@lazyingart/agintiflow 0.7.0 → 0.8.1

package/README.md

@@ -43,7 +43,7 @@ aginti init
 aginti doctor
 aginti --list-routes
 aginti --list-profiles
-aginti --sandbox-status --sandbox-mode docker-readonly
+aginti --sandbox-status
 ```
 
 Start an interactive Codex-style CLI chat from any project folder:
@@ -54,7 +54,7 @@ aginti
 aginti chat
 ```
 
-Inside chat, type normal requests such as `write a small Python CLI app with tests`. Use `/help` for commands, `/docker on` to switch to Docker workspace mode with approved package installs, `/sessions` to list project runs, and `/resume <session-id>` to continue work.
+Inside chat, type normal requests such as `write a small Python CLI app with tests`. The default is now Docker workspace mode with approved package installs, so coding, plotting, and LaTeX tasks can set up project-local tools without touching the host. Use `/help` for commands, `/latex on` for PDF work, `/docker off` only when you intentionally want host mode, `/sessions` to list project runs, and `/resume <session-id>` to continue work.
 
 Launch the local web UI from an installed package:
 
@@ -81,8 +81,10 @@ aginti doctor --capabilities
 aginti sessions list
 aginti sessions show <session-id>
 aginti resume <session-id> "continue with a short follow-up"
+aginti queue <session-id> "extra instruction for the running agent"
 aginti --profile code "write a small Python CLI app with tests"
-aginti --sandbox-mode docker-workspace --approve-package-installs "set up this project and run the tests"
+aginti --latex "draw a figure, write a short LaTeX report, and compile the PDF"
+aginti "set up this project and run the tests"
 ```
 
 Run from a source checkout:
@@ -194,9 +196,9 @@ AgInTiFlow is intentionally conservative:
 - File writes record before/after SHA-256 hashes and compact redacted diffs.
 - Guarded shell mode is policy-based: normal inspection/tests are available, Docker workspace mode can run broader setup/network commands when package installs are approved, and host privileged/destructive work requires explicit trust.
 - Docker read-only mode mounts the workspace read-only and disables container network access.
-- Docker workspace-write mode is the web UI default so plot, PDF, and test outputs can be written inside the mounted workspace.
-- Docker workspace-write mode is the preferred place for approved package or environment setup, including `apt-get`, `npm`, `pip`, `curl`, and `wget` workflows inside the container.
-- Package installs default to `prompt`, so npm/pip/conda/venv setup is blocked until explicitly approved.
+- Docker workspace-write mode is the CLI/web default so plot, PDF, and test outputs can be written inside the mounted workspace.
+- Docker workspace-write mode with package policy `allow` is the default for normal agent work. It permits practical setup commands such as `npm`, `pip`, `conda`, `curl`, `wget`, and `chmod` inside Docker while keeping host sudo/global installs blocked.
+- Host mode falls back to `prompt`, so npm/pip/conda/venv setup and privileged/destructive commands require explicit trust.
 - NPM publishing, npm token commands, API-key reads, and credential files stay blocked. Broader shell commands require either Docker workspace mode with package policy `allow`, or explicit host trust.
 - NPM tokens and API keys are redacted from tool logs and API responses.
 - Every tool request and result is written to structured logs.
@@ -316,7 +318,7 @@ Build the companion agent toolchain sandbox:
 npm run smoke:toolchain-docker
 ```
 
-The setup script idempotently builds `agintiflow-sandbox:latest` from `docker/sandbox.Dockerfile` and verifies Node, npm, Python, NumPy, Matplotlib, `latexmk`, and `pdflatex` inside Docker. The smoke script runs Python plot generation, LaTeX PDF compilation, and PDF artifact preview against the same workspace-mounted sandbox path used by the agent.
+The setup script idempotently builds `agintiflow-sandbox:latest` from `docker/sandbox.Dockerfile` and verifies Node, npm, Python, NumPy, Matplotlib, `latexmk`, and `pdflatex` inside Docker. It also creates the persistent companion folders under `~/.agintiflow/docker/`: `home/` maps to `/aginti-home`, `cache/` maps to `/aginti-cache`, and `env/` maps to `/aginti-env`. Python/conda-style toolchains should live under `/aginti-env` so they survive across agent runs. OS package changes from `apt-get` are container-ephemeral unless you rebuild the image.
 
 ## Sandbox Modes
 
@@ -336,6 +338,8 @@ Package policy values:
 
 Toolchain commands such as `python3 plot.py`, `latexmk -pdf paper.tex`, and `pdflatex -interaction=nonstopmode -halt-on-error paper.tex` are allowlisted only when the shell tool is enabled. In Docker mode the project folder is mounted as `/workspace`; any file written to `/workspace/report.pdf` appears on the host as `<your-project>/report.pdf`. CLI runs print both the host workspace and the Docker mapping before execution. File and canvas tools accept both normal relative paths and Docker virtual paths like `/workspace/report.pdf`, while other absolute host paths remain blocked.
 
+The web chat mirrors the CLI session store. Enter sends, Ctrl+J inserts a newline, and Tab submits/queues the message. Queued input is written to `.sessions/<session-id>/inbox.jsonl`; the running agent drains that pipe between steps and after tool calls.
+
 Safe preflight endpoints:
 
 ```bash

package/docker/sandbox.Dockerfile

@@ -21,6 +21,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   python3 \
   ripgrep \
   sed \
+  sudo \
   texlive-fonts-recommended \
   texlive-latex-base \
   texlive-latex-extra \

package/docs/agent-runtime-pipe.md

@@ -0,0 +1,14 @@
+# Agent Runtime Pipe
+
+AgInTiFlow keeps CLI and web runs equivalent by using the project folder as the source of truth.
+
+- Project root: the folder where `aginti` or `aginti web` is launched.
+- Session store: `<project>/.sessions/`.
+- Web settings database: `<project>/.sessions/web-state.sqlite`.
+- Runtime inbox: `<project>/.sessions/<session-id>/inbox.jsonl`.
+
+When a run is active, the web chat and `aginti queue <session-id> "..."` append messages to the inbox instead of trying to mutate the running process directly. The runner drains the inbox at safe boundaries: before each model step and after tool execution. This mirrors the event-queue style used by mature agent UIs while keeping the backend decoupled from any specific frontend.
+
+Default execution is Docker workspace mode with package installs approved inside the sandbox. The project is mounted at `/workspace`; persistent agent toolchain folders are mounted at `/aginti-home`, `/aginti-cache`, and `/aginti-env` from `~/.agintiflow/docker/`. Python, conda, and other language-level environments should be installed under `/aginti-env` so they survive across runs. Apt/apk package changes are ephemeral unless the Docker image is rebuilt.
