@lazyingart/agintiflow 0.20.79 → 0.20.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.79",
+  "version": "0.20.80",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -3,7 +3,7 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { repairModelMessageHistory, runAgent, shouldShortCircuitToolBatch, skippedAfterBlockedToolResult } from "../src/agent-runner.js";
+import { repairModelMessageHistory, runAgent, sanitizeToolResult, shouldShortCircuitToolBatch, skippedAfterBlockedToolResult } from "../src/agent-runner.js";
 import { formatBehaviorContractForPrompt } from "../src/behavior-contract.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import { readCodebaseMap } from "../src/codebase-map.js";
@@ -285,6 +285,17 @@ try {
   const actualDangerAfterQuotePolicy = evaluateCommandPolicy('echo "rm -rf is text" && rm -rf reports', dockerWorkspacePolicy);
   assert(!actualDangerAfterQuotePolicy.allowed, "actual destructive command after quoted text should still be blocked");
   assert(actualDangerAfterQuotePolicy.category === "destructive", "actual destructive command after quoted text was not classified as destructive");
+  const safeChmodAndRunPolicy = evaluateCommandPolicy(
+    'chmod +x /workspace/reports/run_bounded_02079_v2.sh && bash /workspace/reports/run_bounded_02079.sh 2>&1; echo "RUN_COMMAND_EXIT: $?"',
+    dockerWorkspacePolicy
+  );
+  assert(safeChmodAndRunPolicy.allowed, "safe workspace chmod + script run sequence should be allowed in docker-workspace allow mode");
+  const unsafeChmodPolicy = evaluateCommandPolicy("chmod +x /etc/passwd", dockerWorkspacePolicy);
+  assert(!unsafeChmodPolicy.allowed, "chmod outside the workspace should be blocked");
+  const cdWorkspacePolicy = evaluateCommandPolicy("cd /workspace && git status --short 2>&1 | head -20", dockerWorkspacePolicy);
+  assert(cdWorkspacePolicy.allowed, "cd /workspace should be allowed in docker-workspace mode");
+  const gitCleanDryRunPolicy = evaluateCommandPolicy("git clean -nd reports", dockerWorkspacePolicy);
+  assert(gitCleanDryRunPolicy.allowed, "git clean dry-run should be allowed as read-only inspection evidence");
   const unsafeCloneTarget = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git ../AgInTiFlow", dockerWorkspacePolicy);
   assert(!unsafeCloneTarget.allowed, "git clone outside the workspace should be blocked");
   const blockedClonePolicy = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git", {
@@ -401,6 +412,44 @@ try {
   );
   await fs.writeFile(path.join(workspace, "src/index.js"), "export function answer() { return 42; }\n", "utf8");
   await fs.writeFile(path.join(workspace, "test/index.test.js"), "import test from 'node:test';\n", "utf8");
+  const longSmallFile = [
+    "# Small file read smoke",
+    "line 001",
+    "line 002",
+    "line 003",
+    "line 004",
+    "line 005",
+    "line 006",
+    "line 007",
+    "line 008",
+    "line 009",
+    "line 010",
+    "line 011",
+    "line 012",
+    "line 013",
+    "line 014",
+    "line 015",
+    "line 016",
+    "line 017",
+    "line 018",
+    "line 019",
+    "line 020",
+    "FINAL_SENTINEL_SMALL_FILE_FULL_CONTENT",
+    "",
+  ].join("\n");
+  await fs.writeFile(path.join(workspace, "small-read-smoke.md"), longSmallFile, "utf8");
+  const smallReadResult = await executeWorkspaceTool(
+    "read_file",
+    { path: "small-read-smoke.md" },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  const sanitizedSmallRead = sanitizeToolResult(smallReadResult);
+  assert(sanitizedSmallRead.content === longSmallFile, "small read_file result did not keep full content for the model");
+  assert(sanitizedSmallRead.contentTruncated === false, "small read_file result should not be marked truncated");
+  assert(!("contentPreview" in sanitizedSmallRead), "small read_file result should not replace full content with preview");
   const inspected = await executeWorkspaceTool(
     "inspect_project",
     { path: ".", maxDepth: 4, limit: 200 },
@@ -677,12 +726,16 @@ try {
           "auto_system_pro_route",
           "auto_engineering_guidance",
           "command_policy_git_clone_network",
+          "command_policy_safe_chmod_sequence",
+          "command_policy_cd_workspace",
+          "command_policy_git_clean_dry_run",
           "permission_recovery_advice",
           "parallel_scout_trigger",
           "parallel_scout_roster",
           "parallel_scout_count_clamp",
           "web_search_dry_run",
           "inspect_project",
+          "small_read_file_full_content",
           "parallel_scout_context_pack",
           "durable_codebase_map",
           "scout_blackboard",

