@lazyingart/agintiflow 0.6.0 → 0.8.0

package/README.md

@@ -43,9 +43,19 @@ aginti init
 aginti doctor
 aginti --list-routes
 aginti --list-profiles
-aginti --sandbox-status --sandbox-mode docker-readonly
+aginti --sandbox-status
 ```
 
+Start an interactive Codex-style CLI chat from any project folder:
+
+```bash
+aginti
+# or explicitly:
+aginti chat
+```
+
+Inside chat, type normal requests such as `write a small Python CLI app with tests`. The default is now Docker workspace mode with approved package installs, so coding, plotting, and LaTeX tasks can set up project-local tools without touching the host. Use `/help` for commands, `/latex on` for PDF work, `/docker off` only when you intentionally want host mode, `/sessions` to list project runs, and `/resume <session-id>` to continue work.
+
 Launch the local web UI from an installed package:
 
 ```bash
@@ -71,8 +81,10 @@ aginti doctor --capabilities
 aginti sessions list
 aginti sessions show <session-id>
 aginti resume <session-id> "continue with a short follow-up"
-aginti --profile code --provider mock --routing manual "Create notes/hello.md"
-aginti --allow-shell --sandbox-mode docker-workspace --approve-package-installs "set up and test this project"
+aginti queue <session-id> "extra instruction for the running agent"
+aginti --profile code "write a small Python CLI app with tests"
+aginti --latex "draw a figure, write a short LaTeX report, and compile the PDF"
+aginti "set up this project and run the tests"
 ```
 
 Run from a source checkout:
@@ -184,9 +196,9 @@ AgInTiFlow is intentionally conservative:
 - File writes record before/after SHA-256 hashes and compact redacted diffs.
 - Guarded shell mode is policy-based: normal inspection/tests are available, Docker workspace mode can run broader setup/network commands when package installs are approved, and host privileged/destructive work requires explicit trust.
 - Docker read-only mode mounts the workspace read-only and disables container network access.
-- Docker workspace-write mode is the web UI default so plot, PDF, and test outputs can be written inside the mounted workspace.
-- Docker workspace-write mode is the preferred place for approved package or environment setup, including `apt-get`, `npm`, `pip`, `curl`, and `wget` workflows inside the container.
-- Package installs default to `prompt`, so npm/pip/conda/venv setup is blocked until explicitly approved.
+- Docker workspace-write mode is the CLI/web default so plot, PDF, and test outputs can be written inside the mounted workspace.
+- Docker workspace-write mode with package policy `allow` is the default for normal agent work. It permits practical setup commands such as `npm`, `pip`, `conda`, `curl`, `wget`, and `chmod` inside Docker while keeping host sudo/global installs blocked.
+- Host mode falls back to `prompt`, so npm/pip/conda/venv setup and privileged/destructive commands require explicit trust.
 - NPM publishing, npm token commands, API-key reads, and credential files stay blocked. Broader shell commands require either Docker workspace mode with package policy `allow`, or explicit host trust.
 - NPM tokens and API keys are redacted from tool logs and API responses.
 - Every tool request and result is written to structured logs.
@@ -306,7 +318,7 @@ Build the companion agent toolchain sandbox:
 npm run smoke:toolchain-docker
 ```
 
-The setup script idempotently builds `agintiflow-sandbox:latest` from `docker/sandbox.Dockerfile` and verifies Node, npm, Python, NumPy, Matplotlib, `latexmk`, and `pdflatex` inside Docker. The smoke script runs Python plot generation, LaTeX PDF compilation, and PDF artifact preview against the same workspace-mounted sandbox path used by the agent.
+The setup script idempotently builds `agintiflow-sandbox:latest` from `docker/sandbox.Dockerfile` and verifies Node, npm, Python, NumPy, Matplotlib, `latexmk`, and `pdflatex` inside Docker. It also creates the persistent companion folders under `~/.agintiflow/docker/`: `home/` maps to `/aginti-home`, `cache/` maps to `/aginti-cache`, and `env/` maps to `/aginti-env`. Python/conda-style toolchains should live under `/aginti-env` so they survive across agent runs. OS package changes from `apt-get` are container-ephemeral unless you rebuild the image.
 
