@piagent/platform 1.37.0 → 1.38.1

package/packages/piagent-core/managed/dist/workspace/assets/packages/piagent-core/policies/base-policy.json

@@ -0,0 +1,351 @@
+{
+  "schemaVersion": 1,
+  "name": "piagent-base-policy",
+  "protectedPaths": [
+    ".git/**",
+    "**/.git/**",
+    "**/.hg/**",
+    "**/.svn/**",
+    "**/.pi/**",
+    "**/.aws/**",
+    "**/.azure/**",
+    "**/.docker/**",
+    "**/.gnupg/**",
+    "**/.kube/**",
+    "**/.ssh/**",
+    "**/.git-credentials",
+    "**/.netrc",
+    "**/.npmrc",
+    "**/.pypirc",
+    "**/auth.json",
+    "**/credential.json",
+    "**/credentials.json",
+    "**/secret.json",
+    "**/secrets.json",
+    "**/token.json",
+    "**/tokens.json",
+    "**/.env",
+    "**/.env.*",
+    "**/node_modules/**",
+    "**/dist/**",
+    ".pi/piagent-state/**",
+    ".pi/settings.json",
+    ".pi/piagent-profile.json",
+    ".pi/piagent-profile.lock.json",
+    ".pi/context-index.json"
+  ],
+  "shellProtectedPaths": [
+    ".git/**",
+    "**/.git/**",
+    "**/.hg/**",
+    "**/.svn/**",
+    "**/.pi/**",
+    "**/.aws/**",
+    "**/.azure/**",
+    "**/.docker/**",
+    "**/.gnupg/**",
+    "**/.kube/**",
+    "**/.ssh/**",
+    "**/.git-credentials",
+    "**/.netrc",
+    "**/.npmrc",
+    "**/.pypirc",
+    "**/auth.json",
+    "**/credential.json",
+    "**/credentials.json",
+    "**/secret.json",
+    "**/secrets.json",
+    "**/token.json",
+    "**/tokens.json",
+    "**/.env",
+    "**/.env.*",
+    ".pi/piagent-state/**",
+    ".pi/settings.json",
+    ".pi/piagent-profile.json",
+    ".pi/piagent-profile.lock.json",
+    ".pi/context-index.json"
+  ],
+  "blockedCommandPatterns": [
+    "rm -rf /",
+    "rm -rf ~",
+    "rm -rf $HOME",
+    "git reset --hard",
+    "git clean -fd",
+    "sudo ",
+    "chmod -R 777"
+  ],
+  "requireConfirmationPatterns": [
+    "deploy",
+    "release",
+    "publish",
+    "migration",
+    "terraform apply",
+    "kubectl apply",
+    "gh pr merge",
+    "git push"
+  ],
+  "defaultRequiredContext": [
+    "AGENTS.md",
+    "README.md"
+  ],
+  "permissionProfiles": {
+    "defaultMode": "workspace-write",
+    "allowedModes": [
+      "read-only",
+      "workspace-write",
+      "trusted-full-access",
+      "bypass"
+    ]
+  },
+  "execPolicy": {
+    "defaultMode": "enforce",
+    "bannedPrefixSuggestions": [
+      [
+        "python"
+      ],
+      [
+        "python3"
+      ],
+      [
+        "node"
+      ],
+      [
+        "node",
+        "-e"
+      ],
+      [
+        "bash"
+      ],
+      [
+        "bash",
+        "-lc"
+      ],
+      [
+        "sh"
+      ],
+      [
+        "sh",
+        "-c"
+      ],
+      [
+        "zsh"
+      ],
+      [
+        "zsh",
+        "-lc"
+      ],
+      [
+        "git"
+      ],
+      [
+        "sudo"
+      ],
+      [
+        "env"
+      ]
+    ],
+    "rules": [
+      {
+        "id": "prompt-git-add-broad",
+        "action": "prompt",
+        "match": "regex",
+        "value": "(?:^|\\s)git\\s+(?:-C\\s+\\S+\\s+)?add\\s+(?:(?:--all|-A)(?:\\s+(?:\\.|:/))?|--\\s+(?:\\.|:/)|(?:\\.|:/))(?:\\s|$)",
+        "reason": "Broad git staging can include unrelated or sensitive changes; inspect git status/diff and confirm the exact scope first."
