@piagent/platform 1.37.1 → 1.38.1

package/packages/piagent-core/managed/dist/workspace/assets/adapters/web-frontend/profile.json

@@ -0,0 +1,99 @@
+{
+  "schemaVersion": 1,
+  "projectId": "web-frontend",
+  "displayName": "Web Frontend Project",
+  "mode": "web-frontend",
+  "permissionProfile": "workspace-write",
+  "rootMarkers": [
+    "AGENTS.md",
+    "package.json"
+  ],
+  "protectedPaths": [
+    ".git/**",
+    "**/auth.json",
+    "**/.env",
+    "**/.env.*",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/.next/**"
+  ],
+  "requiredContext": [
+    "AGENTS.md",
+    ".pi/project-context.md",
+    "README.md",
+    "package.json"
+  ],
+  "taskModes": {
+    "readOnly": {
+      "tools": [
+        "read",
+        "grep",
+        "find",
+        "ls"
+      ]
+    },
+    "sourceWrite": {
+      "requiresPlan": true,
+      "requiresVerify": true
+    }
+  },
+  "verifyCommands": {
+    "docsOnly": [
+      "test -s README.md"
+    ],
+    "source": [
+      "node -e \"const s=require('./package.json').scripts||{}; const n=['type-check','typecheck','lint','test']; if(!n.some(k=>s[k])){console.error('No Node source verifier is configured');process.exit(2)}\" && npm run type-check --if-present && npm run typecheck --if-present && npm run lint --if-present && npm test --if-present"
+    ],
+    "runtime": [
+      "node -e \"const s=require('./package.json').scripts||{}; if(!s['test:e2e']){console.error('No web frontend runtime verifier is configured');process.exit(2)}\" && npm run test:e2e"
+    ]
+  },
+  "mcpCapabilities": [
+    "filesystem-readonly",
+    "filesystem-write",
+    "shell",
+    "github",
+    "browser",
+    "memory"
+  ],
+  "capabilityPacks": [
+    {
+      "name": "web-delivery",
+      "version": "0.1.1"
+    }
+  ],
+  "capabilityPolicy": {
+    "allowedOwners": [
+      "platform-maintainers"
+    ],
+    "allowedLifecycles": [
+      "experimental"
+    ],
+    "allowedFilesystemRead": [
+      "**/*"
+    ],
+    "allowedFilesystemWrite": [
+      "**/*"
+    ],
+    "allowedNetworkDomains": [],
+    "allowedExternalActions": []
+  },
+  "memory": {
+    "enabled": true,
+    "mode": "manual",
+    "scope": "project",
+    "summaryFile": ".pi/memory/memory_summary.md",
+    "handbookFile": ".pi/memory/MEMORY.md",
+    "localDir": ".pi/memory/local",
+    "readBeforeTask": true,
+    "writePolicy": "explicit-only",
+    "maxInjectedChars": 4000,
+    "externalPackages": []
+  },
+  "runtimePolicy": {
+    "execPolicy": "enforce",
+    "contextBudget": "enforce",
+    "toolRegistry": "advisory",
+    "finalGate": "enforce"
+  }
+}

package/packages/piagent-core/managed/dist/workspace/assets/local-state-path-BrmghxEZ.js

@@ -0,0 +1,284 @@
+import path from "node:path";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import "node:child_process";
+//#region ../piagent-core/capabilities/project-profile.js
+var ADAPTER_NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var ProjectProfileError = class extends Error {};
+function adapterProfileFile(platformRoot, name) {
+	if (typeof name !== "string") return void 0;
+	const trimmed = name.trim();
+	if (!ADAPTER_NAME.test(trimmed)) return void 0;
+	const candidate = path.join(platformRoot, "adapters", trimmed, "profile.json");
+	return fs.existsSync(candidate) ? candidate : void 0;
+}
+function readJson(file) {
+	try {
+		return JSON.parse(fs.readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve a stored project profile document against the installed adapters.
+* Returns the document to enforce, plus the adapter it came from when one was
+* named. Any key the project states replaces the adapter's key whole — there is
+* no per-entry merging of lists, because a half-merged protectedPaths is harder
+* to reason about than a stated one.
