@lazyingart/agintiflow 0.20.86 → 0.20.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.86",
+  "version": "0.20.88",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -76,6 +76,7 @@ function runCli(args, inputText) {
         ...process.env,
         AGINTIFLOW_RUNTIME_DIR: "",
         AGINTIFLOW_HOME: agintiflowHome,
+        AGINTIFLOW_PREVIEW_TTL_MS: "1000",
         AGINTI_LANGUAGE: "en",
       },
     });

package/scripts/smoke-coding-tools.js

@@ -266,6 +266,16 @@ try {
     packageInstallPolicy: "allow",
     commandCwd: workspace,
   };
+  const dockerWorkspaceNoInstallsPolicy = {
+    ...dockerWorkspacePolicy,
+    packageInstallPolicy: "block",
+  };
+  const readonlyProbePolicy = evaluateCommandPolicy(
+    'which pdflatex 2>&1; which latexmk 2>&1; echo "---"; find /workspace -name \'*.tex\' -maxdepth 3 2>/dev/null; echo "exit: $?"',
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(readonlyProbePolicy.allowed, "read-only toolchain probe sequence should not require package-install-policy=allow");
+  assert(readonlyProbePolicy.category === "read-only", "read-only toolchain probe sequence should be classified as read-only");
   const curlPolicy = evaluateCommandPolicy("curl -s -o /dev/null -w '%{http_code}' https://github.com/lazyingart/AgInTiFlow.git", dockerWorkspacePolicy);
   assert(curlPolicy.allowed, "curl URL probe with flags should be allowed in docker-workspace allow mode");
   assert(curlPolicy.needsNetwork, "curl URL probe with flags was not classified as network");
@@ -725,6 +735,7 @@ try {
           "large_profile_pro_route",
           "auto_system_pro_route",
           "auto_engineering_guidance",
+          "command_policy_readonly_probe_sequence_no_installs",
           "command_policy_git_clone_network",
           "command_policy_safe_chmod_sequence",
           "command_policy_cd_workspace",

package/scripts/smoke-model-roles.js

@@ -10,7 +10,7 @@ import {
   selectModelRoute,
 } from "../src/model-routing.js";
 import { normalizeTextToolCallResponse, parseTextToolCalls, usesTextToolProtocol } from "../src/model-client.js";
-import { modelRoleChoices } from "../src/interactive-cli.js";
+import { modelRoleChoices, selectorVisibleWindow } from "../src/interactive-cli.js";
 import { buildScsEvidencePack, buildSupervisorInstruction } from "../src/scs-controller.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -151,6 +151,11 @@ assert(!routeChoices.includes("venice/e2ee-venice-uncensored-24b-p"), "shared mo
 assert(modelRoleChoices("route").some((item) => item.provider === "openai" && item.model === "gpt-5.5" && item.reasoningOptions.includes("xhigh")), "OpenAI selector missing reasoning levels");
 assert(modelRoleChoices("auxiliary").some((item) => item.provider === "grsai"), "auxiliary selector missing GRS AI");
 assert(modelRoleChoices("auxiliary").some((item) => item.provider === "venice" && item.model === "wan-2-7-pro-edit"), "auxiliary selector missing Venice Wan edit");
+const longAuxiliaryWindow = selectorVisibleWindow(32, 17, 24);
+assert(longAuxiliaryWindow.end - longAuxiliaryWindow.start <= 8, "selector should cap visible rows for long option lists");
+assert(longAuxiliaryWindow.topHidden > 0 && longAuxiliaryWindow.bottomHidden > 0, "selector should expose scroll indicators around middle selections");
+const topAuxiliaryWindow = selectorVisibleWindow(32, 0, 24);
+assert(topAuxiliaryWindow.start === 0 && topAuxiliaryWindow.bottomHidden > 0, "selector should keep first option visible at top of long lists");
 const parsedTextToolCalls = parseTextToolCalls('[TOOL_CALLS]list_files[ARGS]call_123[ARGS]{"path":".","maxDepth":1}');
 assert(parsedTextToolCalls.length === 1, "Venice text tool-call parser did not detect encoded tool call");
 assert(parsedTextToolCalls[0].function.name === "list_files", "Venice text tool-call parser returned wrong tool name");
@@ -253,6 +258,7 @@ console.log(
         "route-overrides",
         "provider-groups",
         "auxiliary-catalog",
+        "selector-windowing",
         "shared-model-selectors",
         "venice-text-tool-parser",
         "requested-tools-parser",

package/src/agent-runner.js

@@ -151,7 +151,7 @@ async function isPortAvailable(port) {
 async function findAvailablePort(preferredPort = 8765) {
   const preferred = Number(preferredPort);
   const start = Number.isFinite(preferred) && preferred > 0 ? preferred : 8765;
-  for (let port = start; port < start + 80; port += 1) {
+  for (let port = start; port < start + 1000 && port < 65535; port += 1) {
     if (await isPortAvailable(port)) return port;
   }
   throw new Error(`No available preview port found near ${start}.`);

package/src/command-policy.js

@@ -26,6 +26,25 @@ const READ_ONLY_PATTERNS = [
   /^echo(?:\s+.+)?$/,
 ];
 
