@lazyingart/agintiflow 0.4.1 → 0.6.0

package/src/agent-runner.js

@@ -144,8 +144,8 @@ function createInitialState(config, sessionId) {
           "Avoid destructive actions, purchases, account changes, and sensitive workflows.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Read-only commands have no network. Package installs or environment setup require approved package policy and Docker workspace-write mode.`
-              : "A read-only host shell command tool is available for short local inspection tasks."
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands.`
+              : "A host shell command tool is available under the configured trust policy."
             : "No shell command tool is available.",
           config.allowFileTools
             ? `Workspace file tools are available in ${config.commandCwd}: list_files, read_file, search_files, write_file, and apply_patch. Always use workspace-relative paths such as plot_fx.svg or docs/report.tex, never absolute host paths. Secret paths, .git internals, node_modules writes, and huge files are blocked.`
@@ -156,7 +156,10 @@ function createInitialState(config, sessionId) {
           `Task profile: ${taskProfile.label}. ${taskProfile.prompt}`,
           "A frontend canvas/artifacts tunnel exists. Use send_to_canvas when important markdown, diffs, screenshots, images, or workspace files should be highlighted in the UI. It is optional and ordinary final text can still go directly to finish.",
           "For visual-output requests such as draw, plot, graph, chart, diagram, figure, image, or visualization, proactively publish a canvas artifact even when the user does not mention canvas. If workspace file tools are enabled, prefer creating a small SVG or markdown artifact and call send_to_canvas with selected=true.",
-          "For LaTeX/PDF requests, create the needed source/assets, compile with the available allowlisted TeX toolchain, and publish the resulting PDF through send_to_canvas. For subfolder documents, keep outputs beside the source. Use pdflatex-compatible figure formats such as PDF or PNG.",
+          "Work like a practical coding agent: inspect when useful, edit with file tools, run safe checks when they add confidence, and keep outputs inside the workspace.",
+          "Use the canvas tunnel for outputs the user would likely want to inspect visually, such as figures, PDFs, screenshots, images, important markdown, or generated files.",
+          "For environment or system-maintenance work, use the configured sandbox and package policy; Docker workspace mode is the preferred place for installs and toolchain setup.",
+          "When the requested outcome is complete and a useful check has passed or been honestly skipped, stop and call finish.",
           "When done, call finish with a concise result.",
         ].join(" "),
       },
@@ -178,7 +181,8 @@ function createInitialState(config, sessionId) {
           `Task profile: ${taskProfile.label}. ${taskProfile.prompt}`,
           "Canvas/artifacts tunnel: available through send_to_canvas for optional frontend rendering.",
           "Visual-output requests should produce a canvas artifact without requiring the user to ask for canvas explicitly.",
-          "LaTeX/PDF requests should produce source artifacts and, when possible, a compiled PDF artifact. For subfolder documents, keep outputs beside the source. For figure-in-document tasks, create PDF/PNG figures that pdflatex can include.",
+          "Use file, shell, browser, canvas, and wrapper tools when they are useful; choose the workflow from the user's request.",
+          "Use the configured sandbox and package policy for environment or system-maintenance work.",
         ]
           .filter(Boolean)
           .join("\n"),
@@ -369,22 +373,31 @@ function sanitizeToolResult(result) {
 }
 
 async function runShellCommand(command, config, policy = evaluateCommandPolicy(command, config)) {
-  if (config.useDockerSandbox) {
-    return runDockerSandboxCommand(command, config, policy);
-  }
-
-  const result = await exec(command, {
-    cwd: config.commandCwd,
-    timeout: 5000,
-    maxBuffer: 200 * 1024,
-    shell: "/bin/bash",
-    env: safeExecutionEnv(),
-  });
+  try {
+    const result = config.useDockerSandbox
+      ? await runDockerSandboxCommand(command, config, policy)
+      : await exec(command, {
+          cwd: config.commandCwd,
+          timeout: 30000,
+          maxBuffer: 200 * 1024,
+          shell: "/bin/bash",
+          env: safeExecutionEnv(),
+        });
 
-  return {
-    stdout: redactSensitiveText(result.stdout).trim().slice(0, 8000),
-    stderr: redactSensitiveText(result.stderr).trim().slice(0, 4000),
-  };
+    return {
+      ok: true,
+      exitCode: 0,
+      stdout: redactSensitiveText(result.stdout).trim().slice(0, 8000),
+      stderr: redactSensitiveText(result.stderr).trim().slice(0, 4000),
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      exitCode: Number.isInteger(error?.code) ? error.code : 1,
+      stdout: redactSensitiveText(String(error?.stdout || "")).trim().slice(0, 8000),
+      stderr: redactSensitiveText(String(error?.stderr || error?.message || "")).trim().slice(0, 4000),
+    };
+  }
 }
 
