@grwnd/pi-governance 1.5.0 → 1.6.0

package/dist/extensions/index.cjs

@@ -23,6 +23,7 @@ __export(extensions_exports, {
   default: () => extensions_default
 });
 module.exports = __toCommonJS(extensions_exports);
+var import_node_fs2 = require("fs");
 
 // src/lib/config/loader.ts
 var import_fs = require("fs");
@@ -206,7 +207,20 @@ var DEFAULTS = {
     sinks: [{ type: "jsonl", path: "~/.pi/agent/audit.jsonl" }]
   },
   dlp: {
-    enabled: false
+    enabled: true,
+    mode: "audit",
+    on_input: "block",
+    on_output: "mask",
+    masking: {
+      strategy: "partial",
+      show_chars: 4,
+      placeholder: "***"
+    },
+    severity_threshold: "low",
+    built_in: {
+      secrets: true,
+      pii: true
+    }
   }
 };
 
@@ -1340,7 +1354,47 @@ var piGovernance = (pi) => {
     const chain = createIdentityChain(config.auth);
     identity = await chain.resolve();
     const rulesFile = config.policy?.yaml?.rules_file ?? "./governance-rules.yaml";
-    policyEngine = new YamlPolicyEngine(rulesFile);
+    if ((0, import_node_fs2.existsSync)(rulesFile)) {
+      policyEngine = new YamlPolicyEngine(rulesFile);
+    } else {
+      policyEngine = new YamlPolicyEngine({
+        roles: {
+          admin: {
+            allowed_tools: ["all"],
+            blocked_tools: [],
+            prompt_template: "admin",
+            execution_mode: "autonomous",
+            human_approval: { required_for: [] },
+            token_budget_daily: -1,
+            allowed_paths: ["**"],
+            blocked_paths: []
+          },
+          project_lead: {
+            allowed_tools: ["all"],
+            blocked_tools: [],
+            prompt_template: "project-lead",
+            execution_mode: "supervised",
+            human_approval: { required_for: ["bash", "write"] },
+            token_budget_daily: -1,
+            allowed_paths: ["**"],
+            blocked_paths: []
+          },
+          analyst: {
+            allowed_tools: ["read", "grep", "find", "ls"],
+            blocked_tools: ["write", "edit", "bash"],
+            prompt_template: "analyst",
+            execution_mode: "supervised",
+            human_approval: { required_for: ["all"] },
+            token_budget_daily: -1,
+            allowed_paths: ["**"],
+            blocked_paths: []
+          }
+        }
+      });
+      if (config.policy?.yaml?.rules_file) {
+        ctx.ui.notify(`Rules file not found: ${rulesFile} \u2014 using built-in defaults`, "warning");
+      }
+    }
     executionMode = policyEngine.getExecutionMode(identity.role);
     const bashOverrides = policyEngine.getBashOverrides(identity.role);
     bashClassifier = new BashClassifier(bashOverrides);
@@ -1372,7 +1426,9 @@ var piGovernance = (pi) => {
         (newConfig) => {
           config = newConfig;
           const newRulesFile = newConfig.policy?.yaml?.rules_file ?? "./governance-rules.yaml";
-          policyEngine = new YamlPolicyEngine(newRulesFile);
+          if ((0, import_node_fs2.existsSync)(newRulesFile)) {
+            policyEngine = new YamlPolicyEngine(newRulesFile);
+          }
           const newOverrides = policyEngine.getBashOverrides(identity.role);
           bashClassifier = new BashClassifier(newOverrides);
           const newDlpCfg = resolveDlpConfig(newConfig.dlp, identity.role);