+function stripBenignRedirections(command = "") {
+  return String(command || "")
+    .replace(/\s+2>&1\b/g, "")
+    .replace(/\s+1>&2\b/g, "")
+    .replace(/\s+2>\/dev\/null\b/g, "")
+    .replace(/\s+1>\/dev\/null\b/g, "")
+    .replace(/\s+>\/dev\/null\b/g, "")
+    .trim();
+}
+
+function isReadOnlyFindCommand(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (!/^find\s+/.test(normalized)) return false;
+  if (/(^|\s)(-delete|-exec|-execdir|-ok|-okdir|-fprint|-fprintf|-fls)\b/.test(normalized)) return false;
+  const unquoted = stripQuotedSegments(normalized);
+  if (/[|<>;&`$]/.test(unquoted)) return false;
+  return /^find\s+(?:[-./~\w]+|\/workspace)(?:\s+[-\w]+(?:\s+(?:"[^"\n]*"|'[^'\n]*'|[^\s|<>;&`$]+))?)*$/.test(normalized);
+}
+
 const TEST_PATTERNS = [
   /^npm\s+(run\s+)?(check|test|build|lint)(?:\s+--\s+[-\w./:=]+)*$/,
   /^npm\s+--prefix\s+[-\w./]+\s+(run\s+)?(check|test|build|lint)(?:\s+--\s+[-\w./:=]+)*$/,
@@ -242,6 +261,7 @@ function classifyGitClone(normalized) {
 }
 
 function classifySimpleCommand(normalized) {
+  const readOnlyCommand = stripBenignRedirections(normalized);
   if (ALWAYS_BLOCKED_PATTERNS.some((pattern) => pattern.test(normalized))) {
     return { category: "blocked", reason: "Command is blocked because it may expose secrets or publish packages." };
   }
@@ -294,7 +314,7 @@ function classifySimpleCommand(normalized) {
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
 
-  const unquoted = stripQuotedSegments(normalized);
+  const unquoted = stripQuotedSegments(readOnlyCommand);
   const lowered = ` ${unquoted.toLowerCase()} `;
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
     return {
@@ -313,7 +333,7 @@ function classifySimpleCommand(normalized) {
     };
   }
 
-  if (matchAny(READ_ONLY_PATTERNS, normalized)) {
+  if (matchAny(READ_ONLY_PATTERNS, readOnlyCommand) || isReadOnlyFindCommand(normalized)) {
     return { category: "read-only", needsNetwork: false, writesWorkspace: false };
   }
   if (matchAny(TEST_PATTERNS, normalized)) {
@@ -395,14 +415,35 @@ function classifyShellSequence(normalized) {
   const classifications = parts.map((part) => classifyCdCommand(part) || classifySimpleCommand(part));
   const blocked = classifications.find((classification) => classification.category === "blocked" || classification.category === "destructive");
   if (blocked) return blocked;
-  return {
-    category: "general-shell",
+  const broad = classifications.find((classification) => classification.category === "general-shell");
+  if (broad) {
+    return {
+      ...broad,
+      reason: `Command sequence includes a broad shell segment and requires trusted shell policy: ${normalized}`,
+    };
+  }
+  const categories = new Set(classifications.map((classification) => classification.category));
+  const aggregate = {
     needsNetwork: classifications.some((classification) => classification.needsNetwork),
     writesWorkspace: classifications.some((classification) => classification.writesWorkspace),
     requiresDockerRoot: classifications.some((classification) => classification.requiresDockerRoot),
     virtualWorkspacePath: classifications.some((classification) => classification.virtualWorkspacePath),
     reason: `Command sequence uses shell separators with individually classified safe segments: ${normalized}`,
   };
+  if (categories.has("system-package-install")) return { category: "system-package-install", ...aggregate };
+  if (categories.has("package-install")) return { category: "package-install", ...aggregate };
+  if (categories.has("env-setup")) return { category: "env-setup", ...aggregate };
+  if (categories.has("permission-change")) return { category: "permission-change", ...aggregate };
+  if (categories.has("git-remote")) return { category: "git-remote", ...aggregate };
+  if (categories.has("network-fetch")) return { category: "network-fetch", ...aggregate };
+  if (categories.has("workspace-write")) return { category: "workspace-write", ...aggregate };
+  if (categories.has("toolchain")) return { category: "toolchain", ...aggregate };
+  if (categories.has("test")) return { category: "test", ...aggregate };
+  if (categories.has("git-workflow")) return { category: "git-workflow", ...aggregate };
+  return {
+    category: "read-only",
+    ...aggregate,
+  };
 }
 
 function classifyCdCommand(normalized) {

package/src/interactive-cli.js

@@ -2220,21 +2220,49 @@ function clearSelectorSequence(lineCount) {
   return Array.from({ length: Math.max(lineCount, 0) }, () => "\x1b[1A\r\x1b[2K").join("");
 }
 
