@lazyingart/agintiflow 0.4.1 → 0.6.0

package/src/command-policy.js

@@ -27,12 +27,24 @@ const READ_ONLY_PATTERNS = [
 
 const TEST_PATTERNS = [
   /^npm\s+(run\s+)?(check|test|build|lint)(?:\s+--\s+[-\w./:=]+)*$/,
+  /^npm\s+--prefix\s+[-\w./]+\s+(run\s+)?(check|test|build|lint)(?:\s+--\s+[-\w./:=]+)*$/,
   /^npm\s+test$/,
   /^node\s+--check\s+[-\w./]+$/,
+  /^node\s+--test(?:\s+[-\w./]+)*$/,
+  /^bash\s+-n\s+[-\w./]+\.sh$/,
+  /^sh\s+-n\s+[-\w./]+\.sh$/,
+  /^python(?:3)?\s+-m\s+py_compile\s+[-\w./]+\.py$/,
   /^python(?:3)?\s+-m\s+pytest(?:\s+[-\w./:=]+)*$/,
   /^pytest(?:\s+[-\w./:=]+)*$/,
 ];
 
+const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
+
+const NETWORK_FETCH_PATTERNS = [
+  /^curl\s+(?:-[A-Za-z0-9]*\s+)*https?:\/\/\S+(?:\s+-o\s+[-\w./]+)?$/,
+  /^wget\s+(?:-[A-Za-z0-9]*\s+)*(?:-O\s+[-\w./]+\s+)?https?:\/\/\S+$/,
+];
+
 const TOOLCHAIN_PATTERNS = [
   /^python(?:3)?\s+[-\w./]+\.py(?:\s+[-\w./:=]+)*$/,
   /^latexmk\s+(?=[-\w./=\s]*-pdf\b)(?:(?:-cd|-pdf|-interaction=nonstopmode|-halt-on-error|-output-directory=[-\w./]+)\s+)+[-\w./]+\.tex$/,
@@ -41,12 +53,24 @@ const TOOLCHAIN_PATTERNS = [
 
 const PACKAGE_INSTALL_PATTERNS = [
   /^npm\s+ci$/,
-  /^npm\s+install$/,
+  /^npm\s+install(?:\s+[-@\w./:=]+)*$/,
   /^pnpm\s+install$/,
+  /^pnpm\s+add(?:\s+[-@\w./:=]+)+$/,
   /^yarn\s+install$/,
+  /^yarn\s+add(?:\s+[-@\w./:=]+)+$/,
   /^python(?:3)?\s+-m\s+pip\s+install\s+-r\s+[-\w./]+$/,
+  /^python(?:3)?\s+-m\s+pip\s+install(?:\s+[-@\w./:=]+)+$/,
   /^pip(?:3)?\s+install\s+-r\s+[-\w./]+$/,
+  /^pip(?:3)?\s+install(?:\s+[-@\w./:=]+)+$/,
+  /^uv\s+(sync|pip\s+install)(?:\s+[-@\w./:=]+)*$/,
   /^conda\s+env\s+(create|update)\s+-f\s+[-\w./]+$/,
+  /^conda\s+install(?:\s+[-@\w./:=]+)+$/,
+];
+
+const SYSTEM_PACKAGE_INSTALL_PATTERNS = [
+  /^(?:sudo\s+)?apt(?:-get)?\s+update$/,
+  /^(?:sudo\s+)?apt(?:-get)?\s+install(?:\s+-y)?(?:\s+[-@\w.+:=]+)+$/,
+  /^apk\s+add(?:\s+--no-cache)?(?:\s+[-@\w.+:=]+)+$/,
 ];
 
 const ENV_SETUP_PATTERNS = [
@@ -57,13 +81,10 @@ const ENV_SETUP_PATTERNS = [
 
 const BLOCKED_SHELL_TOKENS = ["&&", "||", ";", "|", ">", "<", "$(", "`"];
 const BLOCKED_WRITE_TOKENS = [
-  "sudo ",
   " rm",
   " mv",
-  " cp",
   " chmod",
   " chown",
-  " mkdir",
   " rmdir",
   " touch",
   " tee",
@@ -76,8 +97,6 @@ const BLOCKED_WRITE_TOKENS = [
   "git switch",
   "git reset",
   "git clean",
-  "curl ",
-  "wget ",
 ];
 
 const ALWAYS_BLOCKED_PATTERNS = [
@@ -91,6 +110,13 @@ const ALWAYS_BLOCKED_PATTERNS = [
   /DEEPSEEK_API_KEY\s*=/i,
 ];
 
