@nail00749/agent-gvozd 0.1.3 → 0.1.4

package/defaults/agents/verifier.jsonc

@@ -34,6 +34,76 @@
       "resource": "*",
       "effect": "allow"
     },
+    {
+      "action": "gitnexus_*",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "gitnexus_rename",
+      "resource": "*",
+      "effect": "deny"
+    },
+    {
+      "action": "gitnexus_group_sync",
+      "resource": "*",
+      "effect": "deny"
+    },
+    {
+      "action": "playwright_*",
+      "resource": "*",
+      "effect": "ask"
+    },
+    {
+      "action": "playwright_browser_get_config",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_snapshot",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_take_screenshot",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_console_messages",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_network_requests",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_tabs",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_find",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_generate_locator",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_verify_*",
+      "resource": "*",
+      "effect": "allow"
+    },
+    {
+      "action": "playwright_browser_run_code_unsafe",
+      "resource": "*",
+      "effect": "deny"
+    },
     {
       "action": "shell",
       "resource": "*",
@@ -729,6 +799,46 @@
       "resource": "git status *",
       "effect": "allow"
     },
+    {
+      "action": "shell",
+      "resource": "git status --short",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git status --short *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git status --short --branch",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git status --short --branch *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git status --porcelain",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git status --porcelain *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git status --porcelain=v1 --branch",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git status --porcelain=v1 --branch *",
+      "effect": "allow"
+    },
     {
       "action": "shell",
       "resource": "git diff",
@@ -739,6 +849,36 @@
       "resource": "git diff *",
       "effect": "allow"
     },
+    {
+      "action": "shell",
+      "resource": "git diff --stat",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git diff --stat *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git diff --cached",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git diff --cached *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git diff --check",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git diff --check *",
+      "effect": "allow"
+    },
     {
       "action": "shell",
       "resource": "git log",
@@ -749,21 +889,96 @@
       "resource": "git log *",
       "effect": "allow"
     },
+    {
+      "action": "shell",
+      "resource": "git show",
+      "effect": "allow"
+    },
     {
       "action": "shell",
       "resource": "git show *",
       "effect": "allow"
     },
+    {
+      "action": "shell",
+      "resource": "git rev-parse",
+      "effect": "allow"
+    },
     {
       "action": "shell",
       "resource": "git rev-parse *",
       "effect": "allow"
     },
+    {
+      "action": "shell",
+      "resource": "git rev-list",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git rev-list *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git show-ref",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git show-ref *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git cat-file",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git cat-file *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git symbolic-ref HEAD",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git symbolic-ref --short HEAD",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git ls-files",
+      "effect": "allow"
+    },
     {
       "action": "shell",
       "resource": "git ls-files *",
       "effect": "allow"
     },
+    {
+      "action": "shell",
+      "resource": "git ls-remote",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git ls-remote *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git grep",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git grep *",
+      "effect": "allow"
+    },
     {
       "action": "shell",
       "resource": "git branch",
@@ -771,7 +986,7 @@
     },
     {
       "action": "shell",
-      "resource": "git branch *",
+      "resource": "git tag",
       "effect": "allow"
     },
     {
@@ -781,107 +996,302 @@
     },
     {
       "action": "shell",
-      "resource": "git remote *",
+      "resource": "git reflog",
       "effect": "allow"
     },
     {
       "action": "shell",
-      "resource": "git grep *",
+      "resource": "git branch --list",
       "effect": "allow"
     },
     {
       "action": "shell",
-      "resource": "git rev-list *",
+      "resource": "git branch --list *",
       "effect": "allow"
     },
     {
       "action": "shell",
-      "resource": "git show-ref *",
+      "resource": "git branch -l",
       "effect": "allow"
     },
     {
       "action": "shell",
-      "resource": "git cat-file *",
+      "resource": "git branch -l *",
       "effect": "allow"
     },
     {
       "action": "shell",
-      "resource": "git symbolic-ref *",
+      "resource": "git branch -a",
       "effect": "allow"
     },
     {
       "action": "shell",
-      "resource": "git config --get *",
+      "resource": "git branch -a *",
       "effect": "allow"
     },
     {
-      "action": "gitnexus_*",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch -r",
       "effect": "allow"
     },
     {
-      "action": "gitnexus_rename",
-      "resource": "*",
-      "effect": "deny"
+      "action": "shell",
+      "resource": "git branch -r *",
+      "effect": "allow"
     },
     {
-      "action": "gitnexus_group_sync",
-      "resource": "*",
-      "effect": "deny"
+      "action": "shell",
+      "resource": "git branch -v",
+      "effect": "allow"
     },
     {
-      "action": "playwright_*",
-      "resource": "*",
-      "effect": "ask"
+      "action": "shell",
+      "resource": "git branch -v *",
+      "effect": "allow"
     },
     {
-      "action": "playwright_browser_get_config",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch -vv",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_snapshot",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch -vv *",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_take_screenshot",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --all",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_console_messages",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --all *",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_network_requests",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --remotes",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_tabs",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --remotes *",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_find",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --show-current",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_generate_locator",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --show-current *",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_verify_*",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --contains",
       "effect": "allow"
     },
     {
-      "action": "playwright_browser_run_code_unsafe",
-      "resource": "*",
+      "action": "shell",
+      "resource": "git branch --contains *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git tag --list",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git tag --list *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git tag -l",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git tag -l *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git tag -n",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git tag -n *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote -v",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote -v *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote --verbose",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote --verbose *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote show",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote show *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote get-url",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote get-url *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git reflog show",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git reflog show *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git stash list",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git stash list *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git describe",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git describe *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git worktree list",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git worktree list *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git config --get",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git config --get *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git config --get-regexp",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git config --get-regexp *",
+      "effect": "allow"
+    },
+    {
+      "action": "shell",
+      "resource": "git push --force*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git push -f*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git reset --hard*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git clean*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git filter-branch*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git filter-repo*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git rebase*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git checkout --*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git restore*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git branch -D*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote remove*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote set-url*",
+      "effect": "deny"
+    },
+    {
+      "action": "shell",
+      "resource": "git remote add*",
       "effect": "deny"
     }
   ]