 ## Sandbox Modes
 
@@ -324,7 +336,9 @@ Package policy values:
 | `prompt` | Return a clear approval-required error; the UI can switch to approved. |
 | `allow` | Permit package/setup commands. Docker workspace mode also allows broader shell/network commands while keeping secrets and npm publishing blocked. |
 
-Toolchain commands such as `python3 plot.py`, `latexmk -pdf paper.tex`, and `pdflatex -interaction=nonstopmode -halt-on-error paper.tex` are allowlisted only when the shell tool is enabled. In Docker mode they require `docker-workspace` because they write outputs back to `/workspace`. File and canvas tools accept both normal relative paths and Docker virtual paths like `/workspace/report.pdf`, while other absolute host paths remain blocked.
+Toolchain commands such as `python3 plot.py`, `latexmk -pdf paper.tex`, and `pdflatex -interaction=nonstopmode -halt-on-error paper.tex` are allowlisted only when the shell tool is enabled. In Docker mode the project folder is mounted as `/workspace`; any file written to `/workspace/report.pdf` appears on the host as `<your-project>/report.pdf`. CLI runs print both the host workspace and the Docker mapping before execution. File and canvas tools accept both normal relative paths and Docker virtual paths like `/workspace/report.pdf`, while other absolute host paths remain blocked.
+
+The web chat mirrors the CLI session store. Enter sends, Ctrl+J inserts a newline, and Tab submits/queues the message. Queued input is written to `.sessions/<session-id>/inbox.jsonl`; the running agent drains that pipe between steps and after tool calls.
 
 Safe preflight endpoints:
 

package/docs/agent-runtime-pipe.md

@@ -0,0 +1,14 @@
+# Agent Runtime Pipe
+
+AgInTiFlow keeps CLI and web runs equivalent by using the project folder as the source of truth.
+
+- Project root: the folder where `aginti` or `aginti web` is launched.
+- Session store: `<project>/.sessions/`.
+- Web settings database: `<project>/.sessions/web-state.sqlite`.
+- Runtime inbox: `<project>/.sessions/<session-id>/inbox.jsonl`.
+
+When a run is active, the web chat and `aginti queue <session-id> "..."` append messages to the inbox instead of trying to mutate the running process directly. The runner drains the inbox at safe boundaries: before each model step and after tool execution. This mirrors the event-queue style used by mature agent UIs while keeping the backend decoupled from any specific frontend.
+
+Default execution is Docker workspace mode with package installs approved inside the sandbox. The project is mounted at `/workspace`; persistent agent toolchain folders are mounted at `/aginti-home`, `/aginti-cache`, and `/aginti-env` from `~/.agintiflow/docker/`. Python, conda, and other language-level environments should be installed under `/aginti-env` so they survive across runs. Apt/apk package changes are ephemeral unless the Docker image is rebuilt.
+
+The failed `f(f(x)) = f'(x)` LaTeX task exposed three issues: host-mode command policy blocked setup/path commands, a 15-step budget was too small for iterative numerical work plus TeX output, and follow-up input could not be queued while the agent was running. The current runtime defaults and inbox pipe address those without hardcoding that specific math task.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "AgInTiFlow is a resumable Playwright website-control agent with OpenAI-compatible tool calling.",
   "license": "Apache-2.0",
@@ -41,8 +41,10 @@
     "scripts/install-docker-ubuntu.sh",
     "scripts/setup-agent-toolchain-docker.sh",
     "scripts/real-deepseek-capabilities.js",
+    "scripts/smoke-cli-chat.js",
     "scripts/smoke-coding-tools.js",
     "scripts/smoke-capabilities.js",
+    "scripts/smoke-inbox.js",
     "scripts/smoke-toolchain-docker.js",
     "scripts/smoke-web-api.js",
     "src/",
@@ -59,10 +61,12 @@
     "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check src/*.js",
     "setup:toolchain-docker": "scripts/setup-agent-toolchain-docker.sh",
     "smoke:coding-tools": "node scripts/smoke-coding-tools.js",
+    "smoke:cli-chat": "node scripts/smoke-cli-chat.js",
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
+    "smoke:inbox": "node scripts/smoke-inbox.js",
     "smoke:web-api": "node scripts/smoke-web-api.js",
     "real:deepseek": "node scripts/real-deepseek-capabilities.js",
-    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:capabilities",
+    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:capabilities && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/public/app.js

