@lazyingart/agintiflow 0.5.0 → 0.6.0

package/README.md

@@ -72,6 +72,7 @@ aginti sessions list
 aginti sessions show <session-id>
 aginti resume <session-id> "continue with a short follow-up"
 aginti --profile code --provider mock --routing manual "Create notes/hello.md"
+aginti --allow-shell --sandbox-mode docker-workspace --approve-package-installs "set up and test this project"
 ```
 
 Run from a source checkout:
@@ -181,12 +182,12 @@ AgInTiFlow is intentionally conservative:
 - Shell commands are disabled unless the shell tool is enabled.
 - Workspace file tools stay inside `commandCwd` and block `.env`, secret-like paths, `.git`, node_modules writes, absolute escapes, binary files, and huge files.
 - File writes record before/after SHA-256 hashes and compact redacted diffs.
-- Guarded shell mode only allows inspection, test/build checks, and approved setup commands.
+- Guarded shell mode is policy-based: normal inspection/tests are available, Docker workspace mode can run broader setup/network commands when package installs are approved, and host privileged/destructive work requires explicit trust.
 - Docker read-only mode mounts the workspace read-only and disables container network access.
 - Docker workspace-write mode is the web UI default so plot, PDF, and test outputs can be written inside the mounted workspace.
-- Docker workspace-write mode is required for approved package or environment setup.
+- Docker workspace-write mode is the preferred place for approved package or environment setup, including `apt-get`, `npm`, `pip`, `curl`, and `wget` workflows inside the container.
 - Package installs default to `prompt`, so npm/pip/conda/venv setup is blocked until explicitly approved.
-- NPM publishing, npm token commands, sudo, destructive git actions, curl/wget, and shell chaining are blocked.
+- NPM publishing, npm token commands, API-key reads, and credential files stay blocked. Broader shell commands require either Docker workspace mode with package policy `allow`, or explicit host trust.
 - NPM tokens and API keys are redacted from tool logs and API responses.
 - Every tool request and result is written to structured logs.
 
@@ -311,9 +312,9 @@ The setup script idempotently builds `agintiflow-sandbox:latest` from `docker/sa
 
 | Mode | Workspace mount | Network | Intended use |
 | --- | --- | --- | --- |
-| `host` | local process | host network | legacy read-only inspection only |
+| `host` | local process | host network | direct project work; privileged/destructive commands require explicit trust |
 | `docker-readonly` | read-only `/workspace` | none | safe coding inspection and tests that do not write files |
-| `docker-workspace` | writable `/workspace` | none by default, enabled only for approved package installs | web UI default for environment setup, plotting, and LaTeX/PDF compilation inside the mounted project |
+| `docker-workspace` | writable `/workspace` | none by default, enabled for approved package/setup/network commands | web UI default for environment setup, plotting, LaTeX/PDF, dependency installs, and broad toolchain work inside the mounted project |
 
 Package policy values:
 
@@ -321,7 +322,7 @@ Package policy values:
 | --- | --- |
 | `block` | Always block npm/pip/conda/venv setup. |
 | `prompt` | Return a clear approval-required error; the UI can switch to approved. |
-| `allow` | Permit allowlisted setup commands only in `docker-workspace`. |
+| `allow` | Permit package/setup commands. Docker workspace mode also allows broader shell/network commands while keeping secrets and npm publishing blocked. |
 
 Toolchain commands such as `python3 plot.py`, `latexmk -pdf paper.tex`, and `pdflatex -interaction=nonstopmode -halt-on-error paper.tex` are allowlisted only when the shell tool is enabled. In Docker mode they require `docker-workspace` because they write outputs back to `/workspace`. File and canvas tools accept both normal relative paths and Docker virtual paths like `/workspace/report.pdf`, while other absolute host paths remain blocked.
 

package/docs/real-deepseek-capabilities.md

@@ -43,8 +43,8 @@ AGINTIFLOW_REAL_DEEPSEEK=1 AGINTIFLOW_REAL_CASES=flash,pro npm run real:deepseek
 - `flash`: DeepSeek v4 flash creates a dependency-free Node/HTML app with `node:test` tests and runs `npm --prefix <app> test` when safe.