+
+The failed `f(f(x)) = f'(x)` LaTeX task exposed three issues: host-mode command policy blocked setup/path commands, a 15-step budget was too small for iterative numerical work plus TeX output, and follow-up input could not be queued while the agent was running. The current runtime defaults and inbox pipe address those without hardcoding that specific math task.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "type": "module",
   "description": "AgInTiFlow is a resumable Playwright website-control agent with OpenAI-compatible tool calling.",
   "license": "Apache-2.0",
@@ -44,6 +44,7 @@
     "scripts/smoke-cli-chat.js",
     "scripts/smoke-coding-tools.js",
     "scripts/smoke-capabilities.js",
+    "scripts/smoke-inbox.js",
     "scripts/smoke-toolchain-docker.js",
     "scripts/smoke-web-api.js",
     "src/",
@@ -62,9 +63,10 @@
     "smoke:coding-tools": "node scripts/smoke-coding-tools.js",
     "smoke:cli-chat": "node scripts/smoke-cli-chat.js",
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
+    "smoke:inbox": "node scripts/smoke-inbox.js",
     "smoke:web-api": "node scripts/smoke-web-api.js",
     "real:deepseek": "node scripts/real-deepseek-capabilities.js",
-    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:capabilities && npm run smoke:cli-chat",
+    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:capabilities && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/public/app.js

@@ -114,7 +114,9 @@ const translations = {
     messageRequired: "Message is required.",
     sendingStatus: "Sending...",
     runningStatus: "Running...",
+    queuedStatus: "Queued for the running agent.",
     failedContinue: "Failed to continue the conversation.",
+    chatShortcutHelp: "Enter sends · Ctrl+J inserts a newline · Tab queues while the agent is running",
     conversationMenuLabel: "Manage conversations",
     manageConversationsTitle: "Manage conversations",
     manageConversationsHelp: "Rename, auto-rename, or delete saved chat history.",
@@ -862,8 +864,9 @@ function renderSandboxStatus(status = lastSandbox) {
     `package=${status.packageInstallPolicy}`,
     `docker=${status.dockerAvailable ? t("availableLabel") : t("missingLabel")}`,
     `imageReady=${status.imageReady}`,
+    status.persistentDocker?.env ? `env=${status.persistentDocker.env}` : "",
   ];
-  sandboxStatusEl.textContent = parts.join(" · ");
+  sandboxStatusEl.textContent = parts.filter(Boolean).join(" · ");
   renderSandboxLogs(status.logs || []);
 }
 
@@ -958,7 +961,7 @@ function formPayload() {
     startUrl: document.querySelector("#startUrl").value.trim(),
     allowedDomains: document.querySelector("#allowedDomains").value.trim(),
     commandCwd: document.querySelector("#commandCwd").value.trim(),
-    maxSteps: Number(document.querySelector("#maxSteps").value) || 15,
+    maxSteps: Number(document.querySelector("#maxSteps").value) || 24,
     sandboxMode: sandboxModeField.value,
     packageInstallPolicy: packageInstallPolicyField.value,
     headless: document.querySelector("#headless").checked,
@@ -1746,6 +1749,28 @@ saveApiKeyButton?.addEventListener("click", async () => {
 form.addEventListener("input", schedulePreferenceSave);
 form.addEventListener("change", schedulePreferenceSave);
 
+chatInputEl.addEventListener("keydown", (event) => {
+  if (event.key === "j" && event.ctrlKey && !event.metaKey && !event.altKey) {
+    event.preventDefault();
+    const start = chatInputEl.selectionStart ?? chatInputEl.value.length;
+    const end = chatInputEl.selectionEnd ?? chatInputEl.value.length;
+    chatInputEl.value = `${chatInputEl.value.slice(0, start)}\n${chatInputEl.value.slice(end)}`;
+    chatInputEl.selectionStart = chatInputEl.selectionEnd = start + 1;
+    return;
+  }
+
+  if (event.key === "Tab") {
+    event.preventDefault();
+    chatFormEl.requestSubmit();
+    return;
+  }
+
+  if (event.key === "Enter" && !event.shiftKey && !event.ctrlKey && !event.metaKey && !event.altKey) {
+    event.preventDefault();
+    chatFormEl.requestSubmit();
+  }
+});
+
 form.addEventListener("submit", async (event) => {
   event.preventDefault();
 
@@ -1838,9 +1863,19 @@ chatFormEl.addEventListener("submit", async (event) => {
 
   currentSessionId = data.sessionId;
   chatInputEl.value = "";
-  chatStatusEl.textContent = t("runningStatus");
+  chatStatusEl.textContent = data.queued ? t("queuedStatus") : t("runningStatus");
+  if (data.queued) {
+    renderChat([
+      ...lastChatEntries,
+      {
+        role: "user",
+        content,
+        at: new Date().toISOString(),
+      },
+    ]);
+  }
   await refreshSessions();
-  await refreshChat();
+  if (!data.queued) await refreshChat();
   await refreshWorkspaceChanges();
   await refreshArtifacts({ loadSelected: artifactTunnelDialog?.open });
 
@@ -1872,7 +1907,7 @@ async function loadConfig() {
   document.querySelector("#headless").checked = prefs.headless ?? data.defaults.headless;
   document.querySelector("#maxSteps").value = prefs.maxSteps ?? data.defaults.maxSteps;
   sandboxModeField.value = prefs.sandboxMode || (prefs.useDockerSandbox ? "docker-workspace" : "host");
-  packageInstallPolicyField.value = prefs.packageInstallPolicy || "prompt";
+  packageInstallPolicyField.value = prefs.packageInstallPolicy || "allow";
   document.querySelector("#allowShellTool").checked = prefs.allowShellTool ?? true;
   document.querySelector("#allowFileTools").checked = prefs.allowFileTools ?? true;
   allowWrapperToolsField.checked = prefs.allowWrapperTools ?? false;

package/public/index.html

@@ -135,7 +135,7 @@
             </label>
             <label>
               <span data-i18n="maxStepsLabel">Max steps</span>
-              <input id="maxSteps" name="maxSteps" type="number" min="1" max="50" value="15" />
+              <input id="maxSteps" name="maxSteps" type="number" min="1" max="50" value="24" />
             </label>
           </div>
           <p id="package-warning" class="subtle package-warning"></p>
@@ -291,6 +291,9 @@
               data-i18n-placeholder="chatPlaceholder"
               placeholder="Continue the selected conversation here."