@@ -114,7 +114,9 @@ const translations = {
     messageRequired: "Message is required.",
     sendingStatus: "Sending...",
     runningStatus: "Running...",
+    queuedStatus: "Queued for the running agent.",
     failedContinue: "Failed to continue the conversation.",
+    chatShortcutHelp: "Enter sends · Ctrl+J inserts a newline · Tab queues while the agent is running",
     conversationMenuLabel: "Manage conversations",
     manageConversationsTitle: "Manage conversations",
     manageConversationsHelp: "Rename, auto-rename, or delete saved chat history.",
@@ -862,8 +864,9 @@ function renderSandboxStatus(status = lastSandbox) {
     `package=${status.packageInstallPolicy}`,
     `docker=${status.dockerAvailable ? t("availableLabel") : t("missingLabel")}`,
     `imageReady=${status.imageReady}`,
+    status.persistentDocker?.env ? `env=${status.persistentDocker.env}` : "",
   ];
-  sandboxStatusEl.textContent = parts.join(" · ");
+  sandboxStatusEl.textContent = parts.filter(Boolean).join(" · ");
   renderSandboxLogs(status.logs || []);
 }
 
@@ -958,7 +961,7 @@ function formPayload() {
     startUrl: document.querySelector("#startUrl").value.trim(),
     allowedDomains: document.querySelector("#allowedDomains").value.trim(),
     commandCwd: document.querySelector("#commandCwd").value.trim(),
-    maxSteps: Number(document.querySelector("#maxSteps").value) || 15,
+    maxSteps: Number(document.querySelector("#maxSteps").value) || 24,
     sandboxMode: sandboxModeField.value,
     packageInstallPolicy: packageInstallPolicyField.value,
     headless: document.querySelector("#headless").checked,
@@ -1746,6 +1749,28 @@ saveApiKeyButton?.addEventListener("click", async () => {
 form.addEventListener("input", schedulePreferenceSave);
 form.addEventListener("change", schedulePreferenceSave);
 
+chatInputEl.addEventListener("keydown", (event) => {
+  if (event.key === "j" && event.ctrlKey && !event.metaKey && !event.altKey) {
+    event.preventDefault();
+    const start = chatInputEl.selectionStart ?? chatInputEl.value.length;
+    const end = chatInputEl.selectionEnd ?? chatInputEl.value.length;
+    chatInputEl.value = `${chatInputEl.value.slice(0, start)}\n${chatInputEl.value.slice(end)}`;
+    chatInputEl.selectionStart = chatInputEl.selectionEnd = start + 1;
+    return;
+  }
+
+  if (event.key === "Tab") {
+    event.preventDefault();
+    chatFormEl.requestSubmit();
+    return;
+  }
+
+  if (event.key === "Enter" && !event.shiftKey && !event.ctrlKey && !event.metaKey && !event.altKey) {
+    event.preventDefault();
+    chatFormEl.requestSubmit();
+  }
+});
+
 form.addEventListener("submit", async (event) => {
   event.preventDefault();
 
@@ -1838,9 +1863,19 @@ chatFormEl.addEventListener("submit", async (event) => {
 
   currentSessionId = data.sessionId;
   chatInputEl.value = "";
-  chatStatusEl.textContent = t("runningStatus");
+  chatStatusEl.textContent = data.queued ? t("queuedStatus") : t("runningStatus");
+  if (data.queued) {
+    renderChat([
+      ...lastChatEntries,
+      {
+        role: "user",
+        content,
+        at: new Date().toISOString(),
+      },
+    ]);
+  }
   await refreshSessions();
-  await refreshChat();
+  if (!data.queued) await refreshChat();
   await refreshWorkspaceChanges();
   await refreshArtifacts({ loadSelected: artifactTunnelDialog?.open });
 