+*/
+function resolveProjectProfileDocument(platformRoot, stored) {
+	if (!stored || typeof stored !== "object" || Array.isArray(stored)) return {
+		profile: stored,
+		base: void 0
+	};
+	if (stored.extends === void 0) return {
+		profile: stored,
+		base: void 0
+	};
+	const file = adapterProfileFile(platformRoot, stored.extends);
+	if (!file) throw new ProjectProfileError(`project profile extends "${String(stored.extends)}", which is not an adapter in the installed platform`);
+	const adapter = readJson(file);
+	if (!adapter) throw new ProjectProfileError(`adapter profile is unreadable: ${file}`);
+	const { extends: base, ...overrides } = stored;
+	return {
+		profile: {
+			...adapter,
+			...overrides
+		},
+		base
+	};
+}
+//#endregion
+//#region ../piagent-core/extensions/workspace-evidence-roots.js
+var WORKSPACE_PRIVATE_STATE_PATTERNS = Object.freeze([
+	"**/.git/**",
+	"**/.hg/**",
+	"**/.svn/**",
+	"**/.pi/**",
+	"**/.aws/**",
+	"**/.azure/**",
+	"**/.docker/**",
+	"**/.gnupg/**",
+	"**/.kube/**",
+	"**/.ssh/**",
+	"**/.git-credentials",
+	"**/.netrc",
+	"**/.npmrc",
+	"**/.pypirc",
+	"**/.env",
+	"**/.env.*",
+	"**/auth.json",
+	"**/credential.json",
+	"**/credentials.json",
+	"**/secret.json",
+	"**/secrets.json",
+	"**/token.json",
+	"**/tokens.json"
+]);
+//#endregion
+//#region ../piagent-core/extensions/context-index-policy.js
+var DEFAULT_CONTEXT_INDEX_PATH = ".pi/context-index.json";
+var CONTEXT_ENGINE_STATE_PATTERN = ".pi/piagent-state/**";
+var EXCLUDE_POLICY_VERSION = 2;
+function stringArray(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+}
+function uniqueStrings(values) {
+	return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function compareCodePoints(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function normalizePattern(value) {
+	return String(value ?? "").trim().replaceAll("\\", "/").replace(/^\.\/+/, "").replace(/\/+/g, "/");
+}
+function readJsonObject(file, label, { optional = false } = {}) {
+	if (!fs.existsSync(file)) {
+		if (optional) return void 0;
+		throw new Error(`${label} is missing at ${file}`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+	} catch {
+		throw new Error(`${label} is not valid JSON: ${file}`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${label} must contain a JSON object: ${file}`);
+	return parsed;
+}
+function contextIndexStatePath(profile) {
+	const configured = profile?.contextIndex?.path;
+	return typeof configured === "string" && configured.trim() ? configured.trim() : DEFAULT_CONTEXT_INDEX_PATH;
+}
+function effectiveProtectedPaths(policy = {}, profile = {}) {
+	const policyProtectedPaths = stringArray(policy.protectedPaths);
+	const baseReadProtectedPaths = Array.isArray(policy.shellProtectedPaths) ? stringArray(policy.shellProtectedPaths) : policyProtectedPaths;
+	const profileProtectedPaths = stringArray(profile.protectedPaths);
+	const profileShellProtectedPaths = Array.isArray(profile.shellProtectedPaths) ? stringArray(profile.shellProtectedPaths) : profileProtectedPaths;
+	const readOnlyPaths = stringArray(profile.readOnlyPaths);
+	const contextIndexPath = contextIndexStatePath(profile);
+	return {
+		readProtectedPaths: uniqueStrings([
+			...WORKSPACE_PRIVATE_STATE_PATTERNS,
+			...baseReadProtectedPaths,
+			...profileProtectedPaths,
+			contextIndexPath
+		]),
+		writeProtectedPaths: uniqueStrings([
+			...WORKSPACE_PRIVATE_STATE_PATTERNS,
+			...policyProtectedPaths,
+			...profileProtectedPaths,
+			...readOnlyPaths,
+			contextIndexPath
+		]),
+		shellProtectedPaths: uniqueStrings([
+			...WORKSPACE_PRIVATE_STATE_PATTERNS,
