@technomoron/agent-run 0.99.11 → 0.99.13

package/CHANGES

@@ -1,8 +1,15 @@
 CHANGES
 =======
 
-Unreleased (2026-04-24)
------------------------
+Version 0.99.13 (2026-04-27)
+----------------------------
+* Render each profile's generated files and runtime state under `live/`, leaving the profile root for source config and templates.
+
+Version 0.99.12 (2026-04-27)
+----------------------------
+* Add `--local` for Codex and Claude runs to warn about local AI files instead of failing.
+* Limit generated Claude permission allow entries to configured checks instead of broad blocked command families.
+* Write agent-run's Claude settings to `.claude/agent-run-settings.json` and remove only exact legacy generated `.claude/settings.json` files.
 
 Version 0.99.11 (2026-04-27)
 ----------------------------

package/README.md

@@ -118,10 +118,15 @@ generated guard shims on `PATH`. Use `--sandboxed` to request Codex
 `sandbox_workspace_write.network_access=true`.
 
 Claude Code currently has no `--cd` equivalent. `agent-run` keeps Claude's
-process cwd at the project root, passes the generated `.claude/settings.json`
+process cwd at the project root, passes the generated `.claude/agent-run-settings.json`
 with `--settings`, and allows both the project root and private agent directory
 with `--add-dir`.
 
+By default, `agent-run codex` and `agent-run claude` fail when local AI files
+such as `AGENTS.md`, `CLAUDE.md`, `.agents`, `.claude`, or `.codex` are present
+inside the project repository. Use `--local` to warn and continue for a specific
+invocation.
+
 Initialize mapped files for the current repo:
 
 ```sh

package/dist/agent-run.js

@@ -22,28 +22,13 @@ const CONFIG_DIR_ENV = 'AGENT_CONFIG_DIR';
 const VERBOSE_ENV = 'AGENT_RUN_VERBOSE';
 const MANIFEST_FILE_NAME = 'agent-run.jsonc';
 const LOCAL_TEMPLATE_FILE_NAME = 'local.md.njk';
+const LIVE_DIR_NAME = 'live';
 const PACKAGE_VERSION = '0.99.10';
 const UNEXPANDED_TEMPLATE_RE = /\{\{[^}]+\}\}|\{%[^%]+%\}/;
 const agentRunEnvCache = new Map();
 const GENERATED_GITIGNORE_ENTRIES = [
-    '# Generated agent-run files',
-    '**/AGENTS.md',
-    '**/CLAUDE.md',
-    '**/GEMINI.md',
-    '**/config.toml',
-    '',
-    '# Generated native agent homes',
-    '**/.agents/',
-    '**/.claude/',
-    '**/.codex/',
-    '',
-    '# Generated runtime files',
-    '**/bin/',
-    '**/reviews/',
-    '**/memories/',
-    '',
-    '# Generated review reports',
-    '**/REVIEW-*.md',
+    '# Generated agent-run live profiles',
+    '**/live/',
     '',
     '# Optional generated caches',
     '**/.agent-run-cache/'
@@ -216,6 +201,7 @@ function parseRunCommand(command, inputArgs) {
     const wrapperArgs = {
         none: false,
         create: false,
+        local: false,
         codexSandboxMode: null,
         codexNetwork: false
     };
@@ -238,6 +224,10 @@ function parseRunCommand(command, inputArgs) {
             wrapperArgs.create = true;
             continue;
         }
+        if (arg === '--local') {
+            wrapperArgs.local = true;
+            continue;
+        }
         if (arg === '--danger') {
             if (command !== 'codex') {
                 fail('--danger is only supported for agent-run codex');
@@ -412,9 +402,10 @@ function renderHelp(topic) {
                 '  agent-run --init [config-root]',
                 '',
                 'Commands:',
-                '  codex [--none] [--create] [--danger|--sandboxed] [--network] [args...]',
+                '  codex [--none] [--create] [--local] [--danger|--sandboxed] [--network] [args...]',
                 '                                           Run codex with generated private config',
-                '  claude [--none] [--create] [args...]  Run claude with generated private config',
+                '  claude [--none] [--create] [--local] [args...]',
+                '                                           Run claude with generated private config',
                 '  check [--all] [path]                  Validate generated profile output',
                 '  init [path]                           Create profile source files and render output',
