@integrity-labs/agt-cli 0.28.1190 → 0.28.1192

package/dist/{chunk-55M26Q4M.js → chunk-UQYIFOWE.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-XWVM4KPK.js";
 import {
   FORCED_UPDATE_HARD_DEADLINE_MS
-} from "./chunk-7GZKHF45.js";
+} from "./chunk-UUO7QTLC.js";
 import {
   effectiveClaudeJsonPath
 } from "./chunk-AIUIMEUS.js";
@@ -722,4 +722,4 @@ export {
   probeClaudeInstalls,
   maybeUpdateClaudeCode
 };
-//# sourceMappingURL=chunk-55M26Q4M.js.map
+//# sourceMappingURL=chunk-UQYIFOWE.js.map

package/dist/{chunk-7GZKHF45.js → chunk-UUO7QTLC.js}

@@ -164,30 +164,90 @@ var AGENT_RULES_SECTION_END = "<!-- AGT:RULES_END -->";
 var MAX_AGENT_RULES = 8;
 var MAX_AGENT_RULE_CHARS = 200;
 var MAX_AGENT_RULES_CHARS = MAX_AGENT_RULES * (MAX_AGENT_RULE_CHARS + 4);
-function agentRulesRestartBasis(rules) {
+var MAX_ORG_RULES = 10;
+var MAX_TEAM_RULES = 10;
+var MAX_INHERITED_RULES_CHARS = (MAX_ORG_RULES + MAX_TEAM_RULES) * (MAX_AGENT_RULE_CHARS + 4);
+function resolveInheritedForDelivery(received, lastKnown, currentTeamId) {
+  if (received === void 0)
+    return { rules: void 0, reusedLastKnown: [], unknown: [] };
+  const reusedLastKnown = [];
+  const unknown2 = [];
+  const pick = (scope) => {
+    const got = received[scope];
+    if (got !== null)
+      return got;
+    if (lastKnown && (scope === "organization" || lastKnown.teamId === currentTeamId)) {
+      reusedLastKnown.push(scope);
+      return lastKnown.rules[scope];
+    }
+    unknown2.push(scope);
+    return [];
+  };
+  return { rules: { organization: pick("organization"), team: pick("team") }, reusedLastKnown, unknown: unknown2 };
+}
+function agentRulesRestartBasis(rules, inherited) {
+  const own = basisOf(rules);
+  const org = basisOf(inherited?.organization ?? []);
+  const team = basisOf(inherited?.team ?? []);
+  if (org === "" && team === "")
+    return own;
+  return `${own}
organization\0${org}
team\0${team}`;
+}
+function basisOf(rules) {
   return [...rules].map((r) => r.text.trim()).filter((t) => t.length > 0).sort().join("\0");
 }
-function agentHasRules(rules) {
-  return rules.some((r) => r.text.trim().length > 0);
+function agentHasRules(rules, inherited) {
+  const any = (list) => list.some((r) => r.text.trim().length > 0);
+  return any(rules) || any(inherited?.organization ?? []) || any(inherited?.team ?? []);
 }
-function buildAgentRulesSection(rules) {
-  const kept = rules.map((r) => r.text.trim()).filter(Boolean).filter((t) => t.length <= MAX_AGENT_RULE_CHARS).slice(0, MAX_AGENT_RULES);
-  if (kept.length === 0)
-    return "";
-  const lines = kept.map((t) => `- ${t}`).join("\n");
+function buildAgentRulesSection(rules, inherited) {
+  const kept = keepRenderable(rules, MAX_AGENT_RULES);
+  const org = keepRenderable(inherited?.organization ?? [], MAX_ORG_RULES);
+  const team = keepRenderable(inherited?.team ?? [], MAX_TEAM_RULES);
+  if (org.length === 0 && team.length === 0) {
+    if (kept.length === 0)
+      return "";
+    return `${AGENT_RULES_SECTION_START}
+## Standing rules from your people
+
+${RULES_PREAMBLE}
+
+${bullets(kept)}
+${AGENT_RULES_SECTION_END}
+
+`;
+  }
+  const blocks = [];
+  if (org.length > 0)
+    blocks.push(`From your organisation:
+${bullets(org)}`);
+  if (team.length > 0)
+    blocks.push(`From your team:
+${bullets(team)}`);
+  if (kept.length > 0)
+    blocks.push(`Yours:
+${bullets(kept)}`);
   return `${AGENT_RULES_SECTION_START}
 ## Standing rules from your people
 
-Rules your team has asked you to follow every time, in their words. They are not
-task-specific \u2014 they apply on every turn regardless of what you are doing. If one
-ever conflicts with a guardrail above, the guardrail wins and you should say so
-rather than silently picking one.
+${RULES_PREAMBLE} If two of these rules conflict, the more specific one wins:
+yours over your team's, and your team's over your organisation's.
 