+			...baseReadProtectedPaths,
+			...profileShellProtectedPaths,
+			...readOnlyPaths,
+			contextIndexPath
+		]),
+		readOnlyPaths: uniqueStrings(readOnlyPaths)
+	};
+}
+function normalizeContextIndexExcludePatterns(patterns) {
+	return uniqueStrings(stringArray(patterns).map(normalizePattern)).sort(compareCodePoints);
+}
+function contextIndexExcludePatterns(policy, profile) {
+	const effective = effectiveProtectedPaths(policy, profile);
+	return normalizeContextIndexExcludePatterns([
+		...effective.readProtectedPaths,
+		...effective.writeProtectedPaths,
+		...effective.shellProtectedPaths,
+		CONTEXT_ENGINE_STATE_PATTERN
+	]);
+}
+function contextIndexExcludeDigest(patterns) {
+	return crypto.createHash("sha256").update(JSON.stringify({
+		version: EXCLUDE_POLICY_VERSION,
+		patterns: normalizeContextIndexExcludePatterns(patterns)
+	})).digest("hex");
+}
+function loadProjectContextIndexPolicy(platformRoot, projectPath, options = {}) {
+	const policy = readJsonObject(path.join(platformRoot, "packages", "piagent-core", "policies", "base-policy.json"), "Piagent base policy");
+	const explicitProfilePath = typeof options.profilePath === "string" && options.profilePath.trim() ? path.resolve(options.profilePath) : void 0;
+	const profilePath = explicitProfilePath ?? path.join(projectPath, ".pi", "piagent-profile.json");
+	const stored = readJsonObject(profilePath, "Piagent project profile", { optional: !explicitProfilePath });
+	const profile = stored ? resolveProjectProfileDocument(platformRoot, stored).profile : {};
+	return {
+		policy,
+		profile,
+		profilePath,
+		profileSource: explicitProfilePath ? "env" : stored ? "project" : "fallback",
+		excludePatterns: contextIndexExcludePatterns(policy, profile)
+	};
+}
+//#endregion
+//#region ../piagent-core/extensions/policy-core.js
+function escapeRegex(value) {
+	return value.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+}
+function normalizePathCandidate(candidate) {
+	if (typeof candidate !== "string") return "";
+	const raw = candidate.trim().replace(/^['"]|['"]$/g, "");
+	if (/^\/+$/.test(raw)) return "/";
+	return raw.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+/g, "/").replace(/\/$/, "");
+}
+function segmentMatches(patternSegment, candidateSegment) {
+	if (patternSegment === "*") return candidateSegment.length > 0;
+	return new RegExp(`^${escapeRegex(patternSegment).replace(/\*/g, "[^/]*")}$`).test(candidateSegment);
+}
+function globMatchesPath(pattern, candidate) {
+	const normalizedPattern = normalizePathCandidate(pattern);
+	const normalizedCandidate = normalizePathCandidate(candidate);
+	if (!normalizedPattern || !normalizedCandidate) return false;
+	const patternSegments = normalizedPattern.split("/").filter(Boolean);
+	const candidateSegments = normalizedCandidate.split("/").filter(Boolean);
+	function match(patternIndex, candidateIndex) {
+		if (patternIndex === patternSegments.length) return candidateIndex === candidateSegments.length;
+		const patternSegment = patternSegments[patternIndex];
+		if (patternSegment === "**") {
+			if (match(patternIndex + 1, candidateIndex)) return true;
+			for (let nextCandidate = candidateIndex; nextCandidate < candidateSegments.length; nextCandidate += 1) if (match(patternIndex + 1, nextCandidate + 1)) return true;
+			return false;
+		}
+		if (candidateIndex >= candidateSegments.length) return false;
+		if (!segmentMatches(patternSegment, candidateSegments[candidateIndex])) return false;
+		return match(patternIndex + 1, candidateIndex + 1);
+	}
+	return match(0, 0);
+}
