@lazyingart/agintiflow 0.20.87 → 0.20.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.87",
+  "version": "0.20.89",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -266,6 +266,28 @@ try {
     packageInstallPolicy: "allow",
     commandCwd: workspace,
   };
+  const dockerWorkspaceNoInstallsPolicy = {
+    ...dockerWorkspacePolicy,
+    packageInstallPolicy: "block",
+  };
+  const readonlyProbePolicy = evaluateCommandPolicy(
+    'which pdflatex 2>&1; which latexmk 2>&1; echo "---"; find /workspace -name \'*.tex\' -maxdepth 3 2>/dev/null; echo "exit: $?"',
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(readonlyProbePolicy.allowed, "read-only toolchain probe sequence should not require package-install-policy=allow");
+  assert(readonlyProbePolicy.category === "read-only", "read-only toolchain probe sequence should be classified as read-only");
+  const readonlyVersionPipelinePolicy = evaluateCommandPolicy(
+    "which pdflatex latexmk python3 2>&1; pdflatex --version 2>&1 | head -2; latexmk --version 2>&1 | head -2",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(readonlyVersionPipelinePolicy.allowed, "read-only version probe pipelines should not require package-install-policy=allow");
+  assert(readonlyVersionPipelinePolicy.category === "read-only", "read-only version probe pipelines should be classified as read-only");
+  const readonlyTestEchoPolicy = evaluateCommandPolicy(
+    'test -f /usr/bin/pdflatex && echo "pdflatex: FOUND" || echo "pdflatex: NOT FOUND"; test -f /usr/bin/latexmk && echo "latexmk: FOUND" || echo "latexmk: NOT FOUND"; python3 --version 2>&1',
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(readonlyTestEchoPolicy.allowed, "read-only test/echo probe sequence should not require package-install-policy=allow");
+  assert(readonlyTestEchoPolicy.category === "read-only", "read-only test/echo probe sequence should be classified as read-only");
   const curlPolicy = evaluateCommandPolicy("curl -s -o /dev/null -w '%{http_code}' https://github.com/lazyingart/AgInTiFlow.git", dockerWorkspacePolicy);
   assert(curlPolicy.allowed, "curl URL probe with flags should be allowed in docker-workspace allow mode");
   assert(curlPolicy.needsNetwork, "curl URL probe with flags was not classified as network");
@@ -725,6 +747,9 @@ try {
           "large_profile_pro_route",
           "auto_system_pro_route",
           "auto_engineering_guidance",
+          "command_policy_readonly_probe_sequence_no_installs",
+          "command_policy_readonly_version_pipeline_no_installs",
+          "command_policy_readonly_test_echo_no_installs",
           "command_policy_git_clone_network",
           "command_policy_safe_chmod_sequence",
           "command_policy_cd_workspace",

package/src/command-policy.js

@@ -23,9 +23,32 @@ const READ_ONLY_PATTERNS = [
   /^python(?:3)?\s+--version$/,
   /^pip(?:3)?\s+--version$/,
   /^conda\s+--version$/,
+  /^(?:pdflatex|latexmk)\s+--version$/,
+  /^test\s+-[efdx]\s+[-\w./~]+$/,
+  /^true$/,
+  /^false$/,
   /^echo(?:\s+.+)?$/,
 ];
 