             ></textarea>
+            <p class="chat-shortcuts subtle" data-i18n="chatShortcutHelp">
+              Enter sends · Ctrl+J inserts a newline · Tab queues while the agent is running
+            </p>
             <div class="actions">
               <button type="submit" data-i18n="sendMessageButton">Send message</button>
               <span id="chat-status" class="subtle"></span>

package/public/styles.css

@@ -524,6 +524,10 @@ button.danger {
 .chat-panel {
   display: grid;
   gap: 12px;
+  border-color: rgba(15, 118, 110, 0.2);
+  background:
+    linear-gradient(135deg, rgba(255, 253, 250, 0.95), rgba(236, 253, 245, 0.66)),
+    var(--panel);
 }
 
 .chat-thread {
@@ -561,7 +565,25 @@ button.danger {
 }
 
 .chat-form {
+  display: grid;
+  gap: 8px;
   margin: 0;
+  padding: 12px;
+  border: 1px solid rgba(15, 118, 110, 0.18);
+  border-radius: 16px;
+  background: rgba(255, 253, 250, 0.82);
+}
+
+#chat-input {
+  min-height: 92px;
+  border-color: rgba(15, 118, 110, 0.24);
+  background: white;
+}
+
+.chat-shortcuts {
+  margin: -2px 0 0;
+  font-size: 0.78rem;
+  line-height: 1.35;
 }
 
 .modal {

package/scripts/setup-agent-toolchain-docker.sh

@@ -6,6 +6,7 @@ REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
 IMAGE="${AGINTIFLOW_TOOLCHAIN_IMAGE:-agintiflow-sandbox:latest}"
 WORKSPACE="${AGINTIFLOW_TOOLCHAIN_WORKSPACE:-${REPO_ROOT}}"
 DOCKERFILE="${AGINTIFLOW_TOOLCHAIN_DOCKERFILE:-${REPO_ROOT}/docker/sandbox.Dockerfile}"
+STATE_DIR="${AGINTIFLOW_DOCKER_STATE_DIR:-${HOME:-/tmp}/.agintiflow/docker}"
 
 if ! command -v docker >/dev/null 2>&1; then
   echo "Docker is not installed or not on PATH. Run scripts/install-docker-ubuntu.sh first." >&2
@@ -13,11 +14,13 @@ if ! command -v docker >/dev/null 2>&1; then
 fi
 
 mkdir -p "${WORKSPACE}"
+mkdir -p "${STATE_DIR}/home" "${STATE_DIR}/cache" "${STATE_DIR}/env"
 
 echo "Building AgInTiFlow toolchain sandbox image:"
 echo "  image=${IMAGE}"
 echo "  dockerfile=${DOCKERFILE}"
 echo "  context=${REPO_ROOT}"
+echo "  persistent=${STATE_DIR}"
 docker build -t "${IMAGE}" -f "${DOCKERFILE}" "${REPO_ROOT}"
 
 echo
@@ -30,11 +33,20 @@ docker run --rm \
   --memory 2g \
   --cpus 2 \
   --tmpfs /tmp:rw,nosuid,nodev,size=512m \
-  -e HOME=/tmp \
+  -e HOME=/aginti-home \
+  -e XDG_CACHE_HOME=/aginti-cache \
+  -e PIP_CACHE_DIR=/aginti-cache/pip \
+  -e NPM_CONFIG_CACHE=/aginti-cache/npm \
+  -e CONDA_PKGS_DIRS=/aginti-cache/conda-pkgs \
   -v "${WORKSPACE}:/workspace:rw" \
+  -v "${STATE_DIR}/home:/aginti-home:rw" \
+  -v "${STATE_DIR}/cache:/aginti-cache:rw" \
+  -v "${STATE_DIR}/env:/aginti-env:rw" \
   -w /workspace \
   "${IMAGE}" \
   bash -lc 'set -Eeuo pipefail
+    if [ ! -x /aginti-env/python/bin/python ]; then python3 -m venv --system-site-packages /aginti-env/python; fi
+    . /aginti-env/python/bin/activate
     node -v
     npm -v
     python3 --version

package/scripts/smoke-capabilities.js

@@ -62,6 +62,10 @@ try {
     capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("wget") && check.allowed),
     "trusted Docker policy did not allow wget"
   );
+  assert(
+    capabilities.trustedDockerPolicy.some((check) => check.command.startsWith("chmod") && check.allowed),
+    "trusted Docker policy did not allow chmod"
+  );
 
   const doctor = JSON.parse(await runCli(["doctor", "--capabilities", "--json"]));
   assert(doctor.project.root === tempRoot, "doctor --capabilities used the wrong project root");

package/scripts/smoke-inbox.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { SessionStore } from "../src/session-store.js";
+
+const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-inbox-"));
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+try {
+  const store = new SessionStore(path.join(tempRoot, ".sessions"), "inbox-smoke");
+  await store.appendInbox("first queued message", { source: "test" });
+  await store.appendInbox("second queued message", { source: "test" });
+
+  const drained = await store.drainInbox();
+  assert(drained.length === 2, "inbox did not drain both messages");
+  assert(drained[0].content === "first queued message", "first queued message mismatch");
+  assert(drained[1].content === "second queued message", "second queued message mismatch");
+  assert((await store.drainInbox()).length === 0, "inbox was not cleared after drain");
+
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        checks: ["session-inbox-append", "session-inbox-drain"],
+      },
+      null,
+      2
+    )
+  );
+} finally {
+  await fs.rm(tempRoot, { recursive: true, force: true });
+}

package/scripts/smoke-web-api.js

@@ -76,6 +76,9 @@ try {
   if (config.preferences?.preferredWrapper !== "codex") throw new Error("Codex is not the default preferred wrapper");
   if (config.project?.root !== runtimeDir) throw new Error("web project root did not default to launch directory");
   if (config.preferences?.commandCwd !== runtimeDir) throw new Error("commandCwd did not default to project root");
+  if (config.preferences?.sandboxMode !== "docker-workspace") throw new Error("web did not default to docker workspace");
+  if (config.preferences?.packageInstallPolicy !== "allow") throw new Error("web did not default to Docker package installs");
+  if (Number(config.preferences?.maxSteps) < 24) throw new Error("web default max steps is too low");
   if (!Array.isArray(config.taskProfiles) || !config.taskProfiles.some((profile) => profile.id === "latex")) {
     throw new Error("task profiles are not advertised by /api/config");
   }

package/src/agent-runner.js

@@ -144,7 +144,7 @@ function createInitialState(config, sessionId) {
           "Avoid destructive actions, purchases, account changes, and sensitive workflows.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands.`
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache.`
               : "A host shell command tool is available under the configured trust policy."