@@ -1872,7 +1907,7 @@ async function loadConfig() {
   document.querySelector("#headless").checked = prefs.headless ?? data.defaults.headless;
   document.querySelector("#maxSteps").value = prefs.maxSteps ?? data.defaults.maxSteps;
   sandboxModeField.value = prefs.sandboxMode || (prefs.useDockerSandbox ? "docker-workspace" : "host");
-  packageInstallPolicyField.value = prefs.packageInstallPolicy || "prompt";
+  packageInstallPolicyField.value = prefs.packageInstallPolicy || "allow";
   document.querySelector("#allowShellTool").checked = prefs.allowShellTool ?? true;
   document.querySelector("#allowFileTools").checked = prefs.allowFileTools ?? true;
   allowWrapperToolsField.checked = prefs.allowWrapperTools ?? false;

package/public/index.html

@@ -135,7 +135,7 @@
             </label>
             <label>
               <span data-i18n="maxStepsLabel">Max steps</span>
-              <input id="maxSteps" name="maxSteps" type="number" min="1" max="50" value="15" />
+              <input id="maxSteps" name="maxSteps" type="number" min="1" max="50" value="24" />
             </label>
           </div>
           <p id="package-warning" class="subtle package-warning"></p>
@@ -291,6 +291,9 @@
               data-i18n-placeholder="chatPlaceholder"
               placeholder="Continue the selected conversation here."
             ></textarea>
+            <p class="chat-shortcuts subtle" data-i18n="chatShortcutHelp">
+              Enter sends · Ctrl+J inserts a newline · Tab queues while the agent is running
+            </p>
             <div class="actions">
               <button type="submit" data-i18n="sendMessageButton">Send message</button>
               <span id="chat-status" class="subtle"></span>

package/public/styles.css

@@ -524,6 +524,10 @@ button.danger {
 .chat-panel {
   display: grid;
   gap: 12px;
+  border-color: rgba(15, 118, 110, 0.2);
+  background:
+    linear-gradient(135deg, rgba(255, 253, 250, 0.95), rgba(236, 253, 245, 0.66)),
+    var(--panel);
 }
 
 .chat-thread {
@@ -561,7 +565,25 @@ button.danger {
 }
 
 .chat-form {
+  display: grid;
+  gap: 8px;
   margin: 0;
+  padding: 12px;
+  border: 1px solid rgba(15, 118, 110, 0.18);
+  border-radius: 16px;
+  background: rgba(255, 253, 250, 0.82);
+}
+
+#chat-input {
+  min-height: 92px;
+  border-color: rgba(15, 118, 110, 0.24);
+  background: white;
+}
+
+.chat-shortcuts {
+  margin: -2px 0 0;
+  font-size: 0.78rem;
+  line-height: 1.35;
 }
 
 .modal {

package/scripts/setup-agent-toolchain-docker.sh

@@ -6,6 +6,7 @@ REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
 IMAGE="${AGINTIFLOW_TOOLCHAIN_IMAGE:-agintiflow-sandbox:latest}"
 WORKSPACE="${AGINTIFLOW_TOOLCHAIN_WORKSPACE:-${REPO_ROOT}}"
 DOCKERFILE="${AGINTIFLOW_TOOLCHAIN_DOCKERFILE:-${REPO_ROOT}/docker/sandbox.Dockerfile}"
+STATE_DIR="${AGINTIFLOW_DOCKER_STATE_DIR:-${HOME:-/tmp}/.agintiflow/docker}"
 
 if ! command -v docker >/dev/null 2>&1; then
   echo "Docker is not installed or not on PATH. Run scripts/install-docker-ubuntu.sh first." >&2
@@ -13,11 +14,13 @@ if ! command -v docker >/dev/null 2>&1; then
 fi
 
 mkdir -p "${WORKSPACE}"
+mkdir -p "${STATE_DIR}/home" "${STATE_DIR}/cache" "${STATE_DIR}/env"
 