+function stripBenignRedirections(command = "") {
+  return String(command || "")
+    .replace(/\s+2>&1\b/g, "")
+    .replace(/\s+1>&2\b/g, "")
+    .replace(/\s+2>\/dev\/null\b/g, "")
+    .replace(/\s+1>\/dev\/null\b/g, "")
+    .replace(/\s+>\/dev\/null\b/g, "")
+    .trim();
+}
+
+function isReadOnlyFindCommand(command = "") {
+  const normalized = stripBenignRedirections(command);
+  if (!/^find\s+/.test(normalized)) return false;
+  if (/(^|\s)(-delete|-exec|-execdir|-ok|-okdir|-fprint|-fprintf|-fls)\b/.test(normalized)) return false;
+  const unquoted = stripQuotedSegments(normalized);
+  if (/[|<>;&`$]/.test(unquoted)) return false;
+  return /^find\s+(?:[-./~\w]+|\/workspace)(?:\s+[-\w]+(?:\s+(?:"[^"\n]*"|'[^'\n]*'|[^\s|<>;&`$]+))?)*$/.test(normalized);
+}
+
 const TEST_PATTERNS = [
   /^npm\s+(run\s+)?(check|test|build|lint)(?:\s+--\s+[-\w./:=]+)*$/,
   /^npm\s+--prefix\s+[-\w./]+\s+(run\s+)?(check|test|build|lint)(?:\s+--\s+[-\w./:=]+)*$/,
@@ -242,6 +265,7 @@ function classifyGitClone(normalized) {
 }
 
 function classifySimpleCommand(normalized) {
+  const readOnlyCommand = stripBenignRedirections(normalized);
   if (ALWAYS_BLOCKED_PATTERNS.some((pattern) => pattern.test(normalized))) {
     return { category: "blocked", reason: "Command is blocked because it may expose secrets or publish packages." };
   }
@@ -294,7 +318,7 @@ function classifySimpleCommand(normalized) {
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
 
-  const unquoted = stripQuotedSegments(normalized);
+  const unquoted = stripQuotedSegments(readOnlyCommand);
   const lowered = ` ${unquoted.toLowerCase()} `;
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
     return {
@@ -313,7 +337,7 @@ function classifySimpleCommand(normalized) {
     };
   }
 
