@wix/ditto-codegen-public 1.0.437 → 1.0.438

package/dist/out.js

@@ -543,8 +543,8 @@ var require_context = __commonJS({
     exports2.initCtx = exports2.ctx = void 0;
     var types_1 = require_types_impl();
     var dotenv_1 = __importDefault2(require_main());
-    var path_1 = __importDefault2(require("path"));
-    dotenv_1.default.config({ path: path_1.default.join(__dirname, "../.env"), override: true });
+    var path_12 = __importDefault2(require("path"));
+    dotenv_1.default.config({ path: path_12.default.join(__dirname, "../.env"), override: true });
     var HistoryManager = class {
       constructor() {
         this.history = [];
@@ -10949,6 +10949,16 @@ var require_plugins2 = __commonJS({
   }
 });
 
+// ../codegen-types/dist/types/tool-policies.js
+var require_tool_policies = __commonJS({
+  "../codegen-types/dist/types/tool-policies.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.OVERRIDE_AUTHORITY_NOTE = void 0;
+    exports2.OVERRIDE_AUTHORITY_NOTE = `This override intentionally supersedes the wix-app reference docs and the Wix CLI schema output; do not spend turns re-verifying it against them.`;
+  }
+});
+
 // ../codegen-types/dist/types/job-payload.js
 var require_job_payload = __commonJS({
   "../codegen-types/dist/types/job-payload.js"(exports2) {
@@ -11010,6 +11020,7 @@ var require_dist4 = __commonJS({
     __exportStar2(require_decision(), exports2);
     __exportStar2(require_environment(), exports2);
     __exportStar2(require_plugins2(), exports2);
+    __exportStar2(require_tool_policies(), exports2);
     __exportStar2(require_job_payload(), exports2);
     __exportStar2(require_logger2(), exports2);
     __exportStar2(require_ai(), exports2);
@@ -12029,11 +12040,11 @@ var require_rules_writer = __commonJS({
     exports2.writeRuleFiles = writeRuleFiles;
     var promises_1 = require("fs/promises");
     var os_1 = require("os");
-    var path_1 = require("path");
+    var path_12 = require("path");
     var logger_12 = require_logger();
-    var GLOBAL_RULES_DIR = (0, path_1.join)((0, os_1.homedir)(), ".config", "opencode", "rules");
+    var GLOBAL_RULES_DIR = (0, path_12.join)((0, os_1.homedir)(), ".config", "opencode", "rules");
     function getRulePath(filename) {
-      return (0, path_1.join)(GLOBAL_RULES_DIR, filename);
+      return (0, path_12.join)(GLOBAL_RULES_DIR, filename);
     }
     async function writeRuleFiles(rules) {
       if (rules.length === 0) {
@@ -12051,6 +12062,26 @@ var require_rules_writer = __commonJS({
   }
 });
 