             : "No shell command tool is available.",
           config.allowFileTools
@@ -159,6 +159,8 @@ function createInitialState(config, sessionId) {
           "Work like a practical coding agent: inspect when useful, edit with file tools, run safe checks when they add confidence, and keep outputs inside the workspace.",
           "Use the canvas tunnel for outputs the user would likely want to inspect visually, such as figures, PDFs, screenshots, images, important markdown, or generated files.",
           "For environment or system-maintenance work, use the configured sandbox and package policy; Docker workspace mode is the preferred place for installs and toolchain setup.",
+          "Docker language/toolchain installs should prefer /aginti-env or project files so they persist across runs; apt/apk changes are ephemeral unless the image is rebuilt.",
+          "If the run is close to the max-step limit, finish with the best complete artifact and honest limitations instead of starting a new approach.",
           "When the requested outcome is complete and a useful check has passed or been honestly skipped, stop and call finish.",
           "When done, call finish with a concise result.",
         ].join(" "),
@@ -171,7 +173,7 @@ function createInitialState(config, sessionId) {
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths, not absolute host temp paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
               : `Shell working directory: ${config.commandCwd}`
             : "",
           config.allowFileTools ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths.` : "",
@@ -273,7 +275,7 @@ function applyContinuationPrompt(state, config, observers) {
       config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell working directory: ${config.commandCwd}`
         : "",
       config.allowFileTools ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths.` : "",
@@ -409,7 +411,7 @@ async function captureSyntheticSnapshot(store, step, config) {
       config.startUrl ? `Suggested start URL: ${config.startUrl}` : "",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell tool available in: ${config.commandCwd}`
         : "Shell tool disabled.",
       config.allowFileTools
@@ -443,6 +445,29 @@ async function buildSnapshot(browserState, store, step, config) {
   return captureSyntheticSnapshot(store, step, config);
 }
 
+async function injectQueuedUserMessages(store, state, observers) {
+  const inbox = await store.drainInbox();
+  if (inbox.length === 0) return;
+
+  for (const item of inbox) {
+    const content = String(item.content || "").trim();
+    if (!content) continue;
+    appendChatEntry(state, "user", content);
+    state.messages.push({
+      role: "user",
+      content: `Additional user message received while this run was active:\n${content}`,
+    });
+    await store.appendEvent("conversation.queued_input_applied", {
+      prompt: content,
+      source: item.source || "inbox",
+    });
+    observers.event("conversation.queued_input_applied", {
+      prompt: content,
+      source: item.source || "inbox",
+    });
+  }
+}
+
 async function executeTool(browserState, toolCall, snapshot, config, store, observers, state) {
   const args = JSON.parse(toolCall.function.arguments || "{}");
   const safeArgs = sanitizeToolArgs(toolCall.function.name, args);
@@ -798,6 +823,7 @@ export async function runAgent(config) {
         `Docker: image=${config.dockerSandboxImage} mode=${config.sandboxMode} packagePolicy=${config.packageInstallPolicy}`
       );
       console.log(`Docker workspace: /workspace -> ${config.commandCwd}`);
+      console.log("Docker env: /aginti-env persistent toolchain; /aginti-cache persistent caches");
     } else if (config.allowShellTool) {
       console.log(`Shell: host policy=${config.packageInstallPolicy}`);
     }
@@ -808,6 +834,7 @@ export async function runAgent(config) {
     }
 
     for (let step = state.stepsCompleted + 1; step <= config.maxSteps; step += 1) {
+      await injectQueuedUserMessages(store, state, observers);
       const snapshot = await buildSnapshot(browserState, store, step, config);
       state.meta.lastUrl = snapshot.url || state.meta.lastUrl;
       await saveBrowserState(browserState, store).catch(() => {});
@@ -828,7 +855,7 @@ export async function runAgent(config) {
 
       state.messages.push({
         role: "user",
-        content: `Step ${step}/${config.maxSteps}. Latest runtime snapshot:\n${JSON.stringify({
+        content: `Step ${step}/${config.maxSteps} (${config.maxSteps - step} steps remain after this one). Latest runtime snapshot:\n${JSON.stringify({
           title: snapshot.title,
           url: snapshot.url,
           pageText: snapshot.pageText,
@@ -843,6 +870,9 @@ export async function runAgent(config) {
           shellSandbox: config.useDockerSandbox ? "docker" : "host",
           sandboxMode: config.sandboxMode,
           packageInstallPolicy: config.packageInstallPolicy,
+          dockerWorkspace: config.useDockerSandbox ? "/workspace" : "",
+          dockerPersistentEnv: config.useDockerSandbox ? "/aginti-env" : "",
+          dockerPersistentCache: config.useDockerSandbox ? "/aginti-cache" : "",
           commandCwd: config.commandCwd,
           plan: state.plan || "",
           suggestedStartUrl: config.startUrl || "",
@@ -962,6 +992,8 @@ export async function runAgent(config) {
         }
       }
 
+      await injectQueuedUserMessages(store, state, observers);
+
       state.stepsCompleted = step;
       state.updatedAt = new Date().toISOString();
       await store.saveState(state);

package/src/capabilities.js

@@ -43,6 +43,14 @@ function capability(name, ok, details = {}) {
 }
 
 function maintenancePolicyChecks(config) {
+  const hostSafeConfig = {
+    ...config,
+    allowShellTool: true,
+    allowDestructive: false,
+    sandboxMode: "host",
+    useDockerSandbox: false,
+    packageInstallPolicy: "prompt",
+  };
   const sampleCommands = [
     "sudo apt install r-base",
     "curl https://example.com/install.sh",
@@ -51,7 +59,7 @@ function maintenancePolicyChecks(config) {
   ];
 
   return sampleCommands.map((command) => {
-    const policy = evaluateCommandPolicy(command, config);
+    const policy = evaluateCommandPolicy(command, hostSafeConfig);
     return {
       command,
       allowed: Boolean(policy.allowed),
@@ -78,6 +86,7 @@ function trustedDockerPolicyChecks(config) {
     "apt-get install -y curl wget",
     "wget https://example.com/file.txt",
     "curl -fsSL https://example.com/file.txt -o downloads/file.txt",
+    "chmod +x scripts/setup.sh",
     "npm install lodash",
     "python3 -m pip install requests",
   ];

package/src/cli.js

@@ -5,6 +5,7 @@ import { getModelPresets } from "./model-routing.js";
 import { getDockerSandboxStatus, runDockerPreflight } from "./docker-sandbox.js";
 import { buildCapabilityReport, printCapabilityReport } from "./capabilities.js";
 import { startInteractiveCli } from "./interactive-cli.js";
+import { SessionStore } from "./session-store.js";
 import {
   doctorReport,
   initProject,
@@ -57,6 +58,7 @@ export function parseArgs(argv) {
     port: "",
     host: "",
     listProfiles: false,
+    latex: false,
   };
 
   const parts = [];