 - `pro`: DeepSeek v4 pro resumes/improves the app and expands tests.
 - `latex`: creates `.tex` source and compiles only if a TeX toolchain is available; otherwise writes an honest setup artifact.
-- `website`: creates a dependency-free website test sample and runs safe tests when dependencies are present.
-- `maintenance`: creates dry-run maintenance scripts/plans under `maintenance/` and validates script syntax; no global installs.
+- `website`: creates a website test sample and runs checks with the configured shell/package policy.
+- `maintenance`: verifies the agent can prepare project-local maintenance work and use Docker/package policy for broader setup commands without exposing secrets.
 - `aaps`: creates a project-local `.aaps` sample and notes for `@lazyingart/aaps` workflows without publishing.
 - `web`: when `AGINTIFLOW_REAL_WEB_BASE_URL` is set, starts a web run and verifies CLI/web session sharing.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "description": "AgInTiFlow is a resumable Playwright website-control agent with OpenAI-compatible tool calling.",
   "license": "Apache-2.0",

package/scripts/real-deepseek-capabilities.js

@@ -308,7 +308,7 @@ if (cases.has("website")) {
   const websiteDir = `round9/website-test-${stamp}`;
   const run = await runCliCase(
     "website-test",
-    `Create a small website under ${websiteDir} with a simple local test or check file. Run safe checks if you can without installing packages.`,
+    `Create a small website under ${websiteDir} with a simple local test or check file. Run useful checks under the configured policy.`,
     { routingMode: "fast", taskProfile: "website", maxSteps: 24 }
   );
   report.runs.push(run);
@@ -333,12 +333,12 @@ if (cases.has("maintenance")) {
   const maintenanceDir = `maintenance/round9-${stamp}`;
   const run = await runCliCase(
     "maintenance-plan",
-    `Create project-local dry-run maintenance plans and scripts under ${maintenanceDir} for Miniforge/conda, R, Python tooling, CmdStan/CmdStanR, and PyStan. Validate scripts safely if you can.`,
+    `Create project-local maintenance plans and scripts under ${maintenanceDir} for Miniforge/conda, R, Python tooling, CmdStan/CmdStanR, and PyStan. Use Docker/package policy for setup checks when useful.`,
     {
       routingMode: "complex",
       taskProfile: "maintenance",
       sandboxMode: "docker-workspace",
-      packageInstallPolicy: "block",
+      packageInstallPolicy: "allow",
       maxSteps: 24,
     }
   );

package/scripts/smoke-capabilities.js

@@ -54,6 +54,14 @@ try {
     capabilities.maintenancePolicy.some((check) => check.command.startsWith("sudo") && !check.allowed),
     "sudo maintenance command was not blocked"
   );
+  assert(
+    capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("apt-get install") && check.allowed),
+    "trusted Docker policy did not allow apt-get install"
+  );
+  assert(
+    capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("wget") && check.allowed),
+    "trusted Docker policy did not allow wget"
+  );
 
   const doctor = JSON.parse(await runCli(["doctor", "--capabilities", "--json"]));
   assert(doctor.project.root === tempRoot, "doctor --capabilities used the wrong project root");
@@ -63,7 +71,7 @@ try {
       {
         ok: true,
         projectRoot: tempRoot,
-        checks: ["capabilities-cli", "doctor-capabilities", "maintenance-policy"],
+        checks: ["capabilities-cli", "doctor-capabilities", "maintenance-policy", "trusted-docker-policy"],
       },
       null,
       2

package/scripts/smoke-web-api.js

@@ -90,6 +90,9 @@ try {
   if (!capabilities.checks.some((check) => check.name === "npm-prefix-test-policy")) {
     throw new Error("capability endpoint did not include command policy checks");
   }
+  if (!capabilities.trustedDockerPolicy?.some((check) => check.command.startsWith("apt-get install") && check.allowed)) {
+    throw new Error("capability endpoint did not report trusted Docker package policy");
+  }
   const savedKey = await fetchJson("/api/keys/deepseek", {
     method: "POST",
     headers: { "Content-Type": "application/json" },

package/src/agent-runner.js

@@ -144,8 +144,8 @@ function createInitialState(config, sessionId) {
           "Avoid destructive actions, purchases, account changes, and sensitive workflows.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Read-only commands have no network. Package installs or environment setup require approved package policy and Docker workspace-write mode.`
-              : "A read-only host shell command tool is available for short local inspection tasks."