+// dist/opencode-integration/generated-plugins.js
+var require_generated_plugins = __commonJS({
+  "dist/opencode-integration/generated-plugins.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.OPENCODE_PLUGIN_DIR = void 0;
+    exports2.writeGeneratedPlugin = writeGeneratedPlugin;
+    var promises_1 = require("fs/promises");
+    var os_1 = require("os");
+    var path_12 = require("path");
+    var logger_12 = require_logger();
+    exports2.OPENCODE_PLUGIN_DIR = (0, path_12.join)((0, os_1.homedir)(), ".config", "opencode", "plugin");
+    async function writeGeneratedPlugin(filename, source) {
+      await (0, promises_1.mkdir)(exports2.OPENCODE_PLUGIN_DIR, { recursive: true });
+      await (0, promises_1.writeFile)((0, path_12.join)(exports2.OPENCODE_PLUGIN_DIR, filename), source, "utf-8");
+      logger_12.logger.info("[OpenCode] Wrote generated plugin", { plugin: filename });
+    }
+  }
+});
+
 // dist/opencode-integration/node-modules-guard.js
 var require_node_modules_guard = __commonJS({
   "dist/opencode-integration/node-modules-guard.js"(exports2) {
@@ -12060,10 +12091,8 @@ var require_node_modules_guard = __commonJS({
     exports2.isSpelunkCommand = isSpelunkCommand;
     exports2.buildGuardPluginSource = buildGuardPluginSource;
     exports2.writeGuardPlugin = writeGuardPlugin;
-    var promises_1 = require("fs/promises");
-    var os_1 = require("os");
-    var path_1 = require("path");
-    var logger_12 = require_logger();
+    var path_12 = require("path");
+    var generated_plugins_1 = require_generated_plugins();
     var READ_VERB_RE = /(^|[\s|;&(])(grep|rg|cat|head|tail|sed|awk|less|more|strings|find)\b/;
     var SDK_INTERNALS_RE = /node_modules\/(@wix|vite|astro)\b/;
     exports2.MAX_SPELUNK_CALLS = 2;
@@ -12074,9 +12103,8 @@ For anything more (CSS-module/asset typing, component config, etc.), re-read the
     function isSpelunkCommand(command) {
       return READ_VERB_RE.test(command) && SDK_INTERNALS_RE.test(command);
     }
-    var GLOBAL_PLUGIN_DIR = (0, path_1.join)((0, os_1.homedir)(), ".config", "opencode", "plugin");
     var GUARD_PLUGIN_FILENAME = "node-modules-guard.ts";
-    exports2.GUARD_PLUGIN_PATH = (0, path_1.join)(GLOBAL_PLUGIN_DIR, GUARD_PLUGIN_FILENAME);
+    exports2.GUARD_PLUGIN_PATH = (0, path_12.join)(generated_plugins_1.OPENCODE_PLUGIN_DIR, GUARD_PLUGIN_FILENAME);
     function buildGuardPluginSource() {
       return `// Generated by @wix/ditto-codegen (node-modules-guard) \u2014 do not edit.
 const READ_VERB_RE = /${READ_VERB_RE.source}/;
@@ -12103,11 +12131,7 @@ export const NodeModulesGuard = async () => ({
 `;
     }
     async function writeGuardPlugin() {
-      await (0, promises_1.mkdir)(GLOBAL_PLUGIN_DIR, { recursive: true });
-      await (0, promises_1.writeFile)(exports2.GUARD_PLUGIN_PATH, buildGuardPluginSource(), "utf-8");
-      logger_12.logger.info("[OpenCode] Wrote node_modules guard plugin", {
-        path: exports2.GUARD_PLUGIN_PATH
-      });
+      await (0, generated_plugins_1.writeGeneratedPlugin)(GUARD_PLUGIN_FILENAME, buildGuardPluginSource());
     }
   }
 });
@@ -13257,7 +13281,7 @@ var require_checkpoint = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.checkpointPluginFactory = void 0;
     var fs_1 = require("fs");
-    var path_1 = require("path");
+    var path_12 = require("path");
     var http_1 = require_http_impl2();
     var http_2 = require_http_impl3();
     var types_1 = require_types_impl3();
@@ -13274,8 +13298,8 @@ var require_checkpoint = __commonJS({
       const mapping = process.env.CODEGEN_ENVIRONMENT ? COMMON_CONFIG_BY_ENVIRONMENT[process.env.CODEGEN_ENVIRONMENT] : void 0;
       return mapping ? encodeURIComponent(JSON.stringify(mapping)) : void 0;
     })();
-    var ASSETS_DIR = (0, path_1.join)(__dirname, "..", "assets");
-    var readAsset = (name) => (0, fs_1.readFileSync)((0, path_1.join)(ASSETS_DIR, name), "utf-8");
+    var ASSETS_DIR = (0, path_12.join)(__dirname, "..", "assets");
+    var readAsset = (name) => (0, fs_1.readFileSync)((0, path_12.join)(ASSETS_DIR, name), "utf-8");
     var buildCheckpointRules = () => [
       {
         filename: "checkpoint-commit-message.md",
@@ -14688,76 +14712,200 @@ var require_system_prompts = __commonJS({
   }
 });
 
-// ../codegen-common-logic/dist/site-data-layer-rules.js
-var require_site_data_layer_rules = __commonJS({
-  "../codegen-common-logic/dist/site-data-layer-rules.js"(exports2) {
+// ../codegen-common-logic/dist/rules/site-data-layer.js
+var require_site_data_layer = __commonJS({
+  "../codegen-common-logic/dist/rules/site-data-layer.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.SITE_DATA_LAYER_RULES = void 0;
     exports2.SITE_DATA_LAYER_RULES = `# Site Data Layer Rules
 
-The agent operates on a live Wix site (METASITE_ID is in your prompt context).
-
-## Mandatory for data persistence
-
 For any persistent-data need (CMS collections, tables, schemas, data models):
 
-1. **You MUST invoke the \`wix-site-data-collection\` skill first** \u2014 before scaffolding or writing collection code.
-2. **Do NOT** run \`wix generate\` with \`extensionType: DATA_COLLECTION\`, and do not create data-collection CLI extension files manually (e.g. \`src/extensions/backend/data-collections/*\`).
+1. **You MUST invoke the \`wix-site-data-collection\` skill before scaffolding or writing any collection code.**
+2. **Do NOT** create data-collection CLI extension files manually (e.g. \`src/extensions/backend/data-collections/*\`).
 