                 '  edit [path]                           Open local.md.njk or legacy AGENTS-MODS.md',
@@ -429,6 +420,7 @@ function renderHelp(topic) {
                 '  --init [DIR]       Copy the packaged starter config root to DIR (default ~/.agent-config)',
                 '',
                 'Codex wrapper options:',
+                '  --local            Warn about local AI files instead of failing',
                 '  --danger           Run Codex with no sandbox: -a never -s danger-full-access (default)',
                 '  --sandboxed        Run Codex with workspace-write sandbox',
                 '  --network          Enable network for --sandboxed via config override',
@@ -495,7 +487,10 @@ function runTool(parsed) {
     const excludedDir = profileResult.profile === null ? null : resolveAgentDir(projectRoot);
     const localAiFiles = findLocalAiFiles(projectRoot, excludedDir);
     if (localAiFiles.length > 0) {
-        failForLocalAiFiles(command, projectRoot, localAiFiles);
+        if (!wrapperArgs.local) {
+            failForLocalAiFiles(command, projectRoot, localAiFiles);
+        }
+        warnForLocalAiFiles(command, projectRoot, localAiFiles);
     }
     if (profileResult.profile === null) {
         fail(profileResult.reason);
@@ -512,7 +507,7 @@ function runTool(parsed) {
         runCodex(realBinary, permissionArgs, agentDir, configRoot, args, projectRoot, wrapperArgs);
         return;
     }
-    runClaude(realBinary, permissionArgs, agentDir, configRoot, args, projectRoot);
+    runClaude(realBinary, permissionArgs, agentDir, configRoot, args, projectRoot, wrapperArgs);
 }
 function runInit(parsed) {
     const projectRoot = findProjectRoot(parsed.targetPath);
@@ -660,7 +655,8 @@ function runCheck(parsed) {
 }
 function printUpdateSummary(rendered) {
     process.stdout.write(`OK profile ${rendered.profile}\n`);
-    process.stdout.write(`Agent dir: ${rendered.agentDir}\n`);
+    process.stdout.write(`Profile dir: ${rendered.agentDir}\n`);
+    process.stdout.write(`Live dir: ${rendered.context.paths.liveDir}\n`);
     process.stdout.write(`Generated files: ${rendered.files.length}\n`);
     process.stdout.write(`Installed skills: ${rendered.skills.map((skill) => skill.name).join(', ') || '(none)'}\n`);
 }
@@ -982,37 +978,52 @@ function createNunjucksEnv(configRoot) {
         throwOnUndefined: true
     });
 }
-function buildRenderContext(projectRoot, agentDir, configRoot, manifest, env) {
+function buildRenderContext(projectRoot, profileDir, configRoot, manifest, env) {
     const date = localDateString();
+    const liveDir = path.join(profileDir, LIVE_DIR_NAME);
     const baseContext = {
         profile: manifest.profile,
         kind: manifest.kind,
         projectRoot,
-        agentDir,
+        agentDir: liveDir,
+        profileDir,
         configRoot,
         date,
         checks: manifest.checks,
         guardrails: manifest.guardrails
     };
     const paths = {
+        profileDir,
+        liveDir,
         changesFile: resolveRuntimePath(configRoot, manifest.paths.changesFile, env, baseContext),
         reviewDir: resolveRuntimePath(configRoot, manifest.paths.reviewDir, env, baseContext),
         reviewFile: resolveRuntimePath(configRoot, manifest.paths.reviewFile, env, baseContext),
         memoriesDir: resolveRuntimePath(configRoot, manifest.paths.memoriesDir, env, baseContext),
         globalMemoryDir: globalMemoryDir(configRoot),
         codexHomeDir: path.join(resolveRuntimePath(configRoot, manifest.paths.memoriesDir, env, baseContext), 'codex-home'),
-        overridesDir: path.join(agentDir, 'overrides'),
-        codexSkillsDir: path.join(agentDir, '.agents', 'skills'),
-        claudeSkillsDir: path.join(agentDir, '.claude', 'skills'),
-        binDir: path.join(agentDir, 'bin')
+        overridesDir: path.join(profileDir, 'overrides'),
+        codexSkillsDir: path.join(liveDir, '.agents', 'skills'),
+        claudeSkillsDir: path.join(liveDir, '.claude', 'skills'),
+        binDir: path.join(liveDir, 'bin')
     };
     return {