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands.`
+              : "A host shell command tool is available under the configured trust policy."
             : "No shell command tool is available.",
           config.allowFileTools
             ? `Workspace file tools are available in ${config.commandCwd}: list_files, read_file, search_files, write_file, and apply_patch. Always use workspace-relative paths such as plot_fx.svg or docs/report.tex, never absolute host paths. Secret paths, .git internals, node_modules writes, and huge files are blocked.`
@@ -158,7 +158,7 @@ function createInitialState(config, sessionId) {
           "For visual-output requests such as draw, plot, graph, chart, diagram, figure, image, or visualization, proactively publish a canvas artifact even when the user does not mention canvas. If workspace file tools are enabled, prefer creating a small SVG or markdown artifact and call send_to_canvas with selected=true.",
           "Work like a practical coding agent: inspect when useful, edit with file tools, run safe checks when they add confidence, and keep outputs inside the workspace.",
           "Use the canvas tunnel for outputs the user would likely want to inspect visually, such as figures, PDFs, screenshots, images, important markdown, or generated files.",
-          "For environment or system-maintenance work, prefer project-local dry-run plans/scripts unless the configured policy explicitly allows stronger actions.",
+          "For environment or system-maintenance work, use the configured sandbox and package policy; Docker workspace mode is the preferred place for installs and toolchain setup.",
           "When the requested outcome is complete and a useful check has passed or been honestly skipped, stop and call finish.",
           "When done, call finish with a concise result.",
         ].join(" "),
@@ -182,7 +182,7 @@ function createInitialState(config, sessionId) {
           "Canvas/artifacts tunnel: available through send_to_canvas for optional frontend rendering.",
           "Visual-output requests should produce a canvas artifact without requiring the user to ask for canvas explicitly.",
           "Use file, shell, browser, canvas, and wrapper tools when they are useful; choose the workflow from the user's request.",
-          "Keep environment or system-maintenance actions project-local and reversible unless policy explicitly permits stronger actions.",
+          "Use the configured sandbox and package policy for environment or system-maintenance work.",
         ]
           .filter(Boolean)
           .join("\n"),

package/src/capabilities.js

@@ -64,6 +64,39 @@ function maintenancePolicyChecks(config) {
   });
 }
 
+function trustedDockerPolicyChecks(config) {
+  const dockerConfig = {
+    ...config,
+    allowShellTool: true,
+    allowDestructive: false,
+    sandboxMode: "docker-workspace",
+    useDockerSandbox: true,
+    packageInstallPolicy: "allow",
+  };
+  const sampleCommands = [
+    "apt-get update",
+    "apt-get install -y curl wget",
+    "wget https://example.com/file.txt",
+    "curl -fsSL https://example.com/file.txt -o downloads/file.txt",
+    "npm install lodash",
+    "python3 -m pip install requests",
+  ];
+
+  return sampleCommands.map((command) => {
+    const policy = evaluateCommandPolicy(command, dockerConfig);
+    return {
+      command,
+      allowed: Boolean(policy.allowed),