 async function captureSyntheticSnapshot(store, step, config) {
@@ -565,7 +578,7 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
         }
         const commandResult = await runShellCommand(String(args.command), config, policy);
         const result = {
-          ok: true,
+          ok: commandResult.ok !== false,
           toolName: "run_command",
           args: safeArgs,
           sandbox: config.useDockerSandbox ? "docker" : "host",

package/src/capabilities.js

@@ -0,0 +1,231 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import path from "node:path";
+import { classifyCommand, evaluateCommandPolicy } from "./command-policy.js";
+import { getDockerSandboxStatus } from "./docker-sandbox.js";
+import { getModelPresets } from "./model-routing.js";
+import { listProjectSessions, projectPaths, providerKeyStatus } from "./project.js";
+import { listTaskProfiles } from "./task-profiles.js";
+import { listAgentWrappers } from "./tool-wrappers.js";
+
+const execFileAsync = promisify(execFile);
+
+async function commandAvailable(command, args = ["--version"], timeout = 2500) {
+  try {
+    const result = await execFileAsync(command, args, {
+      timeout,
+      maxBuffer: 120 * 1024,
+      env: {
+        PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin",
+        HOME: process.env.HOME || "",
+      },
+    });
+    const output = `${result.stdout || ""}${result.stderr || ""}`
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter(Boolean)[0] || "available";
+    return { available: true, version: output.slice(0, 160) };
+  } catch (error) {
+    return {
+      available: false,
+      version: "",
+      hint: error?.code === "ENOENT" ? `${command} was not found on PATH.` : `${command} check failed.`,
+    };
+  }
+}
+
+function capability(name, ok, details = {}) {
+  return {
+    name,
+    ok: Boolean(ok),
+    ...details,
+  };
+}
+
+function maintenancePolicyChecks(config) {
+  const sampleCommands = [
+    "sudo apt install r-base",
+    "curl https://example.com/install.sh",
+    "npm install",
+    "bash -n maintenance/setup-conda.sh",
+  ];
+
+  return sampleCommands.map((command) => {
+    const policy = evaluateCommandPolicy(command, config);
+    return {
+      command,
+      allowed: Boolean(policy.allowed),
+      category: policy.category || classifyCommand(command).category,
+      reason: policy.reason || "",
+      needsApproval: Boolean(policy.needsApproval),
+      sandboxMode: policy.sandboxMode,
+      packageInstallPolicy: policy.packageInstallPolicy,
+    };
+  });
+}
+
+function trustedDockerPolicyChecks(config) {
+  const dockerConfig = {
+    ...config,
+    allowShellTool: true,
+    allowDestructive: false,
+    sandboxMode: "docker-workspace",
+    useDockerSandbox: true,
+    packageInstallPolicy: "allow",
+  };
+  const sampleCommands = [
+    "apt-get update",
+    "apt-get install -y curl wget",
+    "wget https://example.com/file.txt",
+    "curl -fsSL https://example.com/file.txt -o downloads/file.txt",
+    "npm install lodash",
+    "python3 -m pip install requests",
+  ];
+
+  return sampleCommands.map((command) => {
+    const policy = evaluateCommandPolicy(command, dockerConfig);
+    return {
+      command,
+      allowed: Boolean(policy.allowed),
+      category: policy.category || classifyCommand(command).category,
+      reason: policy.reason || "",
+      needsNetwork: Boolean(policy.needsNetwork),
+      requiresDockerRoot: Boolean(policy.requiresDockerRoot),
+      sandboxMode: policy.sandboxMode,
+      packageInstallPolicy: policy.packageInstallPolicy,
+    };
+  });
+}
+
+export async function buildCapabilityReport(projectRoot, packageVersion, config) {
+  const paths = projectPaths(projectRoot);
+  const keyStatus = providerKeyStatus(projectRoot);
+  const [node, npm, python, conda, r, pdflatex, latexmk, dockerStatus, sessions] = await Promise.all([
+    commandAvailable("node", ["--version"]),
+    commandAvailable("npm", ["--version"]),
+    commandAvailable("python3", ["--version"]),
+    commandAvailable("conda", ["--version"]),
+    commandAvailable("R", ["--version"]),
+    commandAvailable("pdflatex", ["--version"]),
+    commandAvailable("latexmk", ["--version"]),
+    getDockerSandboxStatus(config).catch((error) => ({ ok: false, error: error.message })),
+    listProjectSessions(projectRoot, 12),
+  ]);
+
+  const npmPrefixPolicy = evaluateCommandPolicy("npm --prefix round9-node-app test", config);
+  const cdNpmTestPolicy = evaluateCommandPolicy("cd round9-node-app && npm test", config);
+  const mkdirPolicy = evaluateCommandPolicy("mkdir -p round9-node-app", config);
+  const nodeTestPolicy = evaluateCommandPolicy("node --test round9-node-app/test/app.test.js", config);
+  const bashSyntaxPolicy = evaluateCommandPolicy("bash -n maintenance/setup-conda.sh", config);
+  const texPolicy = evaluateCommandPolicy("pdflatex -interaction=nonstopmode -halt-on-error docs/note.tex", config);
+