@@ -130,6 +132,14 @@ export function parseArgs(argv) {
       result.sandboxMode = result.sandboxMode || "docker-workspace";
       continue;
     }
+    if (arg === "--latex") {
+      result.latex = true;
+      result.taskProfile = "latex";
+      result.sandboxMode = result.sandboxMode || "docker-workspace";
+      result.packageInstallPolicy = result.packageInstallPolicy || "allow";
+      result.maxSteps = result.maxSteps || 30;
+      continue;
+    }
     if (arg === "--max-steps") {
       result.maxSteps = Number(readOption(argv, i));
       i += 1;
@@ -209,10 +219,29 @@ export function parseArgs(argv) {
 
 function printUsage() {
   console.log(
-    'Usage: aginti [chat] OR aginti web [--port 3210] OR aginti [--routing smart|fast|complex|manual] [--provider deepseek|openai|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-destructive] [--allow-file-tools|--no-file-tools] [--allow-wrappers --wrapper codex] [--sandbox-status|--sandbox-preflight] "your task"'
+    'Usage: aginti [chat] OR aginti web [--port 3210] OR aginti queue <session-id> "message" OR aginti [--latex] [--routing smart|fast|complex|manual] [--provider deepseek|openai|mock] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-destructive] [--allow-file-tools|--no-file-tools] [--allow-wrappers --wrapper codex] [--sandbox-status|--sandbox-preflight] "your task"'
   );
 }
 
+function agentDefaults(args) {
+  const defaults = {
+    ...args,
+    allowShellTool: args.allowShellTool ?? true,
+    allowFileTools: args.allowFileTools ?? true,
+    sandboxMode: args.sandboxMode || "docker-workspace",
+    packageInstallPolicy: args.packageInstallPolicy || "allow",
+    useDockerSandbox: args.useDockerSandbox ?? true,
+    maxSteps: args.maxSteps || (args.latex || args.taskProfile === "latex" ? 30 : 24),
+  };
+
+  if (defaults.sandboxMode === "host") {
+    defaults.useDockerSandbox = false;
+    defaults.packageInstallPolicy = args.packageInstallPolicy || "prompt";
+  }
+
+  return defaults;
+}
+
 function printRoutes() {
   const presets = getModelPresets();
   for (const preset of Object.values(presets)) {
@@ -327,6 +356,20 @@ async function handleSessionsCommand(argv) {
   process.exit(1);
 }
 
+async function handleQueueCommand(argv) {
+  const sessionId = argv[0] || "";
+  const content = argv.slice(1).join(" ").trim();
+  if (!/^[A-Za-z0-9._:-]+$/.test(sessionId) || !content) {
+    console.error('Usage: aginti queue <session-id> "message to apply during the next agent step"');
+    process.exit(1);
+  }
+
+  const store = new SessionStore(path.resolve(process.cwd(), ".sessions"), sessionId);
+  await store.appendInbox(content, { source: "cli" });
+  await store.appendEvent("conversation.queued_input", { prompt: content, source: "cli" }).catch(() => {});
+  console.log(`queued message for ${sessionId}`);
+}
+
 export async function main(argv = process.argv.slice(2)) {
   if (argv[0] === "--help" || argv[0] === "help" || argv[0] === "-h") {
     printUsage();
@@ -407,6 +450,11 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (argv[0] === "queue") {
+    await handleQueueCommand(argv.slice(1));
+    return;
+  }
+
   if (argv[0] === "resume") {
     const sessionId = argv[1] || "";
     const prompt = argv.slice(2).join(" ").trim();
@@ -414,10 +462,7 @@ export async function main(argv = process.argv.slice(2)) {
       console.error('Usage: aginti resume <session-id> "new prompt"');
       process.exit(1);
     }
-    const config = loadConfig(
-      { ...parseArgs([prompt]), resume: sessionId, goal: prompt, allowShellTool: true, allowFileTools: true },
-      { packageDir }
-    );
+    const config = loadConfig(agentDefaults({ ...parseArgs([prompt]), resume: sessionId, goal: prompt }), { packageDir });
     await runAgent(config);
     return;
   }
@@ -425,7 +470,7 @@ export async function main(argv = process.argv.slice(2)) {
   const args = parseArgs(argv);
 
   if (args.interactive || (!args.goal && !args.resume && process.stdin.isTTY)) {
-    await startInteractiveCli(args, { packageDir, packageVersion: packageJson.version });
+    await startInteractiveCli(agentDefaults(args), { packageDir, packageVersion: packageJson.version });
     return;
   }
 
@@ -466,13 +511,6 @@ export async function main(argv = process.argv.slice(2)) {
     process.exit(1);
   }
 
-  const config = loadConfig(
-    {
-      ...args,
-      allowShellTool: args.allowShellTool ?? true,
-      allowFileTools: args.allowFileTools ?? true,
-    },
-    { packageDir }
-  );
+  const config = loadConfig(agentDefaults(args), { packageDir });
   await runAgent(config);
 }

package/src/command-policy.js

@@ -39,6 +39,7 @@ const TEST_PATTERNS = [
 ];
 
 const SAFE_WORKSPACE_WRITE_PATTERNS = [/^mkdir\s+-p\s+[-\w./]+$/];
+const PERMISSION_CHANGE_PATTERNS = [/^(?:sudo\s+)?chmod\s+[-+=,rwxugoXst0-7]+\s+[-\w./]+$/];
 
 const NETWORK_FETCH_PATTERNS = [
   /^curl\s+(?:-[A-Za-z0-9]*\s+)*https?:\/\/\S+(?:\s+-o\s+[-\w./]+)?$/,
@@ -153,15 +154,6 @@ function classifySimpleCommand(normalized) {
     return { category: "blocked", reason: "Command is blocked because it references secrets or credential files." };
   }
 
-  const lowered = ` ${normalized.toLowerCase()} `;
-  if (BLOCKED_SHELL_TOKENS.some((part) => normalized.includes(part))) {
-    return {
-      category: "general-shell",
-      needsNetwork: true,
-      writesWorkspace: true,
-      reason: `Command uses general shell syntax: ${normalized}`,
-    };
-  }
   if (matchAny(SAFE_WORKSPACE_WRITE_PATTERNS, normalized)) {
     const target = normalized.replace(/^mkdir\s+-p\s+/, "");
     const virtualWorkspacePath = isSafeVirtualWorkspaceDir(target);
@@ -170,6 +162,16 @@ function classifySimpleCommand(normalized) {
     }
     return { category: "workspace-write", needsNetwork: false, writesWorkspace: true, virtualWorkspacePath };
   }
+  if (matchAny(PERMISSION_CHANGE_PATTERNS, normalized)) {
+    return {
+      category: "permission-change",
+      needsNetwork: false,
+      writesWorkspace: true,
+      reason: `Command changes workspace file mode: ${normalized}`,
+    };
+  }
+
+  const lowered = ` ${normalized.toLowerCase()} `;
   if (BLOCKED_WRITE_TOKENS.some((part) => lowered.includes(part))) {
     return {
       category: "destructive",
@@ -178,6 +180,14 @@ function classifySimpleCommand(normalized) {
       reason: `Command contains a write-capable or destructive token: ${normalized}`,
     };
   }
+  if (BLOCKED_SHELL_TOKENS.some((part) => normalized.includes(part))) {
+    return {
+      category: "general-shell",
+      needsNetwork: true,
+      writesWorkspace: true,
+      reason: `Command uses general shell syntax: ${normalized}`,
+    };
+  }
 
   if (matchAny(READ_ONLY_PATTERNS, normalized)) {
     return { category: "read-only", needsNetwork: false, writesWorkspace: false };
@@ -306,6 +316,20 @@ export function evaluateCommandPolicy(command, config) {
     };
   }
 
+  if (classification.category === "permission-change" && !trustedDockerShell && !trustedHostShell) {
+    return {
+      allowed: false,
+      ...classification,
+      needsApproval: true,
+      reason:
+        sandboxMode === "host"
+          ? "Workspace permission changes on the host require Allow destructive actions. Prefer Docker workspace mode."