 echo "Building AgInTiFlow toolchain sandbox image:"
 echo "  image=${IMAGE}"
 echo "  dockerfile=${DOCKERFILE}"
 echo "  context=${REPO_ROOT}"
+echo "  persistent=${STATE_DIR}"
 docker build -t "${IMAGE}" -f "${DOCKERFILE}" "${REPO_ROOT}"
 
 echo
@@ -30,11 +33,20 @@ docker run --rm \
   --memory 2g \
   --cpus 2 \
   --tmpfs /tmp:rw,nosuid,nodev,size=512m \
-  -e HOME=/tmp \
+  -e HOME=/aginti-home \
+  -e XDG_CACHE_HOME=/aginti-cache \
+  -e PIP_CACHE_DIR=/aginti-cache/pip \
+  -e NPM_CONFIG_CACHE=/aginti-cache/npm \
+  -e CONDA_PKGS_DIRS=/aginti-cache/conda-pkgs \
   -v "${WORKSPACE}:/workspace:rw" \
+  -v "${STATE_DIR}/home:/aginti-home:rw" \
+  -v "${STATE_DIR}/cache:/aginti-cache:rw" \
+  -v "${STATE_DIR}/env:/aginti-env:rw" \
   -w /workspace \
   "${IMAGE}" \
   bash -lc 'set -Eeuo pipefail
+    if [ ! -x /aginti-env/python/bin/python ]; then python3 -m venv --system-site-packages /aginti-env/python; fi
+    . /aginti-env/python/bin/activate
     node -v
     npm -v
     python3 --version

package/scripts/smoke-capabilities.js

@@ -62,6 +62,10 @@ try {
     capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("wget") && check.allowed),
     "trusted Docker policy did not allow wget"
   );
+  assert(
+    capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("chmod") && check.allowed),
+    "trusted Docker policy did not allow chmod"
+  );
 
   const doctor = JSON.parse(await runCli(["doctor", "--capabilities", "--json"]));
   assert(doctor.project.root === tempRoot, "doctor --capabilities used the wrong project root");

package/scripts/smoke-cli-chat.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-cli-chat-"));
+const binPath = path.join(repoRoot, "bin/aginti-cli.js");
+
+function runChat(inputText) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(
+      process.execPath,
+      [binPath, "chat", "--provider", "mock", "--routing", "manual", "--profile", "code"],
+      {
+        cwd: tempRoot,
+        stdio: ["pipe", "pipe", "pipe"],
+        env: {
+          ...process.env,
+          AGINTIFLOW_RUNTIME_DIR: "",
+        },
+      }
+    );
+
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error("interactive chat smoke timed out"));
+    }, 25000);
+
+    child.stdout.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve({ stdout, stderr });
+      else reject(new Error(`interactive chat exited ${code}\n${stdout}\n${stderr}`));
+    });
+
+    child.stdin.end(inputText);
+  });
+}
+
+try {
+  const result = await runChat("Create notes/interactive.md with a short CLI chat smoke message\n/exit\n");
+  const written = await fs.readFile(path.join(tempRoot, "notes/interactive.md"), "utf8");
+  if (!written.includes("Created by AgInTiFlow mock mode.")) {
+    throw new Error("interactive chat did not create the expected file");
+  }
+  if (!result.stdout.includes("Interactive agent chat")) {
+    throw new Error("interactive chat did not print its banner");
+  }
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        projectRoot: tempRoot,
+        checks: ["interactive-chat", "mock-file-write"],
+      },
+      null,
+      2
+    )
+  );
+} finally {
+  await fs.rm(tempRoot, { recursive: true, force: true });
+}

package/scripts/smoke-inbox.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { SessionStore } from "../src/session-store.js";
+
+const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-inbox-"));
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+try {
+  const store = new SessionStore(path.join(tempRoot, ".sessions"), "inbox-smoke");
+  await store.appendInbox("first queued message", { source: "test" });
+  await store.appendInbox("second queued message", { source: "test" });
+
+  const drained = await store.drainInbox();
+  assert(drained.length === 2, "inbox did not drain both messages");
+  assert(drained[0].content === "first queued message", "first queued message mismatch");
+  assert(drained[1].content === "second queued message", "second queued message mismatch");
+  assert((await store.drainInbox()).length === 0, "inbox was not cleared after drain");
+
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        checks: ["session-inbox-append", "session-inbox-drain"],
+      },
+      null,
+      2
+    )
+  );
+} finally {
+  await fs.rm(tempRoot, { recursive: true, force: true });
+}