+      },
+      {
+        "id": "forbid-docker-volume-prune",
+        "action": "forbid",
+        "match": "contains",
+        "value": "docker volume prune",
+        "reason": "Volume prune can delete unrecoverable local data."
+      },
+      {
+        "id": "prompt-docker-compose-down-volume",
+        "action": "prompt",
+        "match": "regex",
+        "value": "docker\\s+compose\\s+down\\s+.*-v",
+        "reason": "docker compose down -v removes volumes."
+      },
+      {
+        "id": "prompt-database-migration",
+        "action": "prompt",
+        "match": "contains",
+        "ignoreSearchArguments": true,
+        "value": "migrate",
+        "reason": "Database migrations require explicit human confirmation."
+      }
+    ]
+  },
+  "contextBudget": {
+    "defaultMode": "enforce",
+    "contextDeltaShadow": "sample",
+    "maxContextFileChars": 50000,
+    "maxMemoryFileChars": 20000,
+    "maxManifestFiles": 80,
+    "warnFragmentChars": 4000
+  },
+  "toolRegistry": {
+    "defaultMode": "advisory",
+    "alwaysAllowedTools": [
+      "piagent_tools",
+      "piagent_context_engine",
+      "piagent_context",
+      "piagent_permission_status",
+      "piagent_exec_policy_check",
+      "piagent_context_budget",
+      "piagent_tool_policy_check",
+      "piagent_task_gate_check",
+      "piagent_usage_snapshot",
+      "piagent_orchestration_policy",
+      "piagent_memory_status",
+      "piagent_memory_note",
+      "piagent_memory_search",
+      "piagent_memory_citation_record",
+      "piagent_context_index_status",
+      "piagent_context_index_record",
+      "piagent_context_index_search",
+      "piagent_profile_options",
+      "piagent_profile_apply",
+      "piagent_profile_tech_options",
+      "piagent_profile_tech_apply",
+      "piagent_profile_tech_context_record",
+      "piagent_project_onboarding_record",
+      "piagent_task_start",
+      "piagent_task_progress",
+      "piagent_source_checkout",
+      "piagent_context_record",
+      "piagent_verify_record",
+      "piagent_trace_record"
+    ],
+    "toolCapabilities": {
+      "bash": [
+        "shell"
+      ],
+      "shell": [
+        "shell"
+      ],
+      "exec": [
+        "shell"
+      ],
+      "read": [
+        "filesystem-readonly"
+      ],
+      "grep": [
+        "filesystem-readonly"
+      ],
+      "find": [
+        "filesystem-readonly"
+      ],
+      "ls": [
+        "filesystem-readonly"
+      ],
+      "write": [
+        "filesystem-write"
+      ],
+      "edit": [
+        "filesystem-write"
+      ],
+      "apply_patch": [
+        "filesystem-write"
+      ],
+      "browser": [
+        "browser"
+      ],
+      "github": [
+        "github"
+      ]
+    }
+  },
+  "externalActionPolicy": {
+    "defaultMode": "enforce",
+    "providerKeywords": [
+      "github",
+      "gitlab",
+      "bitbucket",
+      "vercel",
+      "netlify",
+      "cloudflare",
+      "aws",
+      "gcp",
+      "azure",
+      "slack",
+      "teams",
+      "jira",
+      "linear",
+      "notion",
+      "figma",
+      "stripe",
+      "supabase",
+      "firebase"
+    ],
+    "writeVerbs": [
+      "add",
+      "approve",
+      "archive",
+      "assign",
+      "close",
+      "comment",
+      "create",
+      "delete",
+      "deploy",
+      "dispatch",
+      "merge",
+      "open",
+      "post",
+      "publish",
+      "push",
+      "release",
+      "remove",
+      "reopen",
+      "run",
+      "send",
+      "submit",
+      "trigger",
+      "update",
+      "upload",
+      "write"
+    ],
+    "safeVerbs": [
+      "fetch",
+      "find",
+      "get",
+      "inspect",
+      "list",
+      "read",
+      "search",
+      "show",
+      "view"
+    ]
+  },
+  "finalGate": {
+    "defaultMode": "enforce",
+    "acceptanceProofMode": "diagnostic",
+    "requireTaskContract": true,
+    "requireContextManifest": true,
+    "requireVerifyEvidence": true,
+    "requireTrace": true,
+    "requirePassingVerify": true
+  },
+  "orchestrationPolicy": {
+    "defaultMode": "solo-first",
+    "maxConcurrentSubagents": 2,
+    "defaultReviewLenses": [
+      "correctness",
+      "tests",
+      "scope"
+    ],
+    "roleModelGuidance": {
+      "planner": "Use the strongest available model for decomposition, architecture, risk, and acceptance criteria.",
+      "worker": "Disabled by default. The parent model owns all implementation and mutation.",
+      "reviewer": "Use a model or thinking setting decorrelated from the worker when review quality matters.",
+      "watchdog": "Use a strong model only for final risk review, security, release, or high-impact changes."