+          : "Docker permission changes require docker-workspace mode with Package installs = allow.",
+      sandboxMode,
+      packageInstallPolicy,
+    };
+  }
+
   if (classification.category === "destructive" && !config.allowDestructive) {
     return {
       allowed: false,

package/src/config.js

@@ -42,9 +42,9 @@ export function resolveRuntimeConfig(args, overrides = {}) {
 
   const defaults = getProviderDefaults(route.provider);
   const packageDir = path.resolve(overrides.packageDir || process.env.AGINTIFLOW_PACKAGE_DIR || baseDir);
-  const dockerRequested = parseBoolean(overrides.useDockerSandbox ?? args.useDockerSandbox ?? process.env.USE_DOCKER_SANDBOX, false);
+  const dockerRequested = parseBoolean(overrides.useDockerSandbox ?? args.useDockerSandbox ?? process.env.USE_DOCKER_SANDBOX, true);
   const requestedSandboxMode =
-    overrides.sandboxMode || args.sandboxMode || process.env.SANDBOX_MODE || (dockerRequested ? "docker-readonly" : "host");
+    overrides.sandboxMode || args.sandboxMode || process.env.SANDBOX_MODE || (dockerRequested ? "docker-workspace" : "host");
   const sandboxMode = normalizeSandboxMode(requestedSandboxMode);
 
   return {
@@ -65,14 +65,14 @@ export function resolveRuntimeConfig(args, overrides = {}) {
     apiKey: overrides.apiKey || defaults.apiKey,
     baseURL: overrides.baseURL || defaults.baseURL,
     model: route.model || defaults.model,
-    maxSteps: parseNumber(overrides.maxSteps ?? args.maxSteps ?? process.env.MAX_STEPS, 15),
+    maxSteps: parseNumber(overrides.maxSteps ?? args.maxSteps ?? process.env.MAX_STEPS, 24),
     headless: parseBoolean(overrides.headless ?? args.headless ?? process.env.HEADLESS, false),
     allowedDomains: Array.isArray(overrides.allowedDomains)
       ? overrides.allowedDomains
       : parseList(process.env.ALLOWED_DOMAINS),
     allowPasswords: parseBoolean(overrides.allowPasswords ?? process.env.ALLOW_PASSWORDS, false),
     allowDestructive: parseBoolean(overrides.allowDestructive ?? args.allowDestructive ?? process.env.ALLOW_DESTRUCTIVE, false),
-    allowShellTool: parseBoolean(overrides.allowShellTool ?? args.allowShellTool ?? process.env.ALLOW_SHELL_TOOL, false),
+    allowShellTool: parseBoolean(overrides.allowShellTool ?? args.allowShellTool ?? process.env.ALLOW_SHELL_TOOL, true),
     allowFileTools: parseBoolean(overrides.allowFileTools ?? args.allowFileTools ?? process.env.ALLOW_FILE_TOOLS, true),
     allowWrapperTools: parseBoolean(
       overrides.allowWrapperTools ?? args.allowWrapperTools ?? process.env.ALLOW_WRAPPER_TOOLS,
@@ -84,9 +84,9 @@ export function resolveRuntimeConfig(args, overrides = {}) {
     wrapperTimeoutMs: parseNumber(overrides.wrapperTimeoutMs ?? process.env.WRAPPER_TIMEOUT_MS, 120000),
     sandboxMode,
     packageInstallPolicy: normalizePackageInstallPolicy(
-      overrides.packageInstallPolicy || args.packageInstallPolicy || process.env.PACKAGE_INSTALL_POLICY || "prompt"
+      overrides.packageInstallPolicy || args.packageInstallPolicy || process.env.PACKAGE_INSTALL_POLICY || (sandboxMode === "host" ? "prompt" : "allow")
     ),
-    useDockerSandbox: sandboxMode !== "host" || dockerRequested,
+    useDockerSandbox: sandboxMode !== "host",
     dockerSandboxImage: overrides.dockerSandboxImage || process.env.DOCKER_SANDBOX_IMAGE || "agintiflow-sandbox:latest",
     commandCwd: path.resolve(overrides.commandCwd || args.commandCwd || process.env.COMMAND_CWD || baseDir),
     sessionsDir: path.resolve(baseDir, ".sessions"),

package/src/docker-sandbox.js

@@ -1,5 +1,6 @@
 import { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
@@ -8,6 +9,9 @@ import { redactSensitiveText, redactValue } from "./redaction.js";
 
 const execFile = promisify(execFileCallback);
 const DOCKER_WORKSPACE = "/workspace";
+const DOCKER_HOME = "/aginti-home";
+const DOCKER_CACHE = "/aginti-cache";
+const DOCKER_ENV = "/aginti-env";
 const READY_IMAGES = new Set();
 const SANDBOX_LOG_LIMIT = 80;
 const sandboxLogs = [];
@@ -101,10 +105,31 @@ function sandboxDockerfilePath(config) {
   return path.join(sandboxPackageDir(config), "docker", "sandbox.Dockerfile");
 }
 
+function persistentDockerDirs(config) {
+  const root = path.resolve(
+    config.dockerStateDir || process.env.AGINTIFLOW_DOCKER_STATE_DIR || path.join(os.homedir(), ".agintiflow", "docker")
+  );
+  return {
+    root,
+    home: path.join(root, "home"),
+    cache: path.join(root, "cache"),
+    env: path.join(root, "env"),
+  };
+}
+
+async function ensurePersistentDockerDirs(config) {
+  const dirs = persistentDockerDirs(config);
+  await Promise.all([fs.mkdir(dirs.home, { recursive: true }), fs.mkdir(dirs.cache, { recursive: true }), fs.mkdir(dirs.env, { recursive: true })]);
+  return dirs;
+}
+
 export async function getDockerSandboxStatus(config) {
   const image = config.dockerSandboxImage;
   const dockerfilePath = sandboxDockerfilePath(config);
   const workspace = config.commandCwd;
+  if (config.useDockerSandbox) {
+    await ensurePersistentDockerDirs(config).catch(() => null);
+  }
   const [dockerReady, dockerfileExists, workspaceExists, workspaceReadable, workspaceWritable] = await Promise.all([
     dockerAvailable(),
     pathAccess(dockerfilePath, fsConstants.R_OK),
@@ -114,6 +139,12 @@ export async function getDockerSandboxStatus(config) {
   ]);
 
   const imageReady = dockerReady ? await dockerImageExists(image) : false;
+  const persistentDirs = persistentDockerDirs(config);
+  const [persistentHomeExists, persistentCacheExists, persistentEnvExists] = await Promise.all([
+    pathAccess(persistentDirs.home, fsConstants.F_OK),
+    pathAccess(persistentDirs.cache, fsConstants.F_OK),
+    pathAccess(persistentDirs.env, fsConstants.F_OK),
+  ]);
   return {
     sandboxMode: normalizeSandboxMode(config.sandboxMode),
     useDockerSandbox: Boolean(config.useDockerSandbox),
@@ -127,6 +158,18 @@ export async function getDockerSandboxStatus(config) {
     workspaceReadable,
     workspaceWritable,
     dockerfileExists,
+    persistentDocker: {
+      home: persistentDirs.home,
+      cache: persistentDirs.cache,
+      env: persistentDirs.env,
+      homeExists: persistentHomeExists,
+      cacheExists: persistentCacheExists,
+      envExists: persistentEnvExists,
+      containerHome: DOCKER_HOME,
+      containerCache: DOCKER_CACHE,
+      containerEnv: DOCKER_ENV,
+      pythonVenv: `${DOCKER_ENV}/python`,
+    },
     logs: getSandboxLogs(),
   };
 }
@@ -165,7 +208,31 @@ export async function ensureDockerSandboxReady(config, observers, options = {})
   await buildDockerSandboxImage(config, observers);
 }
 
-function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config)) {
+function dockerCommand(command, policy) {
+  const envLines = [
+    `export HOME=${DOCKER_HOME}`,
+    `export XDG_CACHE_HOME=${DOCKER_CACHE}`,
+    `export PIP_CACHE_DIR=${DOCKER_CACHE}/pip`,
+    `export UV_CACHE_DIR=${DOCKER_CACHE}/uv`,