package/src/agent-runner.js

@@ -780,12 +780,21 @@ async function implicitOverwriteBlock(toolName, args, config, state) {
   };
 }
 
-function sanitizeToolResult(result) {
+const TOOL_RESULT_INLINE_CONTENT_BYTES = 16_000;
+const TOOL_RESULT_CONTENT_PREVIEW_CHARS = 1_200;
+
+export function sanitizeToolResult(result) {
   const safeResult = redactValue(result);
   if (typeof safeResult.content === "string") {
-    safeResult.contentPreview = safeResult.content.slice(0, 600);
-    safeResult.contentBytes = Buffer.byteLength(safeResult.content, "utf8");
-    delete safeResult.content;
+    const contentBytes = Buffer.byteLength(safeResult.content, "utf8");
+    safeResult.contentBytes = contentBytes;
+    if (safeResult.toolName === "read_file" && contentBytes <= TOOL_RESULT_INLINE_CONTENT_BYTES) {
+      safeResult.contentTruncated = false;
+    } else {
+      safeResult.contentPreview = safeResult.content.slice(0, TOOL_RESULT_CONTENT_PREVIEW_CHARS);
+      safeResult.contentTruncated = true;
+      delete safeResult.content;
+    }
   }
   return safeResult;
 }

package/src/command-policy.js

@@ -190,10 +190,34 @@ function isSafeRelativeDir(value) {
 
 function isSafeVirtualWorkspaceDir(value) {
   const normalized = String(value || "").trim();
+  if (normalized === "/workspace") return true;
   if (!normalized.startsWith("/workspace/")) return false;
   return isSafeRelativeDir(normalized.replace(/^\/workspace\//, ""));
 }
 
+function isSafeVirtualWorkspacePath(value) {
+  const normalized = String(value || "").trim();
+  return normalized.startsWith("/workspace/") && isSafeRelativeDir(normalized.replace(/^\/workspace\//, ""));
+}
+
+function isSafeWorkspacePath(value) {
+  return isSafeRelativeDir(value) || isSafeVirtualWorkspacePath(value);
+}
+
+function classifyGitCleanDryRun(normalized) {
+  const match = normalized.match(/^git\s+clean\b([\s\S]*)$/);
+  if (!match) return null;
+  const args = match[1] || "";
+  if (!/(^|\s)(?:-n\b|--dry-run\b|-[A-Za-z]*n[A-Za-z]*\b)/.test(args)) return null;
+  if (/(^|\s)(?:-f\b|--force\b|-[A-Za-z]*f[A-Za-z]*\b)/.test(args)) return null;
+  return {
+    category: "read-only",
+    needsNetwork: false,
+    writesWorkspace: false,
+    reason: "Git clean dry-run is read-only inspection evidence.",
+  };
+}
+
 function classifyGitClone(normalized) {
   const match = normalized.match(
     /^git\s+clone(?:\s+--depth\s+\d+)?(?:\s+--branch\s+[-\w./]+)?\s+(https:\/\/\S+)(?:\s+([-\w./]+))?$/
@@ -224,6 +248,8 @@ function classifySimpleCommand(normalized) {
   if (SENSITIVE_COMMAND_PATTERNS.some((pattern) => pattern.test(normalized))) {
     return { category: "blocked", reason: "Command is blocked because it references secrets or credential files." };
   }
+  const gitCleanDryRun = classifyGitCleanDryRun(normalized);
+  if (gitCleanDryRun) return gitCleanDryRun;
   if (matchAny(UNSAFE_GIT_PATTERNS, normalized)) {
     return {
       category: "destructive",
@@ -242,10 +268,16 @@ function classifySimpleCommand(normalized) {
     return { category: "workspace-write", needsNetwork: false, writesWorkspace: true, virtualWorkspacePath };
   }
   if (matchAny(PERMISSION_CHANGE_PATTERNS, normalized)) {
+    const target = normalized.split(/\s+/).at(-1) || "";
+    const virtualWorkspacePath = isSafeVirtualWorkspacePath(target);
+    if (!isSafeWorkspacePath(target)) {
+      return { category: "blocked", reason: `chmod target must be a safe workspace-relative path: ${target}` };
+    }
     return {
       category: "permission-change",
       needsNetwork: false,
       writesWorkspace: true,
+      virtualWorkspacePath,
       reason: `Command changes workspace file mode: ${normalized}`,
     };
   }
@@ -311,6 +343,68 @@ function classifySimpleCommand(normalized) {
   };
 }
 