+const SENSITIVE_COMMAND_PATTERNS = [
+  /(^|[\s./])\.env(\s|$|[./])/i,
+  /(^|[\s./])\.npmrc(\s|$|[./])/i,
+  /^(env|printenv)(\s|$)/i,
+  /(api[_-]?key|auth[_-]?token|npm[_-]?token|_authToken|bearer\s+[A-Za-z0-9._-]+)/i,
+];
+
 function normalizePolicy(value, allowed, fallback) {
   return allowed.includes(value) ? value : fallback;
 }
@@ -107,20 +133,50 @@ function matchAny(patterns, command) {
   return patterns.some((pattern) => pattern.test(command));
 }
 
-export function classifyCommand(command) {
-  const normalized = String(command || "").trim();
-  if (!normalized) return { category: "blocked", reason: "Command is empty." };
+function isSafeRelativeDir(value) {
+  const normalized = String(value || "").trim();
+  if (!normalized || normalized.startsWith("/") || normalized.startsWith("~")) return false;
+  return normalized.split("/").every((part) => part && part !== "." && part !== "..");
+}
+
+function isSafeVirtualWorkspaceDir(value) {
+  const normalized = String(value || "").trim();
+  if (!normalized.startsWith("/workspace/")) return false;
+  return isSafeRelativeDir(normalized.replace(/^\/workspace\//, ""));
+}
 
+function classifySimpleCommand(normalized) {
   if (ALWAYS_BLOCKED_PATTERNS.some((pattern) => pattern.test(normalized))) {
     return { category: "blocked", reason: "Command is blocked because it may expose secrets or publish packages." };
   }
+  if (SENSITIVE_COMMAND_PATTERNS.some((pattern) => pattern.test(normalized))) {
+    return { category: "blocked", reason: "Command is blocked because it references secrets or credential files." };
+  }
 
   const lowered = ` ${normalized.toLowerCase()} `;
   if (BLOCKED_SHELL_TOKENS.some((part) => normalized.includes(part))) {
-    return { category: "blocked", reason: `Command contains blocked shell syntax: ${normalized}` };
+    return {
+      category: "general-shell",
+      needsNetwork: true,
+      writesWorkspace: true,
+      reason: `Command uses general shell syntax: ${normalized}`,
+    };
+  }
+  if (matchAny(SAFE_WORKSPACE_WRITE_PATTERNS, normalized)) {
+    const target = normalized.replace(/^mkdir\s+-p\s+/, "");
+    const virtualWorkspacePath = isSafeVirtualWorkspaceDir(target);
+    if (!isSafeRelativeDir(target) && !virtualWorkspacePath) {
+      return { category: "blocked", reason: `mkdir target must be a safe workspace-relative directory: ${target}` };
+    }
+    return { category: "workspace-write", needsNetwork: false, writesWorkspace: true, virtualWorkspacePath };
   }
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
-    return { category: "blocked", reason: `Command contains a write-capable or network token: ${normalized}` };
+    return {
+      category: "destructive",
+      needsNetwork: false,
+      writesWorkspace: true,
+      reason: `Command contains a write-capable or destructive token: ${normalized}`,
+    };
   }
 
   if (matchAny(READ_ONLY_PATTERNS, normalized)) {
@@ -132,6 +188,12 @@ export function classifyCommand(command) {
   if (matchAny(TOOLCHAIN_PATTERNS, normalized)) {
     return { category: "toolchain", needsNetwork: false, writesWorkspace: true };
   }
+  if (matchAny(NETWORK_FETCH_PATTERNS, normalized)) {
+    return { category: "network-fetch", needsNetwork: true, writesWorkspace: /(\s-o\s|\s-O\s)/.test(normalized) };
+  }
+  if (matchAny(SYSTEM_PACKAGE_INSTALL_PATTERNS, normalized)) {
+    return { category: "system-package-install", needsNetwork: true, writesWorkspace: false, requiresDockerRoot: true };
+  }
   if (matchAny(PACKAGE_INSTALL_PATTERNS, normalized)) {
     return { category: "package-install", needsNetwork: true, writesWorkspace: true };
   }
@@ -139,18 +201,57 @@ export function classifyCommand(command) {
     return { category: "env-setup", needsNetwork: false, writesWorkspace: true };
   }
 