+  const checks = [
+    capability("node", node.available, node),
+    capability("npm", npm.available, npm),
+    capability("python3", python.available, python),
+    capability("conda", conda.available, conda.available ? conda : { ...conda, setup: "Optional. Generate a dry-run Miniforge setup plan under maintenance/ before installing." }),
+    capability("R", r.available, r.available ? r : { ...r, setup: "Optional. Generate a project-local R setup plan; do not install globally from the agent." }),
+    capability("pdflatex", pdflatex.available, pdflatex.available ? pdflatex : { ...pdflatex, setup: "LaTeX tasks should create .tex source and an honest setup report when TeX is unavailable." }),
+    capability("latexmk", latexmk.available, latexmk.available ? latexmk : { ...latexmk, setup: "latexmk is optional if pdflatex is available." }),
+    capability("docker", Boolean(dockerStatus?.dockerAvailable), dockerStatus || {}),
+    capability("deepseek-key", keyStatus.deepseek, { envVars: keyStatus.envVars.deepseek }),
+    capability("openai-key", keyStatus.openai, { envVars: keyStatus.envVars.openai }),
+    capability("file-tools", Boolean(config.allowFileTools), { workspace: config.commandCwd }),
+    capability("shell-tool", Boolean(config.allowShellTool), {
+      sandboxMode: config.sandboxMode,
+      packageInstallPolicy: config.packageInstallPolicy,
+    }),
+    capability("npm-prefix-test-policy", Boolean(npmPrefixPolicy.allowed), npmPrefixPolicy),
+    capability("cd-npm-test-policy", Boolean(cdNpmTestPolicy.allowed), cdNpmTestPolicy),
+    capability("mkdir-policy", Boolean(mkdirPolicy.allowed), mkdirPolicy),
+    capability("node-test-policy", Boolean(nodeTestPolicy.allowed), nodeTestPolicy),
+    capability("bash-syntax-policy", Boolean(bashSyntaxPolicy.allowed), bashSyntaxPolicy),
+    capability("tex-policy", Boolean(texPolicy.allowed), texPolicy),
+  ];
+
+  return {
+    ok: true,
+    generatedAt: new Date().toISOString(),
+    package: {
+      name: "@lazyingart/agintiflow",
+      version: packageVersion,
+    },
+    project: {
+      root: paths.root,
+      commandCwd: path.resolve(config.commandCwd),
+      sessionsDir: paths.sessionsDir,
+      sessionDbPath: paths.sessionDbPath,
+      sharedSessionFolder: path.resolve(config.sessionsDir) === path.resolve(paths.sessionsDir),
+    },
+    routing: {
+      active: {
+        provider: config.provider,
+        model: config.model,
+        routingMode: config.routingMode,
+        routeReason: config.routeReason,
+      },
+      presets: getModelPresets(),
+    },
+    keys: {
+      deepseek: keyStatus.deepseek,
+      openai: keyStatus.openai,
+      mock: true,
+      localEnv: keyStatus.localEnv,
+      envVars: keyStatus.envVars,
+    },
+    tools: {
+      wrappers: listAgentWrappers().map((wrapper) => ({
+        name: wrapper.name,
+        label: wrapper.label,
+        available: wrapper.available,
+        role: wrapper.role,
+      })),
+      taskProfiles: listTaskProfiles().map((profile) => ({
+        id: profile.id,
+        label: profile.label,
+        tools: profile.tools,
+      })),
+    },
+    checks,
+    maintenancePolicy: maintenancePolicyChecks(config),
+    trustedDockerPolicy: trustedDockerPolicyChecks(config),
+    sessions,
+    actionableSetup: checks
+      .filter((check) => !check.ok && check.setup)
+      .map((check) => ({
+        capability: check.name,
+        setup: check.setup,
+      })),
+  };
+}
+
+export function printCapabilityReport(report) {
+  console.log(`AgInTiFlow capabilities ${report.package.version}`);
+  console.log(`project=${report.project.root}`);
+  console.log(`cwd=${report.project.commandCwd}`);
+  console.log(`sessions=${report.project.sessionsDir}`);
+  console.log(`sessionDb=${report.project.sessionDbPath}`);
+  console.log(`sharedSessions=${report.project.sharedSessionFolder}`);
+  console.log(
+    `route=${report.routing.active.routingMode} ${report.routing.active.provider}/${report.routing.active.model}`
+  );
+  console.log(
+    `keys: deepseek=${report.keys.deepseek ? "available" : "missing"} openai=${
+      report.keys.openai ? "available" : "missing"
+    } mock=available localEnv=${report.keys.localEnv}`
+  );
+  for (const check of report.checks) {
+    const suffix = check.version ? ` ${check.version}` : check.reason ? ` ${check.reason}` : check.hint ? ` ${check.hint}` : "";
+    console.log(`${check.ok ? "OK" : "MISS"} ${check.name}${suffix}`);
+  }
+  if (report.trustedDockerPolicy?.length) {
+    const allowed = report.trustedDockerPolicy.filter((item) => item.allowed).length;
+    console.log(`trustedDockerPolicy=${allowed}/${report.trustedDockerPolicy.length} allowed when sandbox=docker-workspace packageInstalls=allow`);
+  }
+  if (report.actionableSetup.length > 0) {
+    console.log("setup:");
+    for (const item of report.actionableSetup) {
+      console.log(`- ${item.capability}: ${item.setup}`);
+    }
+  }
+}