         ...baseContext,
         paths,
+        permissionsAllow: buildPermissionsAllow(manifest),
         skills: [],
         renderedAgentSections: []
     };
 }
+function buildPermissionsAllow(manifest) {
+    const allow = new Set();
+    for (const check of manifest.checks) {
+        const normalizedCheck = check.trim();
+        if (normalizedCheck) {
+            allow.add(`Bash(${normalizedCheck})`);
+        }
+    }
+    return [...allow];
+}
 function resolveConfigPath(configRoot, relativePath, context) {
     const env = createNunjucksEnv(configRoot);
     const rendered = renderInlineTemplate(env, relativePath, context);
@@ -1114,11 +1125,14 @@ function renderProfile(projectRoot, agentDir, checkOnly = false) {
     const files = [];
     const agentsContent = renderToolInstructions('AGENTS.md', env, configRoot, context, false);
     const claudeContent = renderToolInstructions('CLAUDE.md', env, configRoot, context, true);
-    files.push({ path: path.join(agentDir, 'AGENTS.md'), content: agentsContent });
-    files.push({ path: path.join(agentDir, 'CLAUDE.md'), content: claudeContent });
-    files.push({ path: path.join(agentDir, '.claude', 'CLAUDE.md'), content: claudeContent });
-    files.push({ path: path.join(agentDir, 'config.toml'), content: renderCodexConfig(env, configRoot, context) });
-    files.push({ path: path.join(agentDir, '.claude', 'settings.json'), content: renderClaudeSettings(env, configRoot, context) });
+    files.push({ path: path.join(context.paths.liveDir, 'AGENTS.md'), content: agentsContent });
+    files.push({ path: path.join(context.paths.liveDir, 'CLAUDE.md'), content: claudeContent });
+    files.push({ path: path.join(context.paths.liveDir, '.claude', 'CLAUDE.md'), content: claudeContent });
+    files.push({ path: path.join(context.paths.liveDir, 'config.toml'), content: renderCodexConfig(env, configRoot, context) });
+    files.push({
+        path: path.join(context.paths.liveDir, '.claude', 'agent-run-settings.json'),
+        content: renderClaudeSettings(env, configRoot, context)
+    });
     files.push(...renderNativeSkillFiles(context));
     files.push(...renderGuardShims(context));
     return {
@@ -1136,8 +1150,28 @@ function syncAgentProfile(projectRoot, agentDir) {
     for (const file of rendered.files) {
         writeGeneratedFile(file.path, file.content, file.executable ?? false);
     }
+    removeLegacyGeneratedClaudeSettings(rendered.context);
     return rendered;
 }
+function removeLegacyGeneratedClaudeSettings(context) {
+    for (const legacyPath of [
+        path.join(context.paths.liveDir, '.claude', 'settings.json'),
+        path.join(context.profileDir, '.claude', 'settings.json')
+    ]) {
+        if (!fs.existsSync(legacyPath)) {
+            continue;
+        }
+        const actual = fs.readFileSync(legacyPath, 'utf8').replace(/\r\n/g, '\n');
+        const legacyGeneratedContents = [
+            legacyDefaultClaudeSettingsContent(context, context.agentDir),
+            legacyDefaultClaudeSettingsContent(context, context.profileDir)
+        ];
+        if (legacyGeneratedContents.includes(actual)) {
+            fs.rmSync(legacyPath);
+            verbose(`removed legacy generated Claude settings ${legacyPath}`);
+        }
+    }
+}
 function checkRenderedProfile(projectRoot, agentDir) {
     const findings = [];
     const configRoot = defaultConfigRoot(projectRoot);
@@ -1157,6 +1191,7 @@ function checkRenderedProfile(projectRoot, agentDir) {
             rendered.context.paths.reviewDir,
             rendered.context.paths.memoriesDir,
             rendered.context.paths.codexHomeDir,
+            rendered.context.paths.liveDir,
             rendered.context.paths.overridesDir,
             rendered.context.paths.codexSkillsDir,
             rendered.context.paths.claudeSkillsDir,
@@ -1278,7 +1313,7 @@ function syncRuntimeDirs(context) {
         context.paths.codexSkillsDir,
         context.paths.claudeSkillsDir,
         context.paths.binDir,
-        path.join(context.agentDir, '.claude')
+        path.join(context.paths.liveDir, '.claude')
