@lazyingart/agintiflow 0.20.89 → 0.20.90

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.89",
+  "version": "0.20.90",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -288,6 +288,18 @@ try {
   );
   assert(readonlyTestEchoPolicy.allowed, "read-only test/echo probe sequence should not require package-install-policy=allow");
   assert(readonlyTestEchoPolicy.category === "read-only", "read-only test/echo probe sequence should be classified as read-only");
+  const pdflatexCompilePolicy = evaluateCommandPolicy(
+    'cd profile-latex-20260506 && pdflatex -interaction=nonstopmode -halt-on-error main.tex 2>&1; echo "PDFLATEX_EXIT:$?"',
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(pdflatexCompilePolicy.allowed, "workspace-local pdflatex compile should be allowed without package installs");
+  assert(pdflatexCompilePolicy.category === "toolchain", "workspace-local pdflatex compile should be classified as toolchain");
+  const latexmkCompilePolicy = evaluateCommandPolicy(
+    'cd profile-latex-20260506 && latexmk -pdf main.tex 2>&1; echo "LATEXMK_EXIT:$?"',
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(latexmkCompilePolicy.allowed, "workspace-local latexmk compile should be allowed without package installs");
+  assert(latexmkCompilePolicy.category === "toolchain", "workspace-local latexmk compile should be classified as toolchain");
   const curlPolicy = evaluateCommandPolicy("curl -s -o /dev/null -w '%{http_code}' https://github.com/lazyingart/AgInTiFlow.git", dockerWorkspacePolicy);
   assert(curlPolicy.allowed, "curl URL probe with flags should be allowed in docker-workspace allow mode");
   assert(curlPolicy.needsNetwork, "curl URL probe with flags was not classified as network");
@@ -750,6 +762,8 @@ try {
           "command_policy_readonly_probe_sequence_no_installs",
           "command_policy_readonly_version_pipeline_no_installs",
           "command_policy_readonly_test_echo_no_installs",
+          "command_policy_pdflatex_compile_no_installs",
+          "command_policy_latexmk_compile_no_installs",
           "command_policy_git_clone_network",
           "command_policy_safe_chmod_sequence",
           "command_policy_cd_workspace",

package/src/command-policy.js

@@ -265,7 +265,7 @@ function classifyGitClone(normalized) {
 }
 
 function classifySimpleCommand(normalized) {
-  const readOnlyCommand = stripBenignRedirections(normalized);
+  const benignRedirectCommand = stripBenignRedirections(normalized);
   if (ALWAYS_BLOCKED_PATTERNS.some((pattern) => pattern.test(normalized))) {
     return { category: "blocked", reason: "Command is blocked because it may expose secrets or publish packages." };
   }
@@ -318,7 +318,7 @@ function classifySimpleCommand(normalized) {
   const gitCloneClassification = classifyGitClone(normalized);
   if (gitCloneClassification) return gitCloneClassification;
 
-  const unquoted = stripQuotedSegments(readOnlyCommand);
+  const unquoted = stripQuotedSegments(benignRedirectCommand);
   const lowered = ` ${unquoted.toLowerCase()} `;
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
     return {
@@ -337,25 +337,25 @@ function classifySimpleCommand(normalized) {
     };
   }
 
-  if (matchAny(READ_ONLY_PATTERNS, readOnlyCommand) || isReadOnlyFindCommand(normalized)) {
+  if (matchAny(READ_ONLY_PATTERNS, benignRedirectCommand) || isReadOnlyFindCommand(normalized)) {
     return { category: "read-only", needsNetwork: false, writesWorkspace: false };
   }
-  if (matchAny(TEST_PATTERNS, normalized)) {
+  if (matchAny(TEST_PATTERNS, benignRedirectCommand)) {
     return { category: "test", needsNetwork: false, writesWorkspace: false };
   }
-  if (matchAny(TOOLCHAIN_PATTERNS, normalized)) {
+  if (matchAny(TOOLCHAIN_PATTERNS, benignRedirectCommand)) {
     return { category: "toolchain", needsNetwork: false, writesWorkspace: true };
   }
-  if (matchAny(NETWORK_FETCH_PATTERNS, normalized)) {
-    return { category: "network-fetch", needsNetwork: true, writesWorkspace: /(\s-o\s|\s-O\s)/.test(normalized) };
+  if (matchAny(NETWORK_FETCH_PATTERNS, benignRedirectCommand)) {
+    return { category: "network-fetch", needsNetwork: true, writesWorkspace: /(\s-o\s|\s-O\s)/.test(benignRedirectCommand) };
   }
-  if (matchAny(SYSTEM_PACKAGE_INSTALL_PATTERNS, normalized)) {
+  if (matchAny(SYSTEM_PACKAGE_INSTALL_PATTERNS, benignRedirectCommand)) {
     return { category: "system-package-install", needsNetwork: true, writesWorkspace: false, requiresDockerRoot: true };
   }
-  if (matchAny(PACKAGE_INSTALL_PATTERNS, normalized)) {
+  if (matchAny(PACKAGE_INSTALL_PATTERNS, benignRedirectCommand)) {
     return { category: "package-install", needsNetwork: true, writesWorkspace: true };
   }
-  if (matchAny(ENV_SETUP_PATTERNS, normalized)) {
+  if (matchAny(ENV_SETUP_PATTERNS, benignRedirectCommand)) {
     return { category: "env-setup", needsNetwork: false, writesWorkspace: true };
   }