@poetic-ai/poetic 1.42.0-rc1

package/.github/SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you believe you've found a security vulnerability in Poetic, please **do not
+open a public issue**. Instead, report it privately via GitHub's security
+advisories:
+
+> https://github.com/ebrindley/Poetic/security/advisories/new
+
+We aim to acknowledge reports within 3 business days and provide a remediation
+timeline within 10 business days. Please include:
+
+- A description of the issue and its impact
+- Steps to reproduce (or a proof-of-concept)
+- The Poetic version (`poetic --version`) and your environment
+
+We do not currently operate a bug bounty, but we will credit reporters in the
+release notes if they wish.
+
+## Supported Versions
+
+Only the latest minor release line receives security fixes. The current
+supported version is **v1.42.x**.
+
+## Execution And Sandbox Boundary
+
+Poetic delegates work to local AI provider CLIs and can run code or shell
+commands produced by those providers. Review generated changes before applying
+or shipping them.
+
+On macOS, Poetic can wrap provider processes with a seatbelt sandbox. That
+sandbox is an integrity and persistence boundary: it restricts destructive
+writes and protects selected credential locations from direct filesystem
+access. It is **not** a confidentiality boundary and **not** a network egress
+filter. Provider processes may still read broadly-readable project files and
+may make outbound network requests required by their CLIs.
+
+Do not place secrets in prompts, committed files, or broadly-readable project
+state. Keep provider credentials in the provider's normal auth store or local
+environment configuration, and revoke any credential that may have been exposed
+to a model or committed to git history.
+
+For the detailed model and local telemetry/privacy notes, see:
+
+- [Security Reference](../docs/reference/SECURITY.md)
+- [Telemetry And Privacy Reference](https://github.com/ebrindley/Poetic/blob/main/docs/reference/TELEMETRY_PRIVACY.md)

package/.nvmrc

@@ -0,0 +1 @@
+24

package/.poetic/README.md

@@ -0,0 +1,37 @@
+# Poetic Project Directory
+
+This `.poetic/` directory contains project-local configuration and runtime artifacts for the Poetic CLI.
+
+## Directory Structure (High-Level)
+
+```
+.poetic/
+├── .artifacts/                      # Legacy/generated artifacts (gitignored)
+├── config/
+│   ├── providers.yaml              # Provider defaults (recommended)
+│   ├── poetic.config.jsonc            # Optional advanced config
+│   └── project-context.json        # Project detection output
+├── telemetry/
+│   ├── db/                         # Telemetry SQLite DBs (gitignored)
+│   │   ├── variants.db
+│   │   └── validations.db
+│   ├── invocations.db              # Cost/token tracking DB (gitignored)
+│   └── logs/                       # JSONL/log output (gitignored)
+├── state/                          # Runtime markers/locks (gitignored)
+├── worktrees/                      # Temporary worktrees (gitignored)
+├── .gitignore                      # Ignores runtime artifacts
+└── README.md                       # This file
+```
+
+## Configuration
+
+- Preferred: edit `.poetic/config/providers.yaml` to set provider defaults (without hardcoding model versions unless you need to).
+- Optional: edit `.poetic/config/poetic.config.jsonc` for advanced settings like quality gates and execution tuning.
+
+## Useful Commands
+
+```bash
+poetic health
+poetic health --fix
+poetic config user get
+```