package/scripts/smoke-web-api.js

@@ -76,6 +76,9 @@ try {
   if (config.preferences?.preferredWrapper !== "codex") throw new Error("Codex is not the default preferred wrapper");
   if (config.project?.root !== runtimeDir) throw new Error("web project root did not default to launch directory");
   if (config.preferences?.commandCwd !== runtimeDir) throw new Error("commandCwd did not default to project root");
+  if (config.preferences?.sandboxMode !== "docker-workspace") throw new Error("web did not default to docker workspace");
+  if (config.preferences?.packageInstallPolicy !== "allow") throw new Error("web did not default to Docker package installs");
+  if (Number(config.preferences?.maxSteps) < 24) throw new Error("web default max steps is too low");
   if (!Array.isArray(config.taskProfiles) || !config.taskProfiles.some((profile) => profile.id === "latex")) {
     throw new Error("task profiles are not advertised by /api/config");
   }

package/src/agent-runner.js

@@ -144,7 +144,7 @@ function createInitialState(config, sessionId) {
           "Avoid destructive actions, purchases, account changes, and sensitive workflows.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands.`
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache.`
               : "A host shell command tool is available under the configured trust policy."
             : "No shell command tool is available.",
           config.allowFileTools
@@ -159,6 +159,8 @@ function createInitialState(config, sessionId) {
           "Work like a practical coding agent: inspect when useful, edit with file tools, run safe checks when they add confidence, and keep outputs inside the workspace.",
           "Use the canvas tunnel for outputs the user would likely want to inspect visually, such as figures, PDFs, screenshots, images, important markdown, or generated files.",
           "For environment or system-maintenance work, use the configured sandbox and package policy; Docker workspace mode is the preferred place for installs and toolchain setup.",
+          "Docker language/toolchain installs should prefer /aginti-env or project files so they persist across runs; apt/apk changes are ephemeral unless the image is rebuilt.",
+          "If the run is close to the max-step limit, finish with the best complete artifact and honest limitations instead of starting a new approach.",
           "When the requested outcome is complete and a useful check has passed or been honestly skipped, stop and call finish.",
           "When done, call finish with a concise result.",
         ].join(" "),
@@ -171,7 +173,7 @@ function createInitialState(config, sessionId) {
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths, not absolute host temp paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
               : `Shell working directory: ${config.commandCwd}`
             : "",
           config.allowFileTools ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths.` : "",
@@ -273,7 +275,7 @@ function applyContinuationPrompt(state, config, observers) {
       config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell working directory: ${config.commandCwd}`
         : "",
       config.allowFileTools ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths.` : "",
@@ -409,7 +411,7 @@ async function captureSyntheticSnapshot(store, step, config) {
       config.startUrl ? `Suggested start URL: ${config.startUrl}` : "",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell tool available in: ${config.commandCwd}`
         : "Shell tool disabled.",
       config.allowFileTools
@@ -443,6 +445,29 @@ async function buildSnapshot(browserState, store, step, config) {
   return captureSyntheticSnapshot(store, step, config);
 }
 