+    },
+    "fieldGuide": {
+      "enabled": true,
+      "path": ".pi/memory/MEMORY.md",
+      "maxLines": 80,
+      "writePolicy": "explicit-only",
+      "readBeforeTask": true
+    }
+  }
+}

package/packages/piagent-core/managed/dist/workspace/manifest.json

@@ -0,0 +1,65 @@
+{
+  "version": 1,
+  "files": [
+    {
+      "file": "worker.mjs",
+      "sha256": "5364a7422ee0d0816f4c143c84ecf31a323e1abcb36cdc660534308cad2bd68f"
+    },
+    {
+      "file": "workspace-search-index.mjs",
+      "sha256": "3832bfbf54b51290332dab111907173c7f273424487875510ee65af048b1e863"
+    },
+    {
+      "file": "assets/local-state-path-BrmghxEZ.js",
+      "sha256": "703e7802bfa5b71d45847b78231c6530357017de453c4f49db1cb31c689f7856"
+    },
+    {
+      "file": "assets/packages/piagent-core/policies/base-policy.json",
+      "sha256": "422b26bca154240747970d948cdf1ded57b9dcb544d6547dedb4d1ddfda4b4da"
+    },
+    {
+      "file": "assets/adapters/backend-api/profile.json",
+      "sha256": "101bc1c71180643a053ff79e8eb61a489edc01ee11dc6a8070a2aee22f37be5e"
+    },
+    {
+      "file": "assets/adapters/be-readonly-fe/profile.json",
+      "sha256": "d6985593de9b97ba5da08038c78a1b3227337c6be90b7faebebe75992e7bc762"
+    },
+    {
+      "file": "assets/adapters/data/profile.json",
+      "sha256": "1a730b1a7fb67d15356b1be980777436db022bc14007e0bccfcc9faa8ed57492"
+    },
+    {
+      "file": "assets/adapters/devops/profile.json",
+      "sha256": "fd136a95fa48cd69bbac4a40228a78639459bcd24f823dbb9b9eefa04551760c"
+    },
+    {
+      "file": "assets/adapters/docs/profile.json",
+      "sha256": "2f54b8b3d27edb51f95d94924d844c060d88d7b207eb228102dd41c492f3f75c"
+    },
+    {
+      "file": "assets/adapters/fullstack/profile.json",
+      "sha256": "6be0d4993ec5b35e695168f990b17d0da5a3be5854bd631a58446d1fab6dde51"
+    },
+    {
+      "file": "assets/adapters/generic/profile.json",
+      "sha256": "fc10abbe00bb05e64e43662550b9a92e95b7441c3da000a5e2e244c5afb0eccc"
+    },
+    {
+      "file": "assets/adapters/mobile/profile.json",
+      "sha256": "066304e1988734e8f03c31ef67e3a40b44b718bf7d334464b4d7def7e4609c4e"
+    },
+    {
+      "file": "assets/adapters/node-typescript/profile.json",
+      "sha256": "99c14d2293f08e986e0eed6124dd84a232e0d3ae052a598b2d5c99340116edf1"
+    },
+    {
+      "file": "assets/adapters/python/profile.json",
+      "sha256": "a5e2e4af41f304bc721890d6cca9d52eb798e51a00490f26327971c9f38857de"
+    },
+    {
+      "file": "assets/adapters/web-frontend/profile.json",
+      "sha256": "35d6757d0a8d2f8644b967fe82645fba3de430b53f23b5577c2e5e104dcccdc1"
+    }
+  ]
+}