-\`wix-app\` is still correct for dashboard pages, modals, widgets, and UI \u2014 only the data layer is overridden here.`;
+\`wix-app\` is still correct for dashboard pages, modals, widgets, and UI; only the data layer is overridden here.`;
   }
 });
 
-// ../codegen-common-logic/dist/stores-catalog-version-rules.js
-var require_stores_catalog_version_rules = __commonJS({
-  "../codegen-common-logic/dist/stores-catalog-version-rules.js"(exports2) {
+// ../codegen-common-logic/dist/rules/stores-catalog-version.js
+var require_stores_catalog_version = __commonJS({
+  "../codegen-common-logic/dist/rules/stores-catalog-version.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.STORES_CATALOG_VERSION_RULES = void 0;
     exports2.STORES_CATALOG_VERSION_RULES = `# Wix Stores Catalog Version Rules
 
-The agent operates on a live Wix site (METASITE_ID is in your prompt context), so the site's Stores catalog version is knowable at build time.
-
-## Mandatory before any Stores work
-
-For any use of a Wix Stores API \u2014 products, variants, inventory, collections/categories, Stores webhooks, or any other part of the Stores catalog:
+This site runs exactly ONE Stores catalog version, detectable at build time.
 
-1. **You MUST invoke the \`wix-stores-catalog-version\` skill first** \u2014 before choosing imports, permission scopes, or webhook subscriptions.
-2. **Generate one version's code path only.** No \`catalogVersioning.getCatalogVersion()\` call in generated code, no branching on the version, and no adapter that normalizes V1 and V3 shapes into one type.
-3. **Do NOT tell the user their app must support both catalog versions**, and do not add Dev Center action items about confirming V1/V3 compatibility. That requirement applies to public App Market apps, not to a companion app targeting one known site.
-
-\`wix-app\` is still correct for dashboard pages, modals, widgets, and UI \u2014 and its \`STORES_VERSIONING.md\` remains the reference for the module map, permissions, field mappings, and gotchas. Only the dual-catalog requirement is overridden here.`;
+For ANY use of a Wix Stores API (products, variants, inventory, collections/categories, Stores webhooks): you MUST invoke the \`wix-stores-catalog-version\` skill before choosing imports, permission scopes, or webhook subscriptions. It detects this site's catalog version; generate that version's code path only.`;
   }
 });
 
-// ../codegen-common-logic/dist/studio-2-site-ui-rules.js
-var require_studio_2_site_ui_rules = __commonJS({
-  "../codegen-common-logic/dist/studio-2-site-ui-rules.js"(exports2) {
+// ../codegen-common-logic/dist/rules/index.js
+var require_rules = __commonJS({
+  "../codegen-common-logic/dist/rules/index.js"(exports2) {
     "use strict";
+    var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar2 = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding2(exports3, m, p);
+    };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.STUDIO_2_SITE_UI_RULES = void 0;
-    exports2.STUDIO_2_SITE_UI_RULES = `# Studio 2 Site UI Rules
-
-In the **Studio 2** environment, all site UI MUST be built as **Editor React Components** (\`extensionType: EDITOR_REACT_COMPONENT\`).
-
-- **Never create a Custom Element / site widget** (\`extensionType: CUSTOM_ELEMENT\`, \`CUSTOM_ELEMENT_WIDGET\`). This rule overrides the prompt \u2014 even if the prompt explicitly says "custom element", build it as an Editor React Component instead.
-- The words "widget" and "custom element" in the prompt do **not** mean Custom Element \u2014 always implement them as Editor React Components.
-
-## Studio 2 Site Plugin Restrictions
+    __exportStar2(require_site_data_layer(), exports2);
+    __exportStar2(require_stores_catalog_version(), exports2);
+  }
+});
 
-The following pages **no longer support site plugins** in Studio 2. **This overrides the site plugin skills reference** \u2014 even if SLOTS.md lists these pages as supported, do NOT use a site plugin for them:
+// ../codegen-common-logic/dist/site-environment.js
+var require_site_environment = __commonJS({
+  "../codegen-common-logic/dist/site-environment.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SITE_CODEGEN_RULES = exports2.SITE_ENVIRONMENT_IDENTITY = void 0;
+    var rules_1 = require_rules();
+    exports2.SITE_ENVIRONMENT_IDENTITY = "You generate code for the user's own live Wix site \u2014 to the user it's just their site, not a separate app they're aware of. Your changes are saved and applