@grwnd/pi-governance 1.5.0 → 1.6.0

package/dist/extensions/index.js

@@ -1,3 +1,6 @@
+// src/extensions/index.ts
+import { existsSync as existsSync2 } from "fs";
+
 // src/lib/config/loader.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
@@ -180,7 +183,20 @@ var DEFAULTS = {
     sinks: [{ type: "jsonl", path: "~/.pi/agent/audit.jsonl" }]
   },
   dlp: {
-    enabled: false
+    enabled: true,
+    mode: "audit",
+    on_input: "block",
+    on_output: "mask",
+    masking: {
+      strategy: "partial",
+      show_chars: 4,
+      placeholder: "***"
+    },
+    severity_threshold: "low",
+    built_in: {
+      secrets: true,
+      pii: true
+    }
   }
 };
 
@@ -1314,7 +1330,47 @@ var piGovernance = (pi) => {
     const chain = createIdentityChain(config.auth);
     identity = await chain.resolve();
     const rulesFile = config.policy?.yaml?.rules_file ?? "./governance-rules.yaml";
-    policyEngine = new YamlPolicyEngine(rulesFile);
+    if (existsSync2(rulesFile)) {
+      policyEngine = new YamlPolicyEngine(rulesFile);
+    } else {
+      policyEngine = new YamlPolicyEngine({
+        roles: {
+          admin: {
+            allowed_tools: ["all"],
+            blocked_tools: [],
+            prompt_template: "admin",
+            execution_mode: "autonomous",
+            human_approval: { required_for: [] },
+            token_budget_daily: -1,
+            allowed_paths: ["**"],
+            blocked_paths: []
+          },
+          project_lead: {
+            allowed_tools: ["all"],
+            blocked_tools: [],
+            prompt_template: "project-lead",
+            execution_mode: "supervised",
+            human_approval: { required_for: ["bash", "write"] },
+            token_budget_daily: -1,
+            allowed_paths: ["**"],
+            blocked_paths: []
+          },
+          analyst: {
+            allowed_tools: ["read", "grep", "find", "ls"],
+            blocked_tools: ["write", "edit", "bash"],
+            prompt_template: "analyst",
+            execution_mode: "supervised",
+            human_approval: { required_for: ["all"] },
+            token_budget_daily: -1,
+            allowed_paths: ["**"],
+            blocked_paths: []
+          }
+        }
+      });
+      if (config.policy?.yaml?.rules_file) {
+        ctx.ui.notify(`Rules file not found: ${rulesFile} \u2014 using built-in defaults`, "warning");
+      }
+    }
     executionMode = policyEngine.getExecutionMode(identity.role);
     const bashOverrides = policyEngine.getBashOverrides(identity.role);
     bashClassifier = new BashClassifier(bashOverrides);
@@ -1346,7 +1402,9 @@ var piGovernance = (pi) => {
         (newConfig) => {
           config = newConfig;
           const newRulesFile = newConfig.policy?.yaml?.rules_file ?? "./governance-rules.yaml";
-          policyEngine = new YamlPolicyEngine(newRulesFile);
+          if (existsSync2(newRulesFile)) {
+            policyEngine = new YamlPolicyEngine(newRulesFile);
+          }
           const newOverrides = policyEngine.getBashOverrides(identity.role);
           bashClassifier = new BashClassifier(newOverrides);
           const newDlpCfg = resolveDlpConfig(newConfig.dlp, identity.role);