-  return { category: "blocked", reason: `Command is outside the execution allowlist: ${normalized}` };
+  return {
+    category: "general-shell",
+    needsNetwork: false,
+    writesWorkspace: false,
+    reason: `Command is outside the narrow allowlist and requires a trusted shell policy: ${normalized}`,
+  };
+}
+
+function classifyCdCommand(normalized) {
+  const match = normalized.match(/^cd\s+([-\w./]+)\s+&&\s+(.+)$/);
+  if (!match) return null;
+  const [, dir, inner] = match;
+  const virtualWorkspacePath = isSafeVirtualWorkspaceDir(dir);
+  if (!isSafeRelativeDir(dir) && !virtualWorkspacePath) {
+    return { category: "blocked", reason: `cd target must be a safe workspace-relative directory: ${dir}` };
+  }
+  const innerClassification = classifySimpleCommand(inner.trim());
+  if (innerClassification.category === "blocked") return innerClassification;
+  return { ...innerClassification, cdDir: dir, virtualWorkspacePath };
+}
+
+export function classifyCommand(command) {
+  const normalized = String(command || "").trim();
+  if (!normalized) return { category: "blocked", reason: "Command is empty." };
+
+  return classifyCdCommand(normalized) || classifySimpleCommand(normalized);
 }
 
 export function evaluateCommandPolicy(command, config) {
   const classification = classifyCommand(command);
   const sandboxMode = normalizeSandboxMode(config.sandboxMode);
   const packageInstallPolicy = normalizePackageInstallPolicy(config.packageInstallPolicy);
+  const dockerWorkspace = sandboxMode === "docker-workspace";
+  const packageInstallsAllowed = packageInstallPolicy === "allow";
+  const trustedDockerShell = dockerWorkspace && packageInstallsAllowed;
+  const trustedHostShell = sandboxMode === "host" && Boolean(config.allowDestructive);
 
   if (classification.category === "blocked") {
     return { allowed: false, ...classification, sandboxMode, packageInstallPolicy };
   }
 
+  if (classification.virtualWorkspacePath && !config.useDockerSandbox) {
+    return {
+      allowed: false,
+      ...classification,
+      reason: "Virtual /workspace shell paths are allowed only inside Docker sandbox mode.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
   if (!config.allowShellTool) {
     return {
       allowed: false,
@@ -161,7 +262,11 @@ export function evaluateCommandPolicy(command, config) {
     };
   }
 
-  if (classification.category === "package-install" || classification.category === "env-setup") {
+  if (
+    classification.category === "package-install" ||
+    classification.category === "env-setup" ||
+    classification.category === "system-package-install"
+  ) {
     if (packageInstallPolicy !== "allow") {
       return {
         allowed: false,
@@ -176,17 +281,53 @@ export function evaluateCommandPolicy(command, config) {
       };
     }
 
-    if (sandboxMode !== "docker-workspace") {
+    if (classification.category === "system-package-install" && sandboxMode === "host" && !config.allowDestructive) {
       return {
         allowed: false,
         category: classification.category,
-        reason: "Approved package/environment setup must run in Docker workspace-write sandbox mode.",
+        reason: "Host system package installs require Allow destructive actions. Prefer Docker workspace mode.",
         sandboxMode,
         packageInstallPolicy,
       };
     }
   }
 