+    `export NPM_CONFIG_CACHE=${DOCKER_CACHE}/npm`,
+    `export CONDA_PKGS_DIRS=${DOCKER_CACHE}/conda-pkgs`,
+    `export PYTHONUSERBASE=${DOCKER_ENV}/python-user`,
+    `export PATH=${DOCKER_ENV}/python/bin:${DOCKER_ENV}/python-user/bin:${DOCKER_ENV}/miniforge/bin:${DOCKER_ENV}/bin:$PATH`,
+    `cd ${DOCKER_WORKSPACE}`,
+    `if ! command -v sudo >/dev/null 2>&1; then sudo() { "$@"; }; export -f sudo; fi`,
+  ];
+
+  if (!policy.requiresDockerRoot) {
+    envLines.push(
+      `if command -v python3 >/dev/null 2>&1 && [ ! -x ${DOCKER_ENV}/python/bin/python ]; then python3 -m venv --system-site-packages ${DOCKER_ENV}/python >/dev/null 2>&1 || true; fi`,
+      `if [ -f ${DOCKER_ENV}/python/bin/activate ]; then . ${DOCKER_ENV}/python/bin/activate; fi`
+    );
+  }
+
+  return [...envLines, String(command)].join("\n");
+}
+
+function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config), persistentDirs = persistentDockerDirs(config)) {
   const uid = typeof process.getuid === "function" ? String(process.getuid()) : "";
   const gid = typeof process.getgid === "function" ? String(process.getgid()) : "";
   const userArgs = uid && gid && !policy.requiresDockerRoot ? ["--user", `${uid}:${gid}`] : [];
@@ -196,24 +263,29 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
     ...readOnlyArgs,
     ...userArgs,
     "-e",
-    "HOME=/tmp",
-    "-e",
     "NPM_CONFIG_USERCONFIG=/tmp/.npmrc",
     "-e",
     "PIP_DISABLE_PIP_VERSION_CHECK=1",
     "-v",
     `${config.commandCwd}:${DOCKER_WORKSPACE}:${mountMode}`,
+    "-v",
+    `${persistentDirs.home}:${DOCKER_HOME}:rw`,
+    "-v",
+    `${persistentDirs.cache}:${DOCKER_CACHE}:rw`,
+    "-v",
+    `${persistentDirs.env}:${DOCKER_ENV}:rw`,
     "-w",
     DOCKER_WORKSPACE,
     config.dockerSandboxImage,
     "bash",
     "-lc",
-    String(command),
+    dockerCommand(command, policy),
   ];
 }
 
 export async function runDockerSandboxCommand(command, config, policy = evaluateCommandPolicy(command, config)) {
-  const result = await execDocker(dockerRunArgs(command, config, policy), {
+  const persistentDirs = await ensurePersistentDockerDirs(config);
+  const result = await execDocker(dockerRunArgs(command, config, policy, persistentDirs), {
     timeout: policy.needsNetwork ? 120000 : policy.category === "toolchain" ? 90000 : 15000,
     maxBuffer: 300 * 1024,
   });
@@ -227,6 +299,7 @@ export async function runDockerSandboxCommand(command, config, policy = evaluate
     category: policy.category,
     sandboxMode: policy.sandboxMode,
     network: policy.needsNetwork ? "bridge" : "none",
+    persistentDocker: persistentDirs,
     stdout: payload.stdout.slice(0, 1200),
     stderr: payload.stderr.slice(0, 1200),
   });
@@ -274,6 +347,7 @@ export async function runDockerPreflight(config, options = {}) {
 
   let status = await getDockerSandboxStatus(config);
   const runChecks = async () => {
+    const persistentDirs = await ensurePersistentDockerDirs(config);
     const results = [];
     for (const command of [
       "node -v",
@@ -287,7 +361,7 @@ export async function runDockerPreflight(config, options = {}) {
       "rg --version",
     ]) {
       try {
-        const result = await execDocker(dockerRunArgs(command, config, { needsNetwork: false, category: "preflight" }), {
+        const result = await execDocker(dockerRunArgs(command, config, { needsNetwork: false, category: "preflight" }, persistentDirs), {
           timeout: 15000,
           maxBuffer: 100 * 1024,
         });

package/src/interactive-cli.js

@@ -21,6 +21,7 @@ function printHelp() {
       "  /model <name>             Set an explicit model, or /model auto.",
       "  /docker on                Use docker-workspace with approved package installs.",
       "  /docker off               Use host shell policy.",
+      "  /latex on                 Use the LaTeX/PDF profile in Docker with a larger step budget.",
       "  /installs block|prompt|allow",
       "  /cwd <path>               Change command workspace.",
       "  /exit                     Quit.",
@@ -50,8 +51,8 @@ function createState(args = {}) {
     model: args.model || "",
     routingMode: args.routingMode || "smart",
     commandCwd: args.commandCwd || process.cwd(),
-    sandboxMode: normalizeSandboxMode(args.sandboxMode || "host"),
-    packageInstallPolicy: normalizePackageInstallPolicy(args.packageInstallPolicy || "prompt"),
+    sandboxMode: normalizeSandboxMode(args.sandboxMode || "docker-workspace"),
+    packageInstallPolicy: normalizePackageInstallPolicy(args.packageInstallPolicy || "allow"),
     allowShellTool: args.allowShellTool ?? true,
     allowFileTools: args.allowFileTools ?? true,
     allowWrapperTools: args.allowWrapperTools ?? false,
@@ -59,7 +60,7 @@ function createState(args = {}) {
     preferredWrapper: args.preferredWrapper || "codex",
     taskProfile: normalizeTaskProfile(args.taskProfile || "auto"),
     headless: args.headless ?? false,
-    maxSteps: Number.isFinite(args.maxSteps) && args.maxSteps > 0 ? args.maxSteps : 15,
+    maxSteps: Number.isFinite(args.maxSteps) && args.maxSteps > 0 ? args.maxSteps : args.latex ? 30 : 24,
     sessionId: args.resume || "",
   };
 }
@@ -140,6 +141,21 @@ async function handleCommand(line, state, packageDir) {
     }
     return true;
   }
+  if (command === "latex") {
+    if (value === "on" || value === "") {
+      state.taskProfile = "latex";
+      state.sandboxMode = "docker-workspace";
+      state.packageInstallPolicy = "allow";
+      state.maxSteps = Math.max(state.maxSteps, 30);
+      console.log("latex=on profile=latex sandbox=docker-workspace installs=allow maxSteps=30");
+    } else if (value === "off") {
+      state.taskProfile = "auto";
+      console.log("latex=off profile=auto");
+    } else {
+      console.log("Usage: /latex on OR /latex off");
+    }
+    return true;
+  }
   if (command === "cwd") {
     state.commandCwd = value || process.cwd();
     console.log(`cwd=${state.commandCwd}`);

package/src/model-client.js

@@ -146,7 +146,7 @@ export async function createPlan(client, config, state) {
           state.startUrl ? `Suggested start URL: ${state.startUrl}` : "",
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
-            ? `Shell tool is enabled in ${config.commandCwd}. In Docker, this path is mounted as /workspace. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow.`
+            ? `Shell tool is enabled in ${config.commandCwd}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow.`
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: list_files, read_file, search_files, write_file, apply_patch. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets.`
@@ -159,6 +159,8 @@ export async function createPlan(client, config, state) {
           "Work like a practical coding agent: inspect when useful, edit with file tools, run safe checks when they add confidence, and keep outputs inside the workspace.",
