@lazyingart/agintiflow 0.20.91 → 0.20.93

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.91",
+  "version": "0.20.93",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -338,8 +338,21 @@ try {
   assert(localGitCommitPolicy.category === "git-workflow", "local git commit should be classified as git-workflow");
   const localGitSwitchPolicy = evaluateCommandPolicy("git switch -c feature-a", dockerWorkspaceNoInstallsPolicy);
   assert(localGitSwitchPolicy.allowed, "local git switch -c should be allowed without package installs");
+  const localGitCheckoutExistingPolicy = evaluateCommandPolicy("git checkout main", dockerWorkspaceNoInstallsPolicy);
+  assert(localGitCheckoutExistingPolicy.allowed, "local git checkout existing branch should be allowed without package installs");
   const localGitMergePolicy = evaluateCommandPolicy("git merge --ff-only feature-a", dockerWorkspaceNoInstallsPolicy);
   assert(localGitMergePolicy.allowed, "local git fast-forward merge should be allowed without package installs");
+  const localGitNoFfMergePolicy = evaluateCommandPolicy("git merge --no-ff --no-edit feature-b", dockerWorkspaceNoInstallsPolicy);
+  assert(localGitNoFfMergePolicy.allowed, "local git explicit no-ff merge should be allowed without package installs");
+  const localGitNoFfMergeAltPolicy = evaluateCommandPolicy("git merge --no-ff feature-b --no-edit", dockerWorkspaceNoInstallsPolicy);
+  assert(localGitNoFfMergeAltPolicy.allowed, "local git explicit no-ff merge alternate arg order should be allowed");
+  const localGitWorkflowSequencePolicy = evaluateCommandPolicy(
+    "cd /workspace/git-practice && git checkout main && git merge --ff-only feature-a",
+    dockerWorkspaceNoInstallsPolicy
+  );
+  assert(localGitWorkflowSequencePolicy.allowed, "local git checkout + ff-only merge sequence should be allowed without package installs");
+  const plainGitMergePolicy = evaluateCommandPolicy("git merge feature-a", dockerWorkspaceNoInstallsPolicy);
+  assert(!plainGitMergePolicy.allowed, "plain git merge should stay guarded because it can hang or make an ambiguous merge");
   const unsafeRebasePolicy = evaluateCommandPolicy("git rebase main", dockerWorkspaceNoInstallsPolicy);
   assert(!unsafeRebasePolicy.allowed, "git rebase should still require stronger permission because it rewrites history");
   const unsafeCloneTarget = evaluateCommandPolicy("git clone https://github.com/lazyingart/AgInTiFlow.git ../AgInTiFlow", dockerWorkspacePolicy);

package/scripts/smoke-tmux-tools.js

@@ -36,6 +36,10 @@ const dockerConfig = {
   sandboxMode: "docker-workspace",
   packageInstallPolicy: "allow",
 };
+const dockerNoInstallsConfig = {
+  ...dockerConfig,
+  packageInstallPolicy: "block",
+};
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -122,6 +126,52 @@ try {
   });
   assert.equal(dockerTmuxRelativeStart.allowed, true, "Docker-mode tmux_start_session should allow workspace-relative paths");
 
+  const dockerTmuxGitFfMergeStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: {
+      name: `${session}-docker-git-ff`,
+      cwd: ".",
+      command: "git checkout main && git merge --ff-only feature-a",
+    },
+    config: dockerNoInstallsConfig,
+  });
+  assert.equal(dockerTmuxGitFfMergeStart.allowed, true, "Docker-mode tmux should allow explicit local checkout + ff-only merge workflow");
+
+  const dockerTmuxGitPlainMergeStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-docker-git-plain-merge`, cwd: ".", command: "git merge feature-a" },
+    config: dockerNoInstallsConfig,
+  });
+  assert.equal(dockerTmuxGitPlainMergeStart.allowed, false, "Docker-mode tmux should keep plain git merge guarded");
+  assert.equal(dockerTmuxGitPlainMergeStart.category, "destructive", "plain git merge should keep destructive category");
+
+  const dockerTmuxRebaseStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-docker-rebase`, cwd: ".", command: "git rebase main" },
+    config: dockerNoInstallsConfig,
+  });
+  assert.equal(dockerTmuxRebaseStart.allowed, false, "Docker-mode tmux_start_session should not bypass git rebase guard");
+  assert.equal(dockerTmuxRebaseStart.category, "destructive", "Docker tmux rebase block should keep command-policy category");
+
+  const directDockerRebaseStart = await startTmuxSession(
+    { name: `${session}-direct-docker-rebase`, cwd: ".", command: "git rebase main" },
+    dockerNoInstallsConfig
+  );
+  assert.equal(directDockerRebaseStart.ok, false, "tmux_start_session direct path should enforce Docker shell policy");
+
+  const dockerTmuxRebaseSend = await sendTmuxKeys(
+    { target: start.target, text: "git rebase main", enter: true },
+    dockerNoInstallsConfig
+  );
+  assert.equal(dockerTmuxRebaseSend.ok, false, "Docker-mode tmux_send_keys should not bypass git rebase guard in shell panes");
+  assert.equal(dockerTmuxRebaseSend.category, "destructive", "Docker tmux send rebase block should keep command-policy category");
+
+  const dockerTmuxGitStatusSend = await sendTmuxKeys(
+    { target: start.target, text: "git status --short", enter: true },
+    dockerNoInstallsConfig
+  );
+  assert.equal(dockerTmuxGitStatusSend.ok, true, "Docker-mode tmux_send_keys should allow read-only git status in shell panes");
+
   const hostBroadTmuxStart = checkToolUse({
     toolName: "tmux_start_session",
     args: { name: `${session}-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
@@ -203,6 +253,11 @@ try {
           "docker-tmux-send-outside-path-guardrail",
           "docker-tmux-start-project-path-allowed",
           "docker-tmux-start-relative-path-allowed",
+          "docker-tmux-start-command-policy-guardrail",
+          "docker-tmux-start-git-ff-merge-allowed",
+          "docker-tmux-start-plain-git-merge-guarded",
+          "docker-tmux-send-command-policy-guardrail",
+          "docker-tmux-send-readonly-command-allowed",
           "host-tmux-start-shell-policy-guardrail",
           "host-tmux-send-shell-policy-guardrail",
           "host-tmux-control-key-allowed",