+  if (classification.category === "general-shell" && !trustedDockerShell && !trustedHostShell) {
+    return {
+      allowed: false,
+      ...classification,
+      needsApproval: true,
+      reason:
+        sandboxMode === "host"
+          ? "General shell commands on the host require Allow destructive actions. Prefer Docker workspace mode for broad shell access."
+          : "General Docker shell commands require Package installs = allow in docker-workspace mode.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
+  if (classification.category === "destructive" && !config.allowDestructive) {
+    return {
+      allowed: false,
+      ...classification,
+      needsApproval: true,
+      reason: "Destructive shell commands require Allow destructive actions.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
+  if (classification.category === "network-fetch" && config.useDockerSandbox && !trustedDockerShell) {
+    return {
+      allowed: false,
+      ...classification,
+      needsApproval: true,
+      reason: "Docker network commands require docker-workspace mode with Package installs = allow.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
   if (classification.writesWorkspace && config.useDockerSandbox && sandboxMode !== "docker-workspace") {
     return {
       allowed: false,
@@ -200,6 +341,7 @@ export function evaluateCommandPolicy(command, config) {
   return {
     allowed: true,
     ...classification,
+    requiresDockerRoot: Boolean(classification.requiresDockerRoot && config.useDockerSandbox),
     sandboxMode,
     packageInstallPolicy,
   };

package/src/config.js

@@ -71,7 +71,7 @@ export function resolveRuntimeConfig(args, overrides = {}) {
       ? overrides.allowedDomains
       : parseList(process.env.ALLOWED_DOMAINS),
     allowPasswords: parseBoolean(overrides.allowPasswords ?? process.env.ALLOW_PASSWORDS, false),
-    allowDestructive: parseBoolean(overrides.allowDestructive ?? process.env.ALLOW_DESTRUCTIVE, false),
+    allowDestructive: parseBoolean(overrides.allowDestructive ?? args.allowDestructive ?? process.env.ALLOW_DESTRUCTIVE, false),
     allowShellTool: parseBoolean(overrides.allowShellTool ?? args.allowShellTool ?? process.env.ALLOW_SHELL_TOOL, false),
     allowFileTools: parseBoolean(overrides.allowFileTools ?? args.allowFileTools ?? process.env.ALLOW_FILE_TOOLS, true),
     allowWrapperTools: parseBoolean(

package/src/docker-sandbox.js

@@ -168,7 +168,7 @@ export async function ensureDockerSandboxReady(config, observers, options = {})
 function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config)) {
   const uid = typeof process.getuid === "function" ? String(process.getuid()) : "";
   const gid = typeof process.getgid === "function" ? String(process.getgid()) : "";
-  const userArgs = uid && gid ? ["--user", `${uid}:${gid}`] : [];
+  const userArgs = uid && gid && !policy.requiresDockerRoot ? ["--user", `${uid}:${gid}`] : [];
   const sandboxMode = normalizeSandboxMode(config.sandboxMode);
   const mountMode = sandboxMode === "docker-workspace" ? "rw" : "ro";
   const networkMode = policy.needsNetwork ? "bridge" : "none";

package/src/model-client.js

@@ -156,8 +156,10 @@ export async function createPlan(client, config, state) {
             : "",
           `Task profile: ${taskProfile.label}. ${taskProfile.prompt}`,
           "A canvas/artifacts tunnel is available through send_to_canvas. Use it when an output should be highlighted visually, such as screenshots, image files, important markdown, diffs, or generated artifact paths. It is optional for ordinary text answers.",
-          "When the user asks to draw, plot, graph, chart, diagram, create a figure, or visualize something, include a canvas artifact even if the user does not mention canvas. Prefer a small SVG file or concise markdown figure when file tools are available.",
-          "When the user asks for LaTeX, TeX, a paper, manuscript, report, or PDF, plan to create the needed source/assets, compile with the available allowlisted TeX toolchain, and publish the PDF through the canvas tunnel. For subfolder documents, keep outputs beside the source. For generated figures, use pdflatex-compatible formats such as PDF or PNG.",
+          "Work like a practical coding agent: inspect when useful, edit with file tools, run safe checks when they add confidence, and keep outputs inside the workspace.",
+          "Use the canvas tunnel for outputs the user would likely want to inspect visually, such as figures, PDFs, screenshots, images, important markdown, or generated files.",
+          "For environment or system-maintenance work, prefer project-local dry-run plans/scripts unless the configured policy explicitly allows stronger actions.",
+          "Plan for a complete result, not endless exploration; finish once the request is satisfied and checks have passed or been honestly skipped.",
           "Return a numbered plan only.",
         ]
           .filter(Boolean)
@@ -298,7 +300,7 @@ export async function requestNextStep(client, config, messages) {
       function: {
         name: "run_command",
         description:
-          "Run an allowlisted terminal command in the configured working directory. Good for inspection, tests, and approved Docker package/environment setup. NPM publishing, tokens, sudo, arbitrary network commands, and destructive git/file actions are blocked.",
+          "Run a terminal command in the configured working directory under the active shell policy. Secrets and npm publishing are always blocked; Docker workspace mode with approved package installs supports broader network/setup commands, while host destructive or privileged work requires explicit trust.",
         parameters: {
           type: "object",
           properties: {