-${lines}
+${blocks.join("\n\n")}
 ${AGENT_RULES_SECTION_END}
 
 `;
 }
+var RULES_PREAMBLE = `Rules your team has asked you to follow every time, in their words. They are not
+task-specific \u2014 they apply on every turn regardless of what you are doing. If one
+ever conflicts with a guardrail above, the guardrail wins and you should say so
+rather than silently picking one.`;
+function bullets(texts) {
+  return texts.map((t) => `- ${t}`).join("\n");
+}
+function keepRenderable(rules, max) {
+  return rules.map((r) => r.text.trim()).filter(Boolean).filter((t) => t.length <= MAX_AGENT_RULE_CHARS).slice(0, max);
+}
 
 // ../../packages/core/dist/provisioning/frameworks/claudecode/agent-console-url.js
 var DEFAULT_AGENT_CONSOLE_URL = "https://app.ninjafy.com";
@@ -1260,6 +1320,25 @@ var REQUIRE_APPROVAL_HOW = {
     `  \`check_approval\` says it is approved.`
   ]
 };
+var REQUIRE_APPROVAL_DELETE_SCOPE = [
+  `  What \`delete\` covers: removing anything that cannot be recovered or is not only`,
+  `  yours.`,
+  `  - work that exists only in your directory: uncommitted changes, unpushed commits,`,
+  `    stashes, customer documents, memory files;`,
+  `  - anything shared or outside your own agent directory: remote branches, databases,`,
+  `    other agents' files, \`/tmp\`;`,
+  `  - anything customers or the platform can see.`,
+  `  It does not cover your own rebuildable files, which need no approval: package caches,`,
+  `  build output, and your own scratch files under your agent directory (never \`/tmp\`,`,
+  `  which other agents share). A git worktree or local branch joins that group only`,
+  `  when you have checked, against the remote as it is now and at the moment you remove`,
+  `  it, that its tree is clean with ignored files included, there are no stashes, nothing`,
+  `  is unpushed, and it is merged into, or fully on a branch that still exists on, the`,
+  `  remote, and that it is not your base clone, has no open pull request, and is not in`,
+  `  use by a task of yours that is still in progress or waiting (the`,
+  `  \`reclaim-stale-worktrees\` skill, where your org has it, walks through these).`,
+  `  If you cannot check, or are unsure which list something is on, treat it as a delete.`
+];
 var REQUIRE_APPROVAL_EMAIL_DETAIL = [
   `  For an email, pass \`detail.email\` = { to, from, subject } so your manager sees who it`,
   `  goes to.`
@@ -1308,7 +1387,7 @@ function requireApprovalActions(config) {
   const raw = config?.["actions"];
   if (!Array.isArray(raw))
     return null;
-  const actions = raw.filter((a) => typeof a === "string" && a.trim() !== "").map((a) => a.trim());
+  const actions = raw.filter((a) => typeof a === "string" && a.trim() !== "").map((a) => a.trim().toLowerCase());
   return actions.length > 0 ? actions : null;
 }
 function requireApprovalHowLines(g, level, holds) {
@@ -1319,8 +1398,10 @@ function requireApprovalHowLines(g, level, holds) {
   const namesOther = actions === null || actions.some((a) => a !== REQUIRE_APPROVAL_EMAIL_ACTION);
   const asksAboutEmail = namesEmail && emailHold === null && domainHold === null;
   const ask = namesOther || asksAboutEmail || namesEmail && domainHold !== null;
+  const namesDelete = actions === null || actions.includes("delete");
   return [
     ...ask ? REQUIRE_APPROVAL_HOW[level] : [],
+    ...namesDelete ? REQUIRE_APPROVAL_DELETE_SCOPE : [],
     ...asksAboutEmail ? REQUIRE_APPROVAL_EMAIL_DETAIL : [],
     ...namesEmail && emailHold !== null ? requireApprovalEmailException(emailHold) : [],
     ...namesEmail && domainHold !== null ? requireApprovalDomainHoldException(domainHold.covered) : []
@@ -1456,7 +1537,7 @@ function generateClaudeMd(input) {
   const renderIntegrations = input.renderIntegrationsSection === true;
   const integrationsSection = renderIntegrations ? buildIntegrationsSection(integrations) : "";
   const capabilityPromptSection = buildCapabilityPromptSection(integrations, renderIntegrations);
-  const agentRulesSection = buildAgentRulesSection(input.agentRules ?? []);
+  const agentRulesSection = buildAgentRulesSection(input.agentRules ?? [], input.inheritedAgentRules);
   const kanbanWorkPolicySection = buildKanbanWorkPolicySection();
   const platformStorageSection = buildPlatformStorageSection(input.hasWorkflows);
   const skillAuthoringSection = buildSkillAuthoringSection();
@@ -17424,6 +17505,7 @@ export {
   scrubPreservingIdentifiers,
   identifierMemoryName,
   EXTRACTOR_IDENTIFIER_RULE,
+  resolveInheritedForDelivery,
   agentRulesRestartBasis,
   agentHasRules,
   SCRATCH_RETENTION_DAYS,
@@ -17590,4 +17672,4 @@ export {
   isForcedUpdatePastDeadline,
   shouldMintReplacementKey
 };
-//# sourceMappingURL=chunk-7GZKHF45.js.map
+//# sourceMappingURL=chunk-UUO7QTLC.js.map