     ]) {
         fs.mkdirSync(dir, { recursive: true });
     }
@@ -1488,17 +1523,19 @@ function formatError(error) {
     return error instanceof Error ? error.message : String(error);
 }
 function runCodex(realBinary, permissionArgs, agentDir, configRoot, args, projectRoot, wrapperArgs) {
-    const agentsPath = path.join(agentDir, 'AGENTS.md');
+    const liveDir = profileLiveDir(agentDir);
+    const agentsPath = path.join(liveDir, 'AGENTS.md');
     if (!fs.existsSync(agentsPath)) {
         failMissingConfig('codex', agentDir);
     }
-    const guardBin = path.join(agentDir, 'bin');
-    const codexHomeDir = path.join(agentDir, 'memories', 'codex-home');
+    const guardBin = path.join(liveDir, 'bin');
+    const codexHomeDir = path.join(liveDir, 'memories', 'codex-home');
     fs.mkdirSync(codexHomeDir, { recursive: true });
     const env = {
         ...process.env,
         CODEX_HOME: codexHomeDir,
-        AGENT_DIR: agentDir,
+        AGENT_DIR: liveDir,
+        AGENT_PROFILE_DIR: agentDir,
         AGENT_RUN_PROJECT_ROOT: projectRoot,
         PATH: `${guardBin}${path.delimiter}${process.env.PATH ?? ''}`
     };
@@ -1517,7 +1554,7 @@ function runCodex(realBinary, permissionArgs, agentDir, configRoot, args, projec
             ? ['--config', 'sandbox_workspace_write.network_access=true']
             : []),
         ...args
-    ], shouldUseShell(realBinary), env, codexHomeDir, (code) => postflightProjectCheck(projectRoot, agentDir, code));
+    ], shouldUseShell(realBinary), env, codexHomeDir, (code) => postflightProjectCheck(projectRoot, agentDir, wrapperArgs.local, code));
 }
 function buildCodexRuntimeArgs(wrapperArgs) {
     const mode = wrapperArgs.codexSandboxMode ?? 'danger';
@@ -1526,31 +1563,36 @@ function buildCodexRuntimeArgs(wrapperArgs) {
     }
     return ['-a', 'never', '-s', 'danger-full-access'];
 }
-function runClaude(realBinary, permissionArgs, agentDir, configRoot, args, projectRoot) {
-    const claudePath = path.join(agentDir, 'CLAUDE.md');
+function runClaude(realBinary, permissionArgs, agentDir, configRoot, args, projectRoot, wrapperArgs) {
+    const liveDir = profileLiveDir(agentDir);
+    const claudePath = path.join(liveDir, 'CLAUDE.md');
     if (!fs.existsSync(claudePath)) {
         failMissingConfig('claude', agentDir);
     }
-    const guardBin = path.join(agentDir, 'bin');
-    const claudeConfigDir = path.join(agentDir, '.claude');
+    const guardBin = path.join(liveDir, 'bin');
+    const claudeConfigDir = path.join(liveDir, '.claude');
     const env = {
         ...process.env,
         CLAUDE_CONFIG_DIR: claudeConfigDir,
-        AGENT_DIR: agentDir,
+        AGENT_DIR: liveDir,
+        AGENT_PROFILE_DIR: agentDir,
         AGENT_RUN_PROJECT_ROOT: projectRoot,
         PATH: `${guardBin}${path.delimiter}${process.env.PATH ?? ''}`
     };
     execCommand(realBinary, [
         ...permissionArgs,
         '--settings',
-        path.join(claudeConfigDir, 'settings.json'),
+        path.join(claudeConfigDir, 'agent-run-settings.json'),
         '--add-dir',
         projectRoot,
         '--add-dir',
-        agentDir,
+        liveDir,
         ...globalMemoryArgs(configRoot),
         ...args
-    ], shouldUseShell(realBinary), env, projectRoot, (code) => postflightProjectCheck(projectRoot, agentDir, code));
+    ], shouldUseShell(realBinary), env, projectRoot, (code) => postflightProjectCheck(projectRoot, agentDir, wrapperArgs.local, code));
+}
+function profileLiveDir(agentDir) {
+    return path.join(agentDir, LIVE_DIR_NAME);
 }
 function globalMemoryArgs(configRoot) {
     const memoryDir = globalMemoryDir(configRoot);
@@ -1559,16 +1601,15 @@ function globalMemoryArgs(configRoot) {
 function globalMemoryDir(configRoot) {
     return path.join(configRoot, 'notes', 'memory');
 }
-function postflightProjectCheck(projectRoot, agentDir, code) {
+function postflightProjectCheck(projectRoot, agentDir, allowLocal, code) {
     const localAiFiles = findLocalAiFiles(projectRoot, agentDir);
-    if (localAiFiles.length === 0) {
-        return code;
-    }
