@lazyingart/agintiflow 0.20.91 → 0.20.92

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.91",
+  "version": "0.20.92",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-tmux-tools.js

@@ -36,6 +36,10 @@ const dockerConfig = {
   sandboxMode: "docker-workspace",
   packageInstallPolicy: "allow",
 };
+const dockerNoInstallsConfig = {
+  ...dockerConfig,
+  packageInstallPolicy: "block",
+};
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -122,6 +126,33 @@ try {
   });
   assert.equal(dockerTmuxRelativeStart.allowed, true, "Docker-mode tmux_start_session should allow workspace-relative paths");
 
+  const dockerTmuxRebaseStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-docker-rebase`, cwd: ".", command: "git rebase main" },
+    config: dockerNoInstallsConfig,
+  });
+  assert.equal(dockerTmuxRebaseStart.allowed, false, "Docker-mode tmux_start_session should not bypass git rebase guard");
+  assert.equal(dockerTmuxRebaseStart.category, "destructive", "Docker tmux rebase block should keep command-policy category");
+
+  const directDockerRebaseStart = await startTmuxSession(
+    { name: `${session}-direct-docker-rebase`, cwd: ".", command: "git rebase main" },
+    dockerNoInstallsConfig
+  );
+  assert.equal(directDockerRebaseStart.ok, false, "tmux_start_session direct path should enforce Docker shell policy");
+
+  const dockerTmuxRebaseSend = await sendTmuxKeys(
+    { target: start.target, text: "git rebase main", enter: true },
+    dockerNoInstallsConfig
+  );
+  assert.equal(dockerTmuxRebaseSend.ok, false, "Docker-mode tmux_send_keys should not bypass git rebase guard in shell panes");
+  assert.equal(dockerTmuxRebaseSend.category, "destructive", "Docker tmux send rebase block should keep command-policy category");
+
+  const dockerTmuxGitStatusSend = await sendTmuxKeys(
+    { target: start.target, text: "git status --short", enter: true },
+    dockerNoInstallsConfig
+  );
+  assert.equal(dockerTmuxGitStatusSend.ok, true, "Docker-mode tmux_send_keys should allow read-only git status in shell panes");
+
   const hostBroadTmuxStart = checkToolUse({
     toolName: "tmux_start_session",
     args: { name: `${session}-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
@@ -203,6 +234,9 @@ try {
           "docker-tmux-send-outside-path-guardrail",
           "docker-tmux-start-project-path-allowed",
           "docker-tmux-start-relative-path-allowed",
+          "docker-tmux-start-command-policy-guardrail",
+          "docker-tmux-send-command-policy-guardrail",
+          "docker-tmux-send-readonly-command-allowed",
           "host-tmux-start-shell-policy-guardrail",
           "host-tmux-send-shell-policy-guardrail",
           "host-tmux-control-key-allowed",

package/src/agent-runner.js

@@ -894,7 +894,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; when sending text into a shell pane, tmux follows the same Docker workspace command policy as run_command and is not a bypass for package installs, destructive git history rewrites, or broad shell text. Use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`

package/src/model-client.js

@@ -512,7 +512,7 @@ export async function createPlan(client, config, state) {
             ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
-            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound: use relative project paths, not absolute host paths outside the workspace. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
+            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound and shell-pane text follows the same Docker workspace command policy as run_command: use relative project paths, not absolute host paths outside the workspace, and do not use tmux as a workaround for package installs, destructive git rewrites, or broad shell commands. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. For large or unfamiliar repos, plan to call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests and exact files. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language instead of generic names like story.txt or output.txt; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`

package/src/tmux-tools.js

@@ -153,6 +153,36 @@ function checkHostShellPolicyForTmuxText(text = "", config = {}, label = "tmux t
   };
 }
 
+function shouldApplyDockerShellPolicy(config = {}) {
+  return Boolean(config.useDockerSandbox && config.sandboxMode === "docker-workspace");
+}
+
+function isShellPaneCommand(command = "") {
+  return /^(?:ba|z|fi|da|k)?sh$|^fish$/.test(String(command || "").trim());
+}
+
+async function getPaneCurrentCommand(target) {
+  const result = await runTmux(["display-message", "-p", "-t", target, "#{pane_current_command}"], {
+    timeout: 4000,
+    maxBuffer: 16 * 1024,
+  });
+  if (!result.ok) return "";
+  return String(result.stdout || "").trim();
+}
+
+function checkDockerShellPolicyForTmuxText(text = "", config = {}, label = "tmux text") {
+  const command = String(text || "").trim();
+  if (!command || !shouldApplyDockerShellPolicy(config)) return { ok: true };
+  const policy = evaluateCommandPolicy(command, config);
+  if (policy.allowed) return { ok: true, category: policy.category };
+  return {
+    ok: false,
+    reason: `${label} is blocked by the same Docker workspace shell policy as run_command: ${policy.reason}`,
+    category: policy.category || "tmux",
+    needsApproval: policy.needsApproval,
+  };
+}
+
 function parseSessions(stdout = "") {
   return String(stdout || "")
     .split(/\r?\n/)
@@ -266,6 +296,25 @@ export async function sendTmuxKeys(args = {}, config = {}) {
       needsApproval: hostPolicy.needsApproval,
     };
   }
+  const keyArgsForPolicy = [...keys];
+  if (enter) keyArgsForPolicy.push("Enter");
+  if (text && keyArgsForPolicy.includes("Enter") && shouldApplyDockerShellPolicy(config)) {
+    const paneCommand = await getPaneCurrentCommand(target.target);
+    if (isShellPaneCommand(paneCommand)) {
+      const dockerPolicy = checkDockerShellPolicyForTmuxText(text, config, "tmux text");
+      if (!dockerPolicy.ok) {
+        return {
+          ok: false,
+          toolName: "tmux_send_keys",
+          blocked: true,
+          reason: dockerPolicy.reason,
+          category: dockerPolicy.category,
+          needsApproval: dockerPolicy.needsApproval,
+          paneCommand,
+        };
+      }
+    }
+  }
   for (const key of keys) {
     if (!ALLOWED_KEYS.has(key)) {
       return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: `Unsupported tmux key: ${key}` };
@@ -321,6 +370,17 @@ export async function startTmuxSession(args = {}, config = {}) {
   if (!workspaceBound.ok) {
     return { ok: false, toolName: "tmux_start_session", blocked: true, reason: workspaceBound.reason };
   }
+  const dockerPolicy = checkDockerShellPolicyForTmuxText(command, config, "tmux startup command");
+  if (!dockerPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_start_session",
+      blocked: true,
+      reason: dockerPolicy.reason,
+      category: dockerPolicy.category,
+      needsApproval: dockerPolicy.needsApproval,
+    };
+  }
   const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
   if (!hostPolicy.ok) {
     return {
@@ -402,6 +462,15 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     }
     const workspaceBound = checkWorkspaceBoundTmuxText(command, config, "tmux startup command");
     if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const dockerPolicy = checkDockerShellPolicyForTmuxText(command, config, "tmux startup command");
+    if (!dockerPolicy.ok) {
+      return {
+        allowed: false,
+        reason: dockerPolicy.reason,
+        category: dockerPolicy.category || "tmux",
+        needsApproval: dockerPolicy.needsApproval,
+      };
+    }
     const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
     if (!hostPolicy.ok) {
       return {