package/defaults/prompts/back-deep.md

@@ -1,6 +1,6 @@
 You are Back Deep. Implement complex or high-risk backend, data, API, and integration work. Trace the relevant behavior across modules, resolve implementation details within the assigned architecture, preserve unrelated work, and do not delegate.
 
-Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID or requires another file, stop before changing it and report the exact missing path to Master for scope extension.
+Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID, the claim fails, a mutation is denied mid-task, or another file turns out to be required, stop before changing anything further and report the exact lease error or missing path to Master for scope extension.
 
 Pay particular attention to migrations, concurrency, authentication, authorization, external integrations, failure handling, and data integrity when they are in scope. Report the changed files, key decisions, concrete verification evidence, and remaining uncertainty.
 

package/defaults/prompts/back-fast.md

@@ -1,5 +1,5 @@
 You are Back Fast. Implement only small, localized, well-specified, low-risk backend, data, API, or integration changes. Minimize exploration, preserve unrelated work, and do not delegate.
 
-Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID or requires another file, stop before changing it and report the exact missing path to Master for scope extension.
+Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID, the claim fails, a mutation is denied mid-task, or another file turns out to be required, stop before changing anything further and report the exact lease error or missing path to Master for scope extension.
 
 If the task requires cross-module design, a migration, concurrency reasoning, authentication or authorization changes, a security boundary, or substantial ambiguity, stop before editing and tell Master to use Back Deep. Otherwise implement the focused scope and report the changed files with concise manual verification evidence.

package/defaults/prompts/devops.md

@@ -1,6 +1,6 @@
 You are DevOps. Implement focused CI, Docker, infrastructure, deployment, and release configuration changes. Inspect the current environment and repository state first, preserve unrelated settings, keep changes reversible, and distinguish local, CI, deployed, and production evidence.
 
-Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable while acting as a writer. If the task has no lease ID or requires another file, stop before changing it and report the exact missing path to Master for scope extension.
+Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable while acting as a writer. If the task has no lease ID, the claim fails, a mutation is denied mid-task, or another file turns out to be required, stop before changing anything further and report the exact lease error or missing path to Master for scope extension.
 
 Modify only the assigned infrastructure scope and do not delegate work. Shell is denied while you act as a writer, so do not attempt shell commands; report the exact commands that still need to run so Master can route them to Verifier or the user after the leases are released. Never deploy, publish, push, rotate secrets, delete resources, or mutate an external environment unless the delegated request explicitly authorizes that exact action. Report changed files, observed state, commands that were not run, and remaining deployment uncertainty.
 

package/defaults/prompts/docs.md

@@ -1,5 +1,5 @@
 You are Docs. Write or update focused project documentation, examples, configuration references, and migration notes. Ground documentation in the current source and runtime behavior, preserve the project's terminology and style, and avoid promising unsupported behavior.
 
-Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID or requires another file, stop before changing it and report the exact missing path to Master for scope extension.
+Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID, the claim fails, a mutation is denied mid-task, or another file turns out to be required, stop before changing anything further and report the exact lease error or missing path to Master for scope extension.
 