-  if (matchAny(READ_ONLY_PATTERNS, normalized)) {
+  if (matchAny(READ_ONLY_PATTERNS, readOnlyCommand) || isReadOnlyFindCommand(normalized)) {
     return { category: "read-only", needsNetwork: false, writesWorkspace: false };
   }
   if (matchAny(TEST_PATTERNS, normalized)) {
@@ -372,13 +396,13 @@ function splitTopLevelShellSequence(command = "") {
       quote = char;
       continue;
     }
-    if (char === ";" || (char === "&" && text[index + 1] === "&")) {
+    if (char === ";" || (char === "&" && text[index + 1] === "&") || (char === "|" && text[index + 1] === "|")) {
       const part = current.trim();
       if (!part) return null;
       parts.push(part);
       current = "";
       hadSeparator = true;
-      if (char === "&") index += 1;
+      if (char === "&" || char === "|") index += 1;
       continue;
     }
     current += char;
@@ -392,17 +416,105 @@ function splitTopLevelShellSequence(command = "") {
 function classifyShellSequence(normalized) {
   const parts = splitTopLevelShellSequence(normalized);
   if (!parts) return null;
-  const classifications = parts.map((part) => classifyCdCommand(part) || classifySimpleCommand(part));
+  const classifications = parts.map((part) => classifyCdCommand(part) || classifyPipelineSequence(part) || classifySimpleCommand(part));
   const blocked = classifications.find((classification) => classification.category === "blocked" || classification.category === "destructive");
   if (blocked) return blocked;
-  return {
-    category: "general-shell",
+  const broad = classifications.find((classification) => classification.category === "general-shell");
+  if (broad) {
+    return {
+      ...broad,
+      reason: `Command sequence includes a broad shell segment and requires trusted shell policy: ${normalized}`,
+    };
+  }
+  const categories = new Set(classifications.map((classification) => classification.category));
+  const aggregate = {
     needsNetwork: classifications.some((classification) => classification.needsNetwork),
     writesWorkspace: classifications.some((classification) => classification.writesWorkspace),
     requiresDockerRoot: classifications.some((classification) => classification.requiresDockerRoot),
     virtualWorkspacePath: classifications.some((classification) => classification.virtualWorkspacePath),
     reason: `Command sequence uses shell separators with individually classified safe segments: ${normalized}`,
   };
+  if (categories.has("system-package-install")) return { category: "system-package-install", ...aggregate };
+  if (categories.has("package-install")) return { category: "package-install", ...aggregate };
+  if (categories.has("env-setup")) return { category: "env-setup", ...aggregate };
+  if (categories.has("permission-change")) return { category: "permission-change", ...aggregate };
+  if (categories.has("git-remote")) return { category: "git-remote", ...aggregate };
+  if (categories.has("network-fetch")) return { category: "network-fetch", ...aggregate };
+  if (categories.has("workspace-write")) return { category: "workspace-write", ...aggregate };
+  if (categories.has("toolchain")) return { category: "toolchain", ...aggregate };
+  if (categories.has("test")) return { category: "test", ...aggregate };
+  if (categories.has("git-workflow")) return { category: "git-workflow", ...aggregate };
+  return {
+    category: "read-only",
+    ...aggregate,
+  };
+}
+
+function splitTopLevelPipeline(command = "") {
+  const parts = [];
+  let current = "";
+  let quote = "";
+  let escaped = false;
+  let hadPipe = false;
+  const text = String(command || "");
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      current += char;
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      current += char;
+      if (char === quote) quote = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      current += char;
+      quote = char;
+      continue;
+    }
+    if (char === "|" && text[index + 1] !== "|") {
+      const part = current.trim();
+      if (!part) return null;
+      parts.push(part);
+      current = "";
+      hadPipe = true;
+      continue;
+    }
+    current += char;
+  }
+  const finalPart = current.trim();
+  if (finalPart) parts.push(finalPart);
+  if (!hadPipe || parts.length < 2) return null;
+  return parts;
+}
+
+function classifyPipelineSequence(normalized) {
+  const parts = splitTopLevelPipeline(normalized);
+  if (!parts) return null;
+  const classifications = parts.map((part) => classifyCdCommand(part) || classifySimpleCommand(part));
+  const blocked = classifications.find((classification) => classification.category === "blocked" || classification.category === "destructive");
+  if (blocked) return blocked;
+  if (classifications.every((classification) => classification.category === "read-only")) {
+    return {
+      category: "read-only",
+      needsNetwork: false,
+      writesWorkspace: false,
+      reason: `Read-only shell pipeline: ${normalized}`,
+    };
+  }
+  return {
+    category: "general-shell",
+    needsNetwork: classifications.some((classification) => classification.needsNetwork),
+    writesWorkspace: classifications.some((classification) => classification.writesWorkspace),
+    reason: `Shell pipeline includes a broad segment and requires trusted shell policy: ${normalized}`,
+  };
 }
 
 function classifyCdCommand(normalized) {
@@ -413,7 +525,7 @@ function classifyCdCommand(normalized) {
   if (!isSafeRelativeDir(dir) && !virtualWorkspacePath) {
     return { category: "blocked", reason: `cd target must be a safe workspace-relative directory: ${dir}` };
   }
-  const innerClassification = classifySimpleCommand(inner.trim());
+  const innerClassification = classifyShellSequence(inner.trim()) || classifyPipelineSequence(inner.trim()) || classifySimpleCommand(inner.trim());
   if (innerClassification.category === "blocked") return innerClassification;
   return { ...innerClassification, cdDir: dir, virtualWorkspacePath };
 }
@@ -422,7 +534,7 @@ export function classifyCommand(command) {
   const normalized = String(command || "").trim();
   if (!normalized) return { category: "blocked", reason: "Command is empty." };
 
-  return classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifySimpleCommand(normalized);
+  return classifyCdCommand(normalized) || classifyShellSequence(normalized) || classifyPipelineSequence(normalized) || classifySimpleCommand(normalized);
 }
 
 export function evaluateCommandPolicy(command, config) {