+async function injectQueuedUserMessages(store, state, observers) {
+  const inbox = await store.drainInbox();
+  if (inbox.length === 0) return;
+
+  for (const item of inbox) {
+    const content = String(item.content || "").trim();
+    if (!content) continue;
+    appendChatEntry(state, "user", content);
+    state.messages.push({
+      role: "user",
+      content: `Additional user message received while this run was active:\n${content}`,
+    });
+    await store.appendEvent("conversation.queued_input_applied", {
+      prompt: content,
+      source: item.source || "inbox",
+    });
+    observers.event("conversation.queued_input_applied", {
+      prompt: content,
+      source: item.source || "inbox",
+    });
+  }
+}
+
 async function executeTool(browserState, toolCall, snapshot, config, store, observers, state) {
   const args = JSON.parse(toolCall.function.arguments || "{}");
   const safeArgs = sanitizeToolArgs(toolCall.function.name, args);
@@ -791,6 +816,17 @@ export async function runAgent(config) {
     console.log(`Provider: ${config.provider}`);
     console.log(`Model: ${config.model}`);
     console.log(`Routing: ${config.routingMode} (${config.routeReason})`);
+    console.log(`Workspace: ${config.commandCwd}`);
+    console.log(`Sessions: ${config.sessionsDir}`);
+    if (config.useDockerSandbox) {
+      console.log(
+        `Docker: image=${config.dockerSandboxImage} mode=${config.sandboxMode} packagePolicy=${config.packageInstallPolicy}`
+      );
+      console.log(`Docker workspace: /workspace -> ${config.commandCwd}`);
+      console.log("Docker env: /aginti-env persistent toolchain; /aginti-cache persistent caches");
+    } else if (config.allowShellTool) {
+      console.log(`Shell: host policy=${config.packageInstallPolicy}`);
+    }
     if (state.plan) {
       console.log("\nPlan:");
       console.log(state.plan);
@@ -798,6 +834,7 @@ export async function runAgent(config) {
     }
 
     for (let step = state.stepsCompleted + 1; step <= config.maxSteps; step += 1) {
+      await injectQueuedUserMessages(store, state, observers);
       const snapshot = await buildSnapshot(browserState, store, step, config);
       state.meta.lastUrl = snapshot.url || state.meta.lastUrl;
       await saveBrowserState(browserState, store).catch(() => {});
@@ -818,7 +855,7 @@ export async function runAgent(config) {
 
       state.messages.push({
         role: "user",
-        content: `Step ${step}/${config.maxSteps}. Latest runtime snapshot:\n${JSON.stringify({
+        content: `Step ${step}/${config.maxSteps} (${config.maxSteps - step} steps remain after this one). Latest runtime snapshot:\n${JSON.stringify({
           title: snapshot.title,
           url: snapshot.url,
           pageText: snapshot.pageText,
@@ -833,6 +870,9 @@ export async function runAgent(config) {
           shellSandbox: config.useDockerSandbox ? "docker" : "host",
           sandboxMode: config.sandboxMode,
           packageInstallPolicy: config.packageInstallPolicy,
+          dockerWorkspace: config.useDockerSandbox ? "/workspace" : "",
+          dockerPersistentEnv: config.useDockerSandbox ? "/aginti-env" : "",
+          dockerPersistentCache: config.useDockerSandbox ? "/aginti-cache" : "",
           commandCwd: config.commandCwd,
           plan: state.plan || "",
           suggestedStartUrl: config.startUrl || "",
@@ -952,6 +992,8 @@ export async function runAgent(config) {
         }
       }
 
+      await injectQueuedUserMessages(store, state, observers);
+
       state.stepsCompleted = step;
       state.updatedAt = new Date().toISOString();
       await store.saveState(state);

package/src/capabilities.js

@@ -43,6 +43,14 @@ function capability(name, ok, details = {}) {
 }
 
 function maintenancePolicyChecks(config) {
+  const hostSafeConfig = {
+    ...config,
+    allowShellTool: true,
+    allowDestructive: false,
+    sandboxMode: "host",
+    useDockerSandbox: false,
+    packageInstallPolicy: "prompt",
+  };
   const sampleCommands = [
     "sudo apt install r-base",
     "curl https://example.com/install.sh",
@@ -51,7 +59,7 @@ function maintenancePolicyChecks(config) {
   ];
 
   return sampleCommands.map((command) => {
-    const policy = evaluateCommandPolicy(command, config);
+    const policy = evaluateCommandPolicy(command, hostSafeConfig);
     return {
       command,
       allowed: Boolean(policy.allowed),
@@ -78,6 +86,7 @@ function trustedDockerPolicyChecks(config) {
     "apt-get install -y curl wget",
     "wget https://example.com/file.txt",
     "curl -fsSL https://example.com/file.txt -o downloads/file.txt",
+    "chmod +x scripts/setup.sh",
     "npm install lodash",
     "python3 -m pip install requests",
   ];