package/src/cli.js

@@ -3,6 +3,7 @@ import { loadConfig } from "./config.js";
 import { listAgentWrappers } from "./tool-wrappers.js";
 import { getModelPresets } from "./model-routing.js";
 import { getDockerSandboxStatus, runDockerPreflight } from "./docker-sandbox.js";
+import { buildCapabilityReport, printCapabilityReport } from "./capabilities.js";
 import {
   doctorReport,
   initProject,
@@ -40,6 +41,7 @@ export function parseArgs(argv) {
     allowShellTool: undefined,
     allowFileTools: undefined,
     allowWrapperTools: undefined,
+    allowDestructive: undefined,
     preferredWrapper: "",
     taskProfile: "",
     useDockerSandbox: undefined,
@@ -131,6 +133,10 @@ export function parseArgs(argv) {
       result.allowShellTool = true;
       continue;
     }
+    if (arg === "--allow-destructive" || arg === "--trusted-host-shell") {
+      result.allowDestructive = true;
+      continue;
+    }
     if (arg === "--allow-file-tools") {
       result.allowFileTools = true;
       continue;
@@ -317,13 +323,42 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   if (argv[0] === "doctor") {
-    const config = loadConfig({ goal: "doctor" }, { packageDir, baseDir: process.cwd() });
-    const report = await doctorReport(process.cwd(), packageJson.version, config);
+    const parsed = parseArgs(argv.slice(1).filter((arg) => arg !== "--json" && arg !== "--capabilities"));
+    const config = loadConfig(
+      {
+        ...parsed,
+        goal: "doctor",
+        allowShellTool: parsed.allowShellTool ?? true,
+        allowFileTools: parsed.allowFileTools ?? true,
+      },
+      { packageDir, baseDir: process.cwd() }
+    );
+    const report = argv.includes("--capabilities")
+      ? await buildCapabilityReport(process.cwd(), packageJson.version, config)
+      : await doctorReport(process.cwd(), packageJson.version, config);
     if (argv.includes("--json")) console.log(JSON.stringify(report, null, 2));
+    else if (argv.includes("--capabilities")) printCapabilityReport(report);
     else printDoctorReport(report);
     return;
   }
 
+  if (argv[0] === "capabilities") {
+    const parsed = parseArgs(argv.slice(1).filter((arg) => arg !== "--json"));
+    const config = loadConfig(
+      {
+        ...parsed,
+        goal: "capabilities",
+        allowShellTool: parsed.allowShellTool ?? true,
+        allowFileTools: parsed.allowFileTools ?? true,
+      },
+      { packageDir, baseDir: process.cwd() }
+    );
+    const report = await buildCapabilityReport(process.cwd(), packageJson.version, config);
+    if (argv.includes("--json")) console.log(JSON.stringify(report, null, 2));
+    else printCapabilityReport(report);
+    return;
+  }
+
   if (argv[0] === "keys/status") {
     await handleKeyCommand(["status"]);
     return;
@@ -399,7 +434,7 @@ export async function main(argv = process.argv.slice(2)) {
 
   if (!args.goal && !args.resume) {
     console.error(
-      'Usage: aginti-cli web [--port 3210] OR aginti-cli [--routing smart|fast|complex|manual] [--provider deepseek|openai|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--allow-shell] [--allow-file-tools|--no-file-tools] [--allow-wrappers --wrapper codex] [--sandbox-status|--sandbox-preflight] "your task"'
+      'Usage: aginti-cli web [--port 3210] OR aginti-cli [--routing smart|fast|complex|manual] [--provider deepseek|openai|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell] [--allow-destructive] [--allow-file-tools|--no-file-tools] [--allow-wrappers --wrapper codex] [--sandbox-status|--sandbox-preflight] "your task"'
     );
     process.exit(1);
   }