package/skills/github-maintenance/SKILL.md

@@ -20,6 +20,6 @@ tools:
 
 Always inspect `git status --short` and relevant diffs before committing or pushing. Keep commits scoped and stop on conflicts, divergence, or unrelated dirty work.
 
-For local workflow practice or repository setup, prefer a disposable subdirectory if the user did not clearly target the current repository. Configure only local git identity (`git config user.name`, `git config user.email`) inside that repo; never change global git config. Use accurate git scenarios: a fast-forward merge means the target branch has not diverged; a non-fast-forward merge intentionally creates a merge commit after both branches diverge; a rebase rewrites local branch commits and should be used only in an explicitly disposable/local branch or after user approval.
+For local workflow practice or repository setup, prefer a disposable subdirectory if the user did not clearly target the current repository. Configure only local git identity (`git config user.name`, `git config user.email`) inside that repo; never change global git config. Use policy-friendly local commands: `git switch <branch>` or `git checkout <branch>` for existing branches, `git switch -c <branch>` or `git checkout -b <branch>` for new branches, `git merge --ff-only <branch>` for fast-forward evidence, and `git merge --no-ff --no-edit <branch>` for explicit merge-commit evidence. Avoid plain `git merge <branch>` because it can hang on an editor or make an ambiguous merge. Use accurate git scenarios: a fast-forward merge means the target branch has not diverged; a non-fast-forward merge intentionally creates a merge commit after both branches diverge; a rebase rewrites local branch commits and should be used only in an explicitly disposable/local branch or after user approval.
 
 Use `gh` for PR/release/status workflows when authenticated. Fold long command output but preserve key errors, URLs, branch names, and commit hashes.

package/src/agent-runner.js

@@ -894,7 +894,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; when sending text into a shell pane, tmux follows the same Docker workspace command policy as run_command and is not a bypass for package installs, destructive git history rewrites, or broad shell text. Use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`

package/src/command-policy.js

@@ -81,9 +81,13 @@ const GIT_WORKFLOW_PATTERNS = [
   /^git\s+branch\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+switch\s+(?:-c\s+)?[A-Za-z0-9][-\w./]*$/,
   /^git\s+checkout\s+-b\s+[A-Za-z0-9][-\w./]*$/,
+  /^git\s+checkout\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+merge\s+--ff-only\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+merge\s+--no-ff\s+--no-edit\s+[A-Za-z0-9][-\w./]*$/,
+  /^git\s+merge\s+--no-ff\s+[A-Za-z0-9][-\w./]*\s+--no-edit$/,
+  /^git\s+merge\s+--no-edit\s+--no-ff\s+[A-Za-z0-9][-\w./]*$/,
   /^git\s+merge\s+[A-Za-z0-9][-\w./]*\s+--no-ff\s+--no-edit$/,
+  /^git\s+merge\s+[A-Za-z0-9][-\w./]*\s+--no-edit\s+--no-ff$/,
   /^git\s+fetch(?:\s+[-\w./:=]+)*$/,
   /^git\s+pull\s+--ff-only(?:\s+[-\w./:=]+)*$/,
   /^git\s+push(?:\s+[-\w./:=]+)*$/,

package/src/model-client.js

@@ -512,7 +512,7 @@ export async function createPlan(client, config, state) {
             ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
-            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound: use relative project paths, not absolute host paths outside the workspace. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
+            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound and shell-pane text follows the same Docker workspace command policy as run_command: use relative project paths, not absolute host paths outside the workspace, and do not use tmux as a workaround for package installs, destructive git rewrites, or broad shell commands. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. For large or unfamiliar repos, plan to call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests and exact files. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language instead of generic names like story.txt or output.txt; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`