+function splitTopLevelShellSequence(command = "") {
+  const parts = [];
+  let current = "";
+  let quote = "";
+  let escaped = false;
+  let hadSeparator = false;
+  const text = String(command || "");
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      current += char;
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      current += char;
+      if (char === quote) quote = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      current += char;
+      quote = char;
+      continue;
+    }
+    if (char === ";" || (char === "&" && text[index + 1] === "&")) {
+      const part = current.trim();
+      if (!part) return null;
+      parts.push(part);
+      current = "";
+      hadSeparator = true;
+      if (char === "&") index += 1;
+      continue;
+    }
+    current += char;
+  }
+  const finalPart = current.trim();
+  if (finalPart) parts.push(finalPart);
+  if (!hadSeparator || parts.length < 2) return null;
+  return parts;
+}
+
+function classifyShellSequence(normalized) {
+  const parts = splitTopLevelShellSequence(normalized);
+  if (!parts) return null;
+  const classifications = parts.map((part) => classifyCdCommand(part) || classifySimpleCommand(part));
+  const blocked = classifications.find((classification) => classification.category === "blocked" || classification.category === "destructive");
+  if (blocked) return blocked;
+  return {
+    category: "general-shell",
+    needsNetwork: classifications.some((classification) => classification.needsNetwork),
+    writesWorkspace: classifications.some((classification) => classification.writesWorkspace),
+    requiresDockerRoot: classifications.some((classification) => classification.requiresDockerRoot),
+    virtualWorkspacePath: classifications.some((classification) => classification.virtualWorkspacePath),
+    reason: `Command sequence uses shell separators with individually classified safe segments: ${normalized}`,
+  };
+}
+
 function classifyCdCommand(normalized) {
   const match = normalized.match(/^cd\s+([-\w./]+)\s+&&\s+(.+)$/);
   if (!match) return null;
@@ -328,7 +422,7 @@ export function classifyCommand(command) {
   const normalized = String(command || "").trim();
   if (!normalized) return { category: "blocked", reason: "Command is empty." };
 
-  return classifyCdCommand(normalized) || classifySimpleCommand(normalized);
+  return classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifySimpleCommand(normalized);
 }
 
 export function evaluateCommandPolicy(command, config) {

package/src/model-client.js

@@ -887,7 +887,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "read_file",
           description:
-            "Read a small UTF-8 workspace file. Secret paths, .git internals, files outside the workspace, binary files, and huge files are blocked.",
+            "Read a small UTF-8 workspace file. Small files return full content; larger files return a truncated preview with contentTruncated=true, so do not quote or reproduce omitted content unless you read it another way. Secret paths, .git internals, files outside the workspace, binary files, and huge files are blocked.",
           parameters: {
             type: "object",
             properties: {