+export function selectorVisibleWindow(optionCount = 0, selectedIndex = 0, height = terminalHeight()) {
+  const count = Math.max(Number(optionCount) || 0, 0);
+  const maxRows = Math.max(4, Math.min(8, Math.floor(Math.max(Number(height) || 24, 10) * 0.36)));
+  if (count <= maxRows) {
+    return { start: 0, end: count, topHidden: 0, bottomHidden: 0 };
+  }
+  const selected = clamp(selectedIndex, 0, count - 1);
+  const half = Math.floor(maxRows / 2);
+  const start = clamp(selected - half, 0, count - maxRows);
+  const end = Math.min(start + maxRows, count);
+  return {
+    start,
+    end,
+    topHidden: start,
+    bottomHidden: count - end,
+  };
+}
+
 function renderSelector({ title, subtitle, options, selectedIndex, lineCount = 0 }) {
   const width = Math.min(Math.max(terminalWidth() - 2, 60), 110);
   const bodyWidth = width - 4;
   const safeTitle = compactLine(title, bodyWidth);
   const safeSubtitle = compactLine(subtitle, bodyWidth);
+  const visible = selectorVisibleWindow(options.length, selectedIndex, terminalHeight());
+  const optionRows = [];
+  if (visible.topHidden > 0) {
+    optionRows.push(`│ ${padVisible(color(`  ... ${visible.topHidden} earlier option${visible.topHidden === 1 ? "" : "s"}`, ansi.dim), bodyWidth)} │`);
+  }
+  for (let index = visible.start; index < visible.end; index += 1) {
+    const option = options[index];
+    const marker = index === selectedIndex ? ">" : " ";
+    const rendered = `${marker} ${compactLine(modelChoiceLine(option), bodyWidth - 2)}`;
+    optionRows.push(`│ ${padVisible(index === selectedIndex ? color(rendered, ansi.userBg, ansi.bold) : rendered, bodyWidth)} │`);
+  }
+  if (visible.bottomHidden > 0) {
+    optionRows.push(`│ ${padVisible(color(`  ... ${visible.bottomHidden} later option${visible.bottomHidden === 1 ? "" : "s"}`, ansi.dim), bodyWidth)} │`);
+  }
   const rows = [
     `╭${"─".repeat(width - 2)}╮`,
     `│ ${padVisible(safeTitle, bodyWidth)} │`,
     `│ ${padVisible(safeSubtitle, bodyWidth)} │`,
     `├${"─".repeat(width - 2)}┤`,
-    ...options.map((option, index) => {
-      const marker = index === selectedIndex ? ">" : " ";
-      const rendered = `${marker} ${compactLine(modelChoiceLine(option), bodyWidth - 2)}`;
-      return `│ ${padVisible(index === selectedIndex ? color(rendered, ansi.userBg, ansi.bold) : rendered, bodyWidth)} │`;
-    }),
+    ...optionRows,
     `╰${"─".repeat(width - 2)}╯`,
   ];
   output.write(`${lineCount > 0 ? clearSelectorSequence(lineCount) : ""}${rows.join("\n")}\n`);

package/src/static-preview-server.js

@@ -5,6 +5,8 @@ import path from "node:path";
 const root = path.resolve(process.argv[2] || process.cwd());
 const port = Number(process.argv[3] || 0);
 const host = "127.0.0.1";
+const idleTtlMs = Math.max(Number(process.env.AGINTIFLOW_PREVIEW_TTL_MS) || 6 * 60 * 60 * 1000, 1000);
+let lastRequestAt = Date.now();
 
 const MIME_TYPES = new Map([
   [".html", "text/html; charset=utf-8"],
@@ -62,6 +64,7 @@ function isBlockedPath(relativePath) {
 }
 
 const server = http.createServer(async (req, res) => {
+  lastRequestAt = Date.now();
   if (!["GET", "HEAD"].includes(req.method || "")) {
     send(res, 405, "Method Not Allowed");
     return;
@@ -110,3 +113,14 @@ server.listen(port, host, () => {
   const actualPort = typeof address === "object" && address ? address.port : port;
   console.log(`AgInTiFlow static preview http://${host}:${actualPort}/ root=${root}`);
 });
+
+const ttlTimer = setInterval(async () => {
+  const rootExists = await fs
+    .stat(root)
+    .then((stat) => stat.isDirectory())
+    .catch(() => false);
+  if (rootExists && Date.now() - lastRequestAt < idleTtlMs) return;
+  server.close(() => process.exit(0));
+  setTimeout(() => process.exit(0), 1000).unref();
+}, Math.min(Math.max(Math.floor(idleTtlMs / 2), 1000), 60_000));
+ttlTimer.unref();