+function matchesProtectedPath(candidate, patterns) {
+	const normalizedCandidate = normalizePathCandidate(candidate).toLocaleLowerCase("en-US");
+	if (!normalizedCandidate) return void 0;
+	return patterns.find((pattern) => {
+		const normalizedPattern = normalizePathCandidate(pattern).toLocaleLowerCase("en-US");
+		if (globMatchesPath(normalizedPattern, normalizedCandidate)) return true;
+		if (normalizedPattern.endsWith("/**")) return globMatchesPath(normalizedPattern.slice(0, -3), normalizedCandidate);
+		return false;
+	});
+}
+//#endregion
+//#region ../piagent-core/extensions/local-state-path.js
+function statePathError(label, reason) {
+	return /* @__PURE__ */ new Error(`${label} ${reason}`);
+}
+function resolveLocalStatePath(projectRoot, target, options = {}) {
+	const label = options.label ?? "Local state path";
+	const lexicalRoot = path.resolve(projectRoot);
+	const absoluteTarget = path.resolve(target);
+	const canonicalRoot = fs.realpathSync.native(lexicalRoot);
+	let relative = path.relative(lexicalRoot, absoluteTarget);
+	if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) relative = path.relative(canonicalRoot, absoluteTarget);
+	if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) throw statePathError(label, "must stay inside the project");
+	const segments = relative.split(path.sep).filter(Boolean);
+	let current = canonicalRoot;
+	for (let index = 0; index < segments.length; index += 1) {
+		current = path.join(current, segments[index]);
+		let stat;
+		try {
+			stat = fs.lstatSync(current);
+		} catch (error) {
+			if (error?.code === "ENOENT") return path.join(canonicalRoot, ...segments);
+			throw error;
+		}
+		if (stat.isSymbolicLink()) throw statePathError(label, `must not traverse a symbolic link (${segments.slice(0, index + 1).join("/")})`);
+		const final = index === segments.length - 1;
+		if (!final && !stat.isDirectory()) throw statePathError(label, `has a non-directory ancestor (${segments.slice(0, index + 1).join("/")})`);
+		if (final && options.kind === "directory" && !stat.isDirectory()) throw statePathError(label, "must be a directory");
+		if (final && options.kind === "file" && !stat.isFile()) throw statePathError(label, "must be a regular file");
+	}
+	return path.join(canonicalRoot, ...segments);
+}
+var STATE_ROOT_IGNORE = "# Piagent runtime state: local only, never committed.\n*\n";
+function ensureStateRootIgnored(projectRoot) {
+	try {
+		const root = resolveLocalStatePath(projectRoot, path.join(projectRoot, ".pi", "piagent-state"), { label: "Piagent state root" });
+		fs.mkdirSync(root, {
+			recursive: true,
+			mode: 448
+		});
+		fs.writeFileSync(path.join(root, ".gitignore"), STATE_ROOT_IGNORE, {
+			flag: "wx",
+			mode: 384
+		});
+	} catch {}
+}
+function ensurePrivateStateDirectory(projectRoot, directory, label = "Local state directory") {
+	const target = resolveLocalStatePath(projectRoot, directory, { label });
+	fs.mkdirSync(target, {
+		recursive: true,
+		mode: 448
+	});
+	if (path.relative(path.join(fs.realpathSync.native(path.resolve(projectRoot)), ".pi", "piagent-state"), target).split(path.sep)[0] !== "..") ensureStateRootIgnored(projectRoot);
+	const verified = resolveLocalStatePath(projectRoot, directory, {
+		label,
+		kind: "directory"
+	});
+	try {
+		fs.chmodSync(verified, 448);
+	} catch {}
+	return verified;
+}
+//#endregion
+export { effectiveProtectedPaths as a, contextIndexExcludeDigest as i, resolveLocalStatePath as n, loadProjectContextIndexPolicy as o, matchesProtectedPath as r, normalizeContextIndexExcludePatterns as s, ensurePrivateStateDirectory as t };