+      category: policy.category || classifyCommand(command).category,
+      reason: policy.reason || "",
+      needsNetwork: Boolean(policy.needsNetwork),
+      requiresDockerRoot: Boolean(policy.requiresDockerRoot),
+      sandboxMode: policy.sandboxMode,
+      packageInstallPolicy: policy.packageInstallPolicy,
+    };
+  });
+}
+
 export async function buildCapabilityReport(projectRoot, packageVersion, config) {
   const paths = projectPaths(projectRoot);
   const keyStatus = providerKeyStatus(projectRoot);
@@ -155,6 +188,7 @@ export async function buildCapabilityReport(projectRoot, packageVersion, config)
     },
     checks,
     maintenancePolicy: maintenancePolicyChecks(config),
+    trustedDockerPolicy: trustedDockerPolicyChecks(config),
     sessions,
     actionableSetup: checks
       .filter((check) => !check.ok && check.setup)
@@ -184,6 +218,10 @@ export function printCapabilityReport(report) {
     const suffix = check.version ? ` ${check.version}` : check.reason ? ` ${check.reason}` : check.hint ? ` ${check.hint}` : "";
     console.log(`${check.ok ? "OK" : "MISS"} ${check.name}${suffix}`);
   }
+  if (report.trustedDockerPolicy?.length) {
+    const allowed = report.trustedDockerPolicy.filter((item) => item.allowed).length;
+    console.log(`trustedDockerPolicy=${allowed}/${report.trustedDockerPolicy.length} allowed when sandbox=docker-workspace packageInstalls=allow`);
+  }
   if (report.actionableSetup.length > 0) {
     console.log("setup:");
     for (const item of report.actionableSetup) {

package/src/cli.js

@@ -41,6 +41,7 @@ export function parseArgs(argv) {
     allowShellTool: undefined,
     allowFileTools: undefined,
     allowWrapperTools: undefined,
+    allowDestructive: undefined,
     preferredWrapper: "",
     taskProfile: "",
     useDockerSandbox: undefined,
@@ -132,6 +133,10 @@ export function parseArgs(argv) {
       result.allowShellTool = true;
       continue;
     }
+    if (arg === "--allow-destructive" || arg === "--trusted-host-shell") {
+      result.allowDestructive = true;
+      continue;
+    }
     if (arg === "--allow-file-tools") {
       result.allowFileTools = true;
       continue;
@@ -429,7 +434,7 @@ export async function main(argv = process.argv.slice(2)) {
 
   if (!args.goal && !args.resume) {
     console.error(
-      'Usage: aginti-cli web [--port 3210] OR aginti-cli [--routing smart|fast|complex|manual] [--provider deepseek|openai|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--allow-shell] [--allow-file-tools|--no-file-tools] [--allow-wrappers --wrapper codex] [--sandbox-status|--sandbox-preflight] "your task"'
+      'Usage: aginti-cli web [--port 3210] OR aginti-cli [--routing smart|fast|complex|manual] [--provider deepseek|openai|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell] [--allow-destructive] [--allow-file-tools|--no-file-tools] [--allow-wrappers --wrapper codex] [--sandbox-status|--sandbox-preflight] "your task"'
     );
     process.exit(1);
   }

package/src/command-policy.js

@@ -40,6 +40,11 @@ const TEST_PATTERNS = [
 
 const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
 
+const NETWORK_FETCH_PATTERNS = [
+  /^curl\s+(?:-[A-Za-z0-9]*\s+)*https?:\/\/\S+(?:\s+-o\s+[-\w./]+)?$/,
+  /^wget\s+(?:-[A-Za-z0-9]*\s+)*(?:-O\s+[-\w./]+\s+)?https?:\/\/\S+$/,
+];
+
 const TOOLCHAIN_PATTERNS = [
   /^python(?:3)?\s+[-\w./]+\.py(?:\s+[-\w./:=]+)*$/,