-    process.stderr.write(`agent-run: postflight found local AI files in project root ${projectRoot}\n`);
-    for (const file of localAiFiles) {
-        process.stderr.write(`agent-run:   ${file}\n`);
+    if (localAiFiles.length > 0) {
+        warnForLocalAiFiles(null, projectRoot, localAiFiles);
+        if (!allowLocal) {
+            return 1;
+        }
     }
-    return 1;
+    return code;
 }
 function failMissingConfig(tool, agentDir) {
     process.stderr.write(`agent-run: no ${tool} config found for this project: ${agentDir}\n`);
@@ -1648,6 +1689,7 @@ function isSamePathOrDescendant(candidatePath, parentPath) {
 function shouldPruneProjectEntry(entry) {
     return (entry.isDirectory() &&
         (entry.name === '.git' ||
+            entry.name === '.claude' ||
             entry.name === 'node_modules' ||
             entry.name === '.pnpm-store' ||
             entry.name === 'dist' ||
@@ -1666,13 +1708,21 @@ function isIgnoredDir(dir) {
     const env = readAgentRunEnv(dir);
     return parseBooleanEnv(env.AGENT_RUN_IGNORE);
 }
+function warnForLocalAiFiles(tool, projectRoot, localAiFiles) {
+    process.stderr.write(`WARNING: local AI files found in project root ${projectRoot}\n`);
+    for (const file of localAiFiles) {
+        process.stderr.write(`WARNING:   ${path.relative(projectRoot, file)}\n`);
+    }
+    if (tool !== null) {
+        process.stderr.write(`WARNING: consider moving these files out of the project, or run \`agent-run ${tool} --none\` to bypass the wrapper.\n`);
+    }
+}
 function failForLocalAiFiles(tool, projectRoot, localAiFiles) {
     process.stderr.write(`agent-run: found local AI files in project root ${projectRoot}\n`);
     for (const file of localAiFiles) {
         process.stderr.write(`agent-run:   ${file}\n`);
     }
-    process.stderr.write(`agent-run: move these files manually out of the project, or run \`${tool}\` directly if you want to use the local files.\n`);
-    process.stderr.write(`agent-run: run \`agent-run ${tool} --none\` to bypass the wrapper for this invocation.\n`);
+    process.stderr.write(`agent-run: move these files manually out of the project, run \`agent-run ${tool} --local\` to warn and continue, or run \`agent-run ${tool} --none\` to bypass the wrapper for this invocation.\n`);
     process.exit(1);
 }
 function findProjectRoot(cwd) {
@@ -2093,6 +2143,12 @@ function defaultLocalTemplate(_profile) {
         '{{ agentDir }}',
         '```',
         '',
+        'Profile source directory:',
+        '',
+        '```text',
+        '{{ profileDir }}',
+        '```',
+        '',
         'Add project-specific rules here.',
         ''
     ].join('\n');
@@ -2135,7 +2191,8 @@ function defaultNoAiFilesSnippet() {
         '## Agent File Storage',
         '',
         'Do not create AGENTS.md, CLAUDE.md, .agents, .claude, .codex, or other agent runtime files inside the project repository.',
-        'Agent-only files belong under {{ agentDir }}.',
+        'Generated agent-only files belong under {{ paths.liveDir }}.',
+        'Source config files belong under {{ profileDir }}.',
         ''
     ].join('\n');
 }
@@ -2207,8 +2264,8 @@ function defaultToolInstructionsTemplate(isClaude) {
         'Do not edit this file directly. Edit:',
         '',
         '```text',
-        '{{ agentDir }}/agent-run.jsonc',
-        '{{ agentDir }}/local.md.njk',
+        '{{ profileDir }}/agent-run.jsonc',
+        '{{ profileDir }}/local.md.njk',
         '```',
         '',
         '{% for section in renderedAgentSections %}',
@@ -2229,6 +2286,12 @@ function defaultToolInstructionsTemplate(isClaude) {
         '{{ agentDir }}',
         '```',
         '',
+        'Profile source directory:',
+        '',
+        '```text',
+        '{{ profileDir }}',
+        '```',
+        '',
         'Review directory:',
         '',
         '```text',
@@ -2268,13 +2331,14 @@ function defaultToolInstructionsTemplate(isClaude) {
         '## Tool Note',
         '',
         isClaude
-            ? 'Claude uses the generated config directory under {{ agentDir }}/.claude and may read {{ agentDir }} via `--add-dir`.'