package/src/task-profiles.js

@@ -255,7 +255,7 @@ export const TASK_PROFILES = {
     id: "github",
     label: "GitHub maintenance",
     prompt:
-      "Bias toward safe git and GitHub maintenance while still fixing code/docs when asked. Always inspect git status and remotes first, separate unrelated changes, run relevant checks before commits, use gh when available for PR/issues/releases, prefer fast-forward pulls, and stop on conflicts or ambiguous history. For local workflow practice, use a disposable subdirectory, set only local git identity, avoid real remotes unless explicitly requested, and describe fast-forward, non-fast-forward merge, and rebase evidence accurately.",
+      "Bias toward safe git and GitHub maintenance while still fixing code/docs when asked. Always inspect git status and remotes first, separate unrelated changes, run relevant checks before commits, use gh when available for PR/issues/releases, prefer fast-forward pulls, and stop on conflicts or ambiguous history. For local workflow practice, use a disposable subdirectory, set only local git identity, avoid real remotes unless explicitly requested, prefer `git switch <branch>`/`git checkout <branch>` for branch changes, use `git merge --ff-only <branch>` for fast-forward evidence, use `git merge --no-ff --no-edit <branch>` for intentional merge commits, avoid plain `git merge <branch>`, and describe fast-forward, non-fast-forward merge, and rebase evidence accurately.",
     tools: ["shell", "files", "web_search", "inspect_project"],
   },
   word: {

package/src/tmux-tools.js

@@ -153,6 +153,36 @@ function checkHostShellPolicyForTmuxText(text = "", config = {}, label = "tmux t
   };
 }
 
+function shouldApplyDockerShellPolicy(config = {}) {
+  return Boolean(config.useDockerSandbox && config.sandboxMode === "docker-workspace");
+}
+
+function isShellPaneCommand(command = "") {
+  return /^(?:ba|z|fi|da|k)?sh$|^fish$/.test(String(command || "").trim());
+}
+
+async function getPaneCurrentCommand(target) {
+  const result = await runTmux(["display-message", "-p", "-t", target, "#{pane_current_command}"], {
+    timeout: 4000,
+    maxBuffer: 16 * 1024,
+  });
+  if (!result.ok) return "";
+  return String(result.stdout || "").trim();
+}
+
+function checkDockerShellPolicyForTmuxText(text = "", config = {}, label = "tmux text") {
+  const command = String(text || "").trim();
+  if (!command || !shouldApplyDockerShellPolicy(config)) return { ok: true };
+  const policy = evaluateCommandPolicy(command, config);
+  if (policy.allowed) return { ok: true, category: policy.category };
+  return {
+    ok: false,
+    reason: `${label} is blocked by the same Docker workspace shell policy as run_command: ${policy.reason}`,
+    category: policy.category || "tmux",
+    needsApproval: policy.needsApproval,
+  };
+}
+
 function parseSessions(stdout = "") {
   return String(stdout || "")
     .split(/\r?\n/)
@@ -266,6 +296,25 @@ export async function sendTmuxKeys(args = {}, config = {}) {
       needsApproval: hostPolicy.needsApproval,
     };
   }
+  const keyArgsForPolicy = [...keys];
+  if (enter) keyArgsForPolicy.push("Enter");
+  if (text && keyArgsForPolicy.includes("Enter") && shouldApplyDockerShellPolicy(config)) {
+    const paneCommand = await getPaneCurrentCommand(target.target);
+    if (isShellPaneCommand(paneCommand)) {
+      const dockerPolicy = checkDockerShellPolicyForTmuxText(text, config, "tmux text");
+      if (!dockerPolicy.ok) {
+        return {
+          ok: false,
+          toolName: "tmux_send_keys",
+          blocked: true,
+          reason: dockerPolicy.reason,
+          category: dockerPolicy.category,
+          needsApproval: dockerPolicy.needsApproval,
+          paneCommand,
+        };
+      }
+    }
+  }
   for (const key of keys) {
     if (!ALLOWED_KEYS.has(key)) {
       return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: `Unsupported tmux key: ${key}` };
@@ -321,6 +370,17 @@ export async function startTmuxSession(args = {}, config = {}) {
   if (!workspaceBound.ok) {
     return { ok: false, toolName: "tmux_start_session", blocked: true, reason: workspaceBound.reason };
   }
+  const dockerPolicy = checkDockerShellPolicyForTmuxText(command, config, "tmux startup command");
+  if (!dockerPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_start_session",
+      blocked: true,
+      reason: dockerPolicy.reason,
+      category: dockerPolicy.category,
+      needsApproval: dockerPolicy.needsApproval,
+    };
+  }
   const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
   if (!hostPolicy.ok) {
     return {
@@ -402,6 +462,15 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     }
     const workspaceBound = checkWorkspaceBoundTmuxText(command, config, "tmux startup command");
     if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const dockerPolicy = checkDockerShellPolicyForTmuxText(command, config, "tmux startup command");
+    if (!dockerPolicy.ok) {
+      return {
+        allowed: false,
+        reason: dockerPolicy.reason,
+        category: dockerPolicy.category || "tmux",
+        needsApproval: dockerPolicy.needsApproval,
+      };
+    }
     const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
     if (!hostPolicy.ok) {
       return {