   /^latexmk\s+(?=[-\w./=\s]*-pdf\b)(?:(?:-cd|-pdf|-interaction=nonstopmode|-halt-on-error|-output-directory=[-\w./]+)\s+)+[-\w./]+\.tex$/,
@@ -48,12 +53,24 @@ const TOOLCHAIN_PATTERNS = [
 
 const PACKAGE_INSTALL_PATTERNS = [
   /^npm\s+ci$/,
-  /^npm\s+install$/,
+  /^npm\s+install(?:\s+[-@\w./:=]+)*$/,
   /^pnpm\s+install$/,
+  /^pnpm\s+add(?:\s+[-@\w./:=]+)+$/,
   /^yarn\s+install$/,
+  /^yarn\s+add(?:\s+[-@\w./:=]+)+$/,
   /^python(?:3)?\s+-m\s+pip\s+install\s+-r\s+[-\w./]+$/,
+  /^python(?:3)?\s+-m\s+pip\s+install(?:\s+[-@\w./:=]+)+$/,
   /^pip(?:3)?\s+install\s+-r\s+[-\w./]+$/,
+  /^pip(?:3)?\s+install(?:\s+[-@\w./:=]+)+$/,
+  /^uv\s+(sync|pip\s+install)(?:\s+[-@\w./:=]+)*$/,
   /^conda\s+env\s+(create|update)\s+-f\s+[-\w./]+$/,
+  /^conda\s+install(?:\s+[-@\w./:=]+)+$/,
+];
+
+const SYSTEM_PACKAGE_INSTALL_PATTERNS = [
+  /^(?:sudo\s+)?apt(?:-get)?\s+update$/,
+  /^(?:sudo\s+)?apt(?:-get)?\s+install(?:\s+-y)?(?:\s+[-@\w.+:=]+)+$/,
+  /^apk\s+add(?:\s+--no-cache)?(?:\s+[-@\w.+:=]+)+$/,
 ];
 
 const ENV_SETUP_PATTERNS = [
@@ -64,13 +81,10 @@ const ENV_SETUP_PATTERNS = [
 
 const BLOCKED_SHELL_TOKENS = ["&&", "||", ";", "|", ">", "<", "$(", "`"];
 const BLOCKED_WRITE_TOKENS = [
-  "sudo ",
   " rm",
   " mv",
-  " cp",
   " chmod",
   " chown",
-  " mkdir",
   " rmdir",
   " touch",
   " tee",
@@ -83,8 +97,6 @@ const BLOCKED_WRITE_TOKENS = [
   "git switch",
   "git reset",
   "git clean",
-  "curl ",
-  "wget ",
 ];
 
 const ALWAYS_BLOCKED_PATTERNS = [
@@ -98,6 +110,13 @@ const ALWAYS_BLOCKED_PATTERNS = [
   /DEEPSEEK_API_KEY\s*=/i,
 ];
 
+const SENSITIVE_COMMAND_PATTERNS = [
+  /(^|[\s./])\.env(\s|$|[./])/i,
+  /(^|[\s./])\.npmrc(\s|$|[./])/i,
+  /^(env|printenv)(\s|$)/i,
+  /(api[_-]?key|auth[_-]?token|npm[_-]?token|_authToken|bearer\s+[A-Za-z0-9._-]+)/i,
+];
+
 function normalizePolicy(value, allowed, fallback) {
   return allowed.includes(value) ? value : fallback;
 }
@@ -130,10 +149,18 @@ function classifySimpleCommand(normalized) {
   if (ALWAYS_BLOCKED_PATTERNS.some((pattern) => pattern.test(normalized))) {
     return { category: "blocked", reason: "Command is blocked because it may expose secrets or publish packages." };
   }
+  if (SENSITIVE_COMMAND_PATTERNS.some((pattern) => pattern.test(normalized))) {
+    return { category: "blocked", reason: "Command is blocked because it references secrets or credential files." };
+  }
 
   const lowered = ` ${normalized.toLowerCase()} `;
   if (BLOCKED_SHELL_TOKENS.some((part) => normalized.includes(part))) {
-    return { category: "blocked", reason: `Command contains blocked shell syntax: ${normalized}` };
+    return {
+      category: "general-shell",
+      needsNetwork: true,
+      writesWorkspace: true,
+      reason: `Command uses general shell syntax: ${normalized}`,
+    };
   }
   if (matchAny(SAFE_WORKSPACE_WRITE_PATTERNS, normalized)) {
     const target = normalized.replace(/^mkdir\s+-p\s+/, "");
@@ -144,7 +171,12 @@ function classifySimpleCommand(normalized) {
     return { category: "workspace-write", needsNetwork: false, writesWorkspace: true, virtualWorkspacePath };
   }
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
-    return { category: "blocked", reason: `Command contains a write-capable or network token: ${normalized}` };
+    return {
+      category: "destructive",
+      needsNetwork: false,
+      writesWorkspace: true,
+      reason: `Command contains a write-capable or destructive token: ${normalized}`,
+    };
   }
 
   if (matchAny(READ_ONLY_PATTERNS, normalized)) {