           "Use the canvas tunnel for outputs the user would likely want to inspect visually, such as figures, PDFs, screenshots, images, important markdown, or generated files.",
           "For environment or system-maintenance work, prefer project-local dry-run plans/scripts unless the configured policy explicitly allows stronger actions.",
+          "Docker language/toolchain installs should prefer /aginti-env or project files so they persist across runs; apt/apk changes are ephemeral unless the image is rebuilt.",
+          "If the run is close to the max-step limit, finish with the best complete artifact and honest limitations instead of starting a new approach.",
           "Plan for a complete result, not endless exploration; finish once the request is satisfied and checks have passed or been honestly skipped.",
           "Return a numbered plan only.",
         ]

package/src/session-store.js

@@ -10,6 +10,7 @@ export class SessionStore {
     this.statePath = path.join(this.sessionDir, "state.json");
     this.planPath = path.join(this.sessionDir, "plan.md");
     this.eventsPath = path.join(this.sessionDir, "events.jsonl");
+    this.inboxPath = path.join(this.sessionDir, "inbox.jsonl");
     this.storageStatePath = path.join(this.sessionDir, "storage-state.json");
   }
 
@@ -59,6 +60,34 @@ export class SessionStore {
     }
   }
 
+  async appendInbox(content, metadata = {}) {
+    await this.ensure();
+    const text = String(content || "").trim();
+    if (!text) return;
+    const line = JSON.stringify({
+      timestamp: new Date().toISOString(),
+      content: text,
+      ...metadata,
+    });
+    await fs.appendFile(this.inboxPath, `${line}\n`, "utf8");
+  }
+
+  async drainInbox() {
+    await this.ensure();
+    let raw = "";
+    try {
+      raw = await fs.readFile(this.inboxPath, "utf8");
+    } catch {
+      return [];
+    }
+    await fs.writeFile(this.inboxPath, "", "utf8");
+    return raw
+      .split("\n")
+      .map((line) => line.trim())
+      .filter(Boolean)
+      .map((line) => JSON.parse(line));
+  }
+
   async saveSnapshot(step, snapshot) {
     await this.ensure();
     const filename = `step-${String(step).padStart(3, "0")}.snapshot.json`;

package/src/task-profiles.js

@@ -66,7 +66,7 @@ export const TASK_PROFILES = {
     id: "latex",
     label: "LaTeX",
     prompt:
-      "For LaTeX/PDF tasks, create source and figures in a subfolder, compile when a TeX toolchain is available, and send the PDF through the canvas tunnel.",
+      "For LaTeX/PDF tasks, create source and figures in a subfolder, compile when a TeX toolchain is available, and send the PDF through the canvas tunnel. In Docker, use /workspace for project outputs and the persistent Python/conda/tool cache under /aginti-env when setup is needed.",
     tools: ["files", "shell", "canvas", "sandbox"],
   },
   maintenance: {

package/src/web-db.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { getModelPresets } from "./model-routing.js";
 
-const PREFERENCES_SCHEMA_VERSION = 3;
+const PREFERENCES_SCHEMA_VERSION = 4;
 
 function defaultPreferences(baseDir) {
   const presets = getModelPresets();
@@ -13,7 +13,7 @@ function defaultPreferences(baseDir) {
     provider: "deepseek",
     model: presets.fast.model,
     headless: true,
-    maxSteps: 15,
+    maxSteps: 24,
     startUrl: "",
     allowedDomains: "",
     commandCwd: path.resolve(baseDir),
@@ -23,7 +23,7 @@ function defaultPreferences(baseDir) {
     preferredWrapper: "codex",
     wrapperTimeoutMs: 120000,
     sandboxMode: "docker-workspace",
-    packageInstallPolicy: "prompt",
+    packageInstallPolicy: "allow",
     useDockerSandbox: true,
     dockerSandboxImage: "agintiflow-sandbox:latest",
     allowPasswords: false,
@@ -89,8 +89,11 @@ export class WebDatabase {
           preferences.sandboxMode = "docker-workspace";
           preferences.useDockerSandbox = true;
         }
-        if (parsed.packageInstallPolicy === "block") {
-          preferences.packageInstallPolicy = "prompt";
+        if ((parsed.packageInstallPolicy || "") !== "allow") {
+          preferences.packageInstallPolicy = "allow";
+        }
+        if (!Number.isFinite(Number(parsed.maxSteps)) || Number(parsed.maxSteps) < 24) {
+          preferences.maxSteps = 24;
         }
         this.savePreferences(preferences);
       }

package/web.js

@@ -130,7 +130,7 @@ function normalizePreferencePayload(body = {}, current = db.getPreferences()) {
           ? providerDefaults.model
           : current.model || modelPresets.fast.model || providerDefaults.model,
     headless: typeof body.headless === "boolean" ? body.headless : Boolean(current.headless),
-    maxSteps: Number.isFinite(parsedMaxSteps) && parsedMaxSteps > 0 ? parsedMaxSteps : Number(current.maxSteps) || 15,
+    maxSteps: Number.isFinite(parsedMaxSteps) && parsedMaxSteps > 0 ? parsedMaxSteps : Number(current.maxSteps) || 24,
     startUrl: typeof body.startUrl === "string" ? body.startUrl.trim() : current.startUrl || "",
     allowedDomains:
       typeof body.allowedDomains === "string" ? body.allowedDomains.trim() : current.allowedDomains || "",
@@ -156,7 +156,7 @@ function normalizePreferencePayload(body = {}, current = db.getPreferences()) {
           : Boolean(current.useDockerSandbox),
     sandboxMode,
     packageInstallPolicy: normalizePackageInstallPolicy(
-      body.packageInstallPolicy || current.packageInstallPolicy || "prompt"
+      body.packageInstallPolicy || current.packageInstallPolicy || (sandboxMode === "host" ? "prompt" : "allow")
     ),
     dockerSandboxImage:
       typeof body.dockerSandboxImage === "string" && body.dockerSandboxImage.trim()
@@ -519,7 +519,7 @@ app.get("/api/config", async (_req, res) => {
       deepseek: publicProviderDefault("deepseek"),
       mock: publicProviderDefault("mock"),
       headless: true,
-      maxSteps: 15,
+      maxSteps: 24,
     },
     taskProfiles: listTaskProfiles(),
     routing: {
@@ -768,6 +768,28 @@ app.post("/api/sessions/:sessionId/messages", async (req, res) => {
     return;
   }
 
+  if (!isSafeSessionId(sessionId)) {
+    res.status(400).json({ error: "Invalid session id." });
+    return;
+  }
+
+  const active = runs.get(sessionId);
+  if (active?.status === "running") {
+    const store = sessionStore(sessionId);
+    await store.appendInbox(content, { source: "web" });
+    await store.appendEvent("conversation.queued_input", { prompt: content, source: "web" }).catch(() => {});
+    active.logs.push({
+      at: new Date().toISOString(),
+      kind: "event",
+      message: "conversation.queued_input",
+      data: { prompt: content, source: "web" },
+    });
+    active.updatedAt = new Date().toISOString();
+    db.upsertSession(active);
+    res.json({ sessionId, queued: true });
+    return;
+  }
+
   try {
     await ensureNotRunning(sessionId);
   } catch (error) {