+            ? 'Claude uses the generated config directory under {{ paths.liveDir }}/.claude and may read {{ paths.liveDir }} via `--add-dir`.'
             : 'Codex uses {{ agentDir }}/AGENTS.md as `system_prompt_file` and {{ paths.codexHomeDir }} as CODEX_HOME.',
         '',
         '## Mandatory Path Rule',
         '',
         'Do not create AGENTS.md, CLAUDE.md, .agents, .claude, .codex, or AI-related files inside the project repository.',
-        'Agent-only files must be stored under the agent directory shown above.',
+        'Generated agent-only files must be stored under the agent directory shown above.',
+        'Source config files must be stored under the profile source directory shown above.',
         ''
     ].join('\n');
 }
@@ -2289,6 +2353,7 @@ function defaultCodexConfigTemplate() {
         'writable_roots = [',
         '  "{{ projectRoot }}",',
         '  "{{ agentDir }}",',
+        '  "{{ profileDir }}",',
         '  "{{ paths.globalMemoryDir }}"',
         ']',
         'network_access = false',
@@ -2296,15 +2361,27 @@ function defaultCodexConfigTemplate() {
     ].join('\n');
 }
 function defaultClaudeSettingsTemplate() {
-    return [
-        '{',
+    const envBlock = [
         '  "env": {',
         '    "AGENT_DIR": "{{ agentDir }}",',
+        '    "AGENT_PROFILE_DIR": "{{ profileDir }}",',
         '    "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",',
         '    "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}"',
+        '  }'
+    ].join('\n');
+    return [
+        '{% if permissionsAllow.length %}{',
+        envBlock + ',',
+        '  "permissions": {',
+        '    "allow": [',
+        '      "{{ permissionsAllow | join(\'",\\n      "\') }}"',
+        '    ]',
         '  }',
         '}',
-        ''
+        '{% else %}{',
+        envBlock,
+        '}',
+        '{% endif %}'
     ].join('\n');
 }
 function defaultCodexConfigContent(context) {
@@ -2318,6 +2395,7 @@ function defaultCodexConfigContent(context) {
         'writable_roots = [',
         `  ${jsonString(context.projectRoot)},`,
         `  ${jsonString(context.agentDir)},`,
+        `  ${jsonString(context.profileDir)},`,
         `  ${jsonString(context.paths.globalMemoryDir)}`,
         ']',
         'network_access = false',
@@ -2325,9 +2403,23 @@ function defaultCodexConfigContent(context) {
     ].join('\n');
 }
 function defaultClaudeSettingsContent(context) {
-    return `${JSON.stringify({
+    const settings = {
         env: {
             AGENT_DIR: context.agentDir,
+            AGENT_PROFILE_DIR: context.profileDir,
+            AGENT_RUN_PROJECT_ROOT: context.projectRoot,
+            AGENT_GLOBAL_MEMORY_DIR: context.paths.globalMemoryDir
+        }
+    };
+    if (context.permissionsAllow.length > 0) {
+        settings.permissions = { allow: context.permissionsAllow };
+    }
+    return `${JSON.stringify(settings, null, 2)}\n`;
+}
+function legacyDefaultClaudeSettingsContent(context, agentDir) {
+    return `${JSON.stringify({
+        env: {
+            AGENT_DIR: agentDir,
             AGENT_RUN_PROJECT_ROOT: context.projectRoot,
             AGENT_GLOBAL_MEMORY_DIR: context.paths.globalMemoryDir
         }

package/examples/basic-config/agent-config/gitignore

@@ -1,21 +1,5 @@
-# Generated agent-run files
-**/AGENTS.md
-**/CLAUDE.md
-**/GEMINI.md
-**/config.toml
-
-# Generated native agent homes
-**/.agents/
-**/.claude/
-**/.codex/
-
-# Generated runtime files
-**/bin/
-**/reviews/
-**/memories/
-
-# Generated review reports
-**/REVIEW-*.md
+# Generated agent-run live profiles
+**/live/
 
 # Optional generated caches
 **/.agent-run-cache/

package/examples/basic-config/agent-config/global/snippets/no-ai-files.md.njk

@@ -7,3 +7,9 @@ Agent directory:
 ```text
 {{ agentDir }}
 ```
+
+Profile source directory:
+
+```text
+{{ profileDir }}
+```

package/examples/basic-config/agent-config/global/tool-templates/AGENTS.md.njk

@@ -10,6 +10,7 @@ Do not edit this generated file. Edit `agent-run.jsonc` and `local.md.njk`.