@@ -156,6 +188,12 @@ function classifySimpleCommand(normalized) {
   if (matchAny(TOOLCHAIN_PATTERNS, normalized)) {
     return { category: "toolchain", needsNetwork: false, writesWorkspace: true };
   }
+  if (matchAny(NETWORK_FETCH_PATTERNS, normalized)) {
+    return { category: "network-fetch", needsNetwork: true, writesWorkspace: /(\s-o\s|\s-O\s)/.test(normalized) };
+  }
+  if (matchAny(SYSTEM_PACKAGE_INSTALL_PATTERNS, normalized)) {
+    return { category: "system-package-install", needsNetwork: true, writesWorkspace: false, requiresDockerRoot: true };
+  }
   if (matchAny(PACKAGE_INSTALL_PATTERNS, normalized)) {
     return { category: "package-install", needsNetwork: true, writesWorkspace: true };
   }
@@ -163,7 +201,12 @@ function classifySimpleCommand(normalized) {
     return { category: "env-setup", needsNetwork: false, writesWorkspace: true };
   }
 
-  return { category: "blocked", reason: `Command is outside the execution allowlist: ${normalized}` };
+  return {
+    category: "general-shell",
+    needsNetwork: false,
+    writesWorkspace: false,
+    reason: `Command is outside the narrow allowlist and requires a trusted shell policy: ${normalized}`,
+  };
 }
 
 function classifyCdCommand(normalized) {
@@ -190,6 +233,10 @@ export function evaluateCommandPolicy(command, config) {
   const classification = classifyCommand(command);
   const sandboxMode = normalizeSandboxMode(config.sandboxMode);
   const packageInstallPolicy = normalizePackageInstallPolicy(config.packageInstallPolicy);
+  const dockerWorkspace = sandboxMode === "docker-workspace";
+  const packageInstallsAllowed = packageInstallPolicy === "allow";
+  const trustedDockerShell = dockerWorkspace && packageInstallsAllowed;
+  const trustedHostShell = sandboxMode === "host" && Boolean(config.allowDestructive);
 
   if (classification.category === "blocked") {
     return { allowed: false, ...classification, sandboxMode, packageInstallPolicy };
@@ -215,7 +262,11 @@ export function evaluateCommandPolicy(command, config) {
     };
   }
 
-  if (classification.category === "package-install" || classification.category === "env-setup") {
+  if (
+    classification.category === "package-install" ||
+    classification.category === "env-setup" ||
+    classification.category === "system-package-install"
+  ) {
     if (packageInstallPolicy !== "allow") {
       return {
         allowed: false,
@@ -230,17 +281,53 @@ export function evaluateCommandPolicy(command, config) {
       };
     }
 
-    if (sandboxMode !== "docker-workspace") {
+    if (classification.category === "system-package-install" && sandboxMode === "host" && !config.allowDestructive) {
       return {
         allowed: false,
         category: classification.category,
-        reason: "Approved package/environment setup must run in Docker workspace-write sandbox mode.",
+        reason: "Host system package installs require Allow destructive actions. Prefer Docker workspace mode.",
         sandboxMode,
         packageInstallPolicy,
       };
     }
   }
 
+  if (classification.category === "general-shell" && !trustedDockerShell && !trustedHostShell) {
+    return {
+      allowed: false,
+      ...classification,
+      needsApproval: true,
+      reason:
+        sandboxMode === "host"
+          ? "General shell commands on the host require Allow destructive actions. Prefer Docker workspace mode for broad shell access."