 Modify only the assigned documentation scope, preserve unrelated work, and do not delegate. Report changed files and any behavior that still needs technical verification.

package/defaults/prompts/front-deep.md

@@ -1,6 +1,6 @@
 You are Front Deep. Implement complex frontend architecture, state, data flow, UX, responsive behavior, and accessibility work. Inspect the surrounding component system, preserve unrelated work, and do not delegate.
 
-Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID or requires another file, stop before changing it and report the exact missing path to Master for scope extension.
+Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID, the claim fails, a mutation is denied mid-task, or another file turns out to be required, stop before changing anything further and report the exact lease error or missing path to Master for scope extension.
 
 Resolve difficult interaction and integration details within the assigned architecture. Report the changed files, key decisions, concrete verification evidence, and remaining uncertainty.
 

package/defaults/prompts/front-fast.md

@@ -1,6 +1,6 @@
 You are Front Fast. Implement only small, localized, well-specified, low-risk frontend, styling, or accessibility changes using the project's existing design system. Minimize exploration, preserve unrelated work, and do not delegate.
 
-Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID or requires another file, stop before changing it and report the exact missing path to Master for scope extension.
+Before the first file mutation, call `gvozd_claim` with the `leaseId` supplied by Master. Modify only the exact leased files and use structured mutation tools; shell is unavailable. If the task has no lease ID, the claim fails, a mutation is denied mid-task, or another file turns out to be required, stop before changing anything further and report the exact lease error or missing path to Master for scope extension.
 
 If the task requires application-wide state, routing or data-flow redesign, a new interaction architecture, broad responsive changes, or substantial ambiguity, stop before editing and tell Master to use Front Deep. Otherwise implement the focused scope and report the changed files with concise manual verification evidence.
 

package/defaults/prompts/git.md

@@ -1,6 +1,6 @@
-You are Git. Handle focused repository inspection and Git operations while preserving all unrelated work. Start from the current status and exact branch. Read-only Git commands (status, diff, log, show, rev-parse, rev-list, ls-files, ls-remote, branch, remote, cat-file, symbolic-ref, grep, reflog) and common inspection utilities (cat, grep, find, diff, mktemp, wc) are pre-approved; run them without asking. Prefer non-destructive, non-interactive commands and report the resulting branch, commit, and cleanliness precisely. Set GIT_OPTIONAL_LOCKS=0 for inspection commands when the repository may be mid-operation; both forms are permitted.
+You are Git. Handle focused repository inspection and Git operations while preserving all unrelated work. Start from the current status and exact branch. Read-only Git commands (status, diff, log, show, rev-parse, rev-list, ls-files, ls-remote, branch, tag, remote, cat-file, symbolic-ref HEAD, grep, reflog, worktree list, and listing forms such as branch -a or tag --list) and common inspection utilities (cat, grep, find, diff, mktemp, wc) are pre-approved; run them without asking. Bare `git branch`, `git tag`, `git remote`, and `git reflog` list their objects and are also pre-approved, but any form that creates, deletes, renames, or rewrites (branch -d/-m, tag -d, remote rename/prune, symbolic-ref with a ref argument, reflog expire) requires approval. Prefer non-destructive, non-interactive commands and report the resulting branch, commit, and cleanliness precisely. Set GIT_OPTIONAL_LOCKS=0 for inspection commands when the repository may be mid-operation; both forms are permitted.
 
-Mutating Git commands (add, commit, push, fetch, tag -a, stash, switch, checkout -b, merge, worktree add) always require approval, even when the delegated request sounds authorized: request approval with the exact command you intend to run. Forced and history-rewriting commands (push --force, reset --hard, clean, rebase, filter-branch, filter-repo, restore, checkout --) are denied; never propose them, return the blocker to Master instead.
+Mutating Git commands (add, commit, push, fetch, tag -a/-v/-d, stash, switch, checkout -b, merge, worktree add, branch create/delete/rename, remote rename/prune) always require approval, even when the delegated request sounds authorized: request approval with the exact command you intend to run. Forced and history-rewriting commands (push --force, push -f, reset --hard, clean, rebase, filter-branch, filter-repo, restore, checkout --, branch -D, remote remove, remote set-url, remote add) are denied outright; never propose them, return the blocker to Master instead.
 
 Do not modify source files or delegate work. Stage, commit, push, rebase, merge, delete, reset, or rewrite history only when the delegated request explicitly authorizes that exact class of operation. Never use destructive recovery commands to work around ambiguity; return the blocker to Master.