package/src/task-profiles.js

@@ -10,7 +10,7 @@ export const TASK_PROFILES = {
     id: "code",
     label: "Code writing",
     prompt:
-      "Act like a coding agent: inspect files first, make targeted workspace-local edits, run relevant checks, and report changed files and residual risks.",
+      "Act like a coding agent: understand the request, edit workspace files, run useful safe checks, and report changed files and residual risks.",
     tools: ["files", "shell", "sandbox"],
   },
   writing: {
@@ -45,14 +45,21 @@ export const TASK_PROFILES = {
     id: "node",
     label: "Node",
     prompt:
-      "For Node.js tasks, inspect package scripts, use npm checks/tests when safe, and keep generated files inside the project workspace.",
+      "For Node.js tasks, use the local project structure, add tests when useful, and run safe npm/node checks when available.",
     tools: ["files", "shell", "sandbox"],
   },
+  website: {
+    id: "website",
+    label: "Website testing",
+    prompt:
+      "For website-testing tasks, create or inspect the site, add a local check when useful, and use the configured sandbox/package policy for dependencies.",
+    tools: ["files", "shell", "canvas", "sandbox"],
+  },
   aaps: {
     id: "aaps",
     label: "AAPS",
     prompt:
-      "For AAPS tasks, recognize .aaps folders and @lazyingart/aaps package workflows. Prefer project-local config, safe publish preparation, and explicit secret handling.",
+      "For AAPS tasks, recognize .aaps folders and @lazyingart/aaps workflows, keep work project-local, and avoid secrets or publishing.",
     tools: ["files", "shell", "sandbox"],
   },
   latex: {
@@ -66,7 +73,7 @@ export const TASK_PROFILES = {
     id: "maintenance",
     label: "System maintenance",
     prompt:
-      "For system maintenance, diagnose first, prefer idempotent scripts, ask for approval before privileged or destructive operations, and avoid leaking credentials.",
+      "For system maintenance, diagnose first, use Docker for broad installs when available, and follow the configured trust/package policy for host-level changes.",
     tools: ["shell", "sandbox", "files"],
   },
 };

package/web.js

@@ -13,6 +13,7 @@ import { normalizePackageInstallPolicy, normalizeSandboxMode } from "./src/comma
 import { summarizeWorkspaceTools, WORKSPACE_TOOL_NAMES } from "./src/workspace-tools.js";
 import { listTaskProfiles, normalizeTaskProfile } from "./src/task-profiles.js";
 import { loadProjectEnv, projectPaths, providerKeyStatus, setProviderKey } from "./src/project.js";
+import { buildCapabilityReport } from "./src/capabilities.js";
 import {
   buildArtifacts,
   countUnreadArtifacts,
@@ -24,6 +25,7 @@ import {
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const packageDir = __dirname;
+const packageJson = JSON.parse(await fs.readFile(path.join(packageDir, "package.json"), "utf8"));
 const baseDir = path.resolve(process.env.AGINTIFLOW_RUNTIME_DIR || process.cwd());
 const sessionsDir = path.join(baseDir, ".sessions");
 loadProjectEnv(baseDir);
@@ -539,6 +541,18 @@ app.get("/api/keys/status", (_req, res) => {
   res.json({ ok: true, keyStatus: publicKeyStatus(baseDir) });
 });
 
+app.get("/api/capabilities", async (_req, res) => {
+  const preferences = normalizePreferencePayload({}, db.getPreferences());
+  const config = buildRunConfig({
+    ...preferences,
+    goal: "capabilities",
+    allowShellTool: true,
+    allowFileTools: true,
+  });
+  const report = await buildCapabilityReport(baseDir, packageJson.version, config);
+  res.json(report);
+});
+
 app.post("/api/keys/:provider", async (req, res) => {
   try {
     const result = await setProviderKey(baseDir, req.params.provider, req.body?.apiKey || req.body?.key || "");