+          : "General Docker shell commands require Package installs = allow in docker-workspace mode.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
+  if (classification.category === "destructive" && !config.allowDestructive) {
+    return {
+      allowed: false,
+      ...classification,
+      needsApproval: true,
+      reason: "Destructive shell commands require Allow destructive actions.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
+  if (classification.category === "network-fetch" && config.useDockerSandbox && !trustedDockerShell) {
+    return {
+      allowed: false,
+      ...classification,
+      needsApproval: true,
+      reason: "Docker network commands require docker-workspace mode with Package installs = allow.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
   if (classification.writesWorkspace && config.useDockerSandbox && sandboxMode !== "docker-workspace") {
     return {
       allowed: false,
@@ -254,6 +341,7 @@ export function evaluateCommandPolicy(command, config) {
   return {
     allowed: true,
     ...classification,
+    requiresDockerRoot: Boolean(classification.requiresDockerRoot && config.useDockerSandbox),
     sandboxMode,
     packageInstallPolicy,
   };

package/src/config.js

@@ -71,7 +71,7 @@ export function resolveRuntimeConfig(args, overrides = {}) {
       ? overrides.allowedDomains
       : parseList(process.env.ALLOWED_DOMAINS),
     allowPasswords: parseBoolean(overrides.allowPasswords ?? process.env.ALLOW_PASSWORDS, false),
-    allowDestructive: parseBoolean(overrides.allowDestructive ?? process.env.ALLOW_DESTRUCTIVE, false),
+    allowDestructive: parseBoolean(overrides.allowDestructive ?? args.allowDestructive ?? process.env.ALLOW_DESTRUCTIVE, false),
     allowShellTool: parseBoolean(overrides.allowShellTool ?? args.allowShellTool ?? process.env.ALLOW_SHELL_TOOL, false),
     allowFileTools: parseBoolean(overrides.allowFileTools ?? args.allowFileTools ?? process.env.ALLOW_FILE_TOOLS, true),
     allowWrapperTools: parseBoolean(

package/src/docker-sandbox.js

@@ -168,7 +168,7 @@ export async function ensureDockerSandboxReady(config, observers, options = {})
 function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config)) {
   const uid = typeof process.getuid === "function" ? String(process.getuid()) : "";
   const gid = typeof process.getgid === "function" ? String(process.getgid()) : "";
-  const userArgs = uid && gid ? ["--user", `${uid}:${gid}`] : [];
+  const userArgs = uid && gid && !policy.requiresDockerRoot ? ["--user", `${uid}:${gid}`] : [];
   const sandboxMode = normalizeSandboxMode(config.sandboxMode);
   const mountMode = sandboxMode === "docker-workspace" ? "rw" : "ro";
   const networkMode = policy.needsNetwork ? "bridge" : "none";

package/src/model-client.js

@@ -300,7 +300,7 @@ export async function requestNextStep(client, config, messages) {
       function: {
         name: "run_command",
         description:
-          "Run an allowlisted terminal command in the configured working directory. Good for inspection, tests, and approved Docker package/environment setup. NPM publishing, tokens, sudo, arbitrary network commands, and destructive git/file actions are blocked.",
+          "Run a terminal command in the configured working directory under the active shell policy. Secrets and npm publishing are always blocked; Docker workspace mode with approved package installs supports broader network/setup commands, while host destructive or privileged work requires explicit trust.",
         parameters: {
           type: "object",
           properties: {

package/src/task-profiles.js

@@ -52,7 +52,7 @@ export const TASK_PROFILES = {
     id: "website",
     label: "Website testing",
     prompt:
-      "For website-testing tasks, create or inspect the site, add a simple local test/check file when useful, and run safe checks without installing packages unless approved.",
+      "For website-testing tasks, create or inspect the site, add a local check when useful, and use the configured sandbox/package policy for dependencies.",
     tools: ["files", "shell", "canvas", "sandbox"],
   },
   aaps: {
@@ -73,7 +73,7 @@ export const TASK_PROFILES = {
     id: "maintenance",
     label: "System maintenance",
     prompt:
-      "For system maintenance, diagnose first, prefer reversible project-local plans or dry-run scripts, and avoid privileged/global/destructive actions unless explicitly approved.",
+      "For system maintenance, diagnose first, use Docker for broad installs when available, and follow the configured trust/package policy for host-level changes.",
     tools: ["shell", "sandbox", "files"],
   },
 };