 
 - projectRoot: `{{ projectRoot }}`
 - agentDir: `{{ agentDir }}`
+- profileDir: `{{ profileDir }}`
 - reviewFile: `{{ paths.reviewFile }}`
 - memoriesDir: `{{ paths.memoriesDir }}`
 - globalMemoryDir: `{{ paths.globalMemoryDir }}`

package/examples/basic-config/agent-config/global/tool-templates/claude-settings.json.njk

@@ -1,8 +1,24 @@
-{
+{% if permissionsAllow.length %}{
   "env": {
     "AGENT_DIR": "{{ agentDir }}",
+    "AGENT_PROFILE_DIR": "{{ profileDir }}",
     "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
     "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
     "STARTER_PROFILE": "{{ profile }}"
+  },
+  "permissions": {
+    "allow": [
+      "{{ permissionsAllow | join('",\n      "') }}"
+    ]
   }
 }
+{% else %}{
+  "env": {
+    "AGENT_DIR": "{{ agentDir }}",
+    "AGENT_PROFILE_DIR": "{{ profileDir }}",
+    "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
+    "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
+    "STARTER_PROFILE": "{{ profile }}"
+  }
+}
+{% endif %}

package/examples/basic-config/agent-config/global/tool-templates/codex-config.toml.njk

@@ -6,6 +6,7 @@ sandbox_mode = "workspace-write"
 writable_roots = [
   "{{ projectRoot }}",
   "{{ agentDir }}",
+  "{{ profileDir }}",
   "{{ paths.memoriesDir }}",
   "{{ paths.globalMemoryDir }}"
 ]

package/examples/basic-config/agent-config/starter/basic-project/local.md.njk

@@ -3,3 +3,4 @@
 This starter profile belongs to `{{ profile }}`.
 
 Use the project root at `{{ projectRoot }}` and keep generated files in `{{ agentDir }}`.
+Keep source profile edits in `{{ profileDir }}`.

package/examples/basic-config/agent-config/starter/basic-project/overrides/claude-settings.json.njk

@@ -1,9 +1,26 @@
-{
+{% if permissionsAllow.length %}{
   "env": {
     "AGENT_DIR": "{{ agentDir }}",
+    "AGENT_PROFILE_DIR": "{{ profileDir }}",
     "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
     "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
     "STARTER_PROFILE": "{{ profile }}",
     "STARTER_OVERRIDE": "true"
+  },
+  "permissions": {
+    "allow": [
+      "{{ permissionsAllow | join('",\n      "') }}"
+    ]
   }
 }
+{% else %}{
+  "env": {
+    "AGENT_DIR": "{{ agentDir }}",
+    "AGENT_PROFILE_DIR": "{{ profileDir }}",
+    "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
+    "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
+    "STARTER_PROFILE": "{{ profile }}",
+    "STARTER_OVERRIDE": "true"
+  }
+}
+{% endif %}

package/examples/basic-config/agent-config/starter/basic-project/overrides/codex-config.toml.njk

@@ -6,6 +6,7 @@ sandbox_mode = "workspace-write"
 writable_roots = [
   "{{ projectRoot }}",
   "{{ agentDir }}",
+  "{{ profileDir }}",
   "{{ paths.memoriesDir }}",
   "{{ paths.globalMemoryDir }}"
 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/agent-run",
-  "version": "0.99.11",
+  "version": "0.99.13",
   "packageManager": "pnpm@10.28.1",
   "bin": {
     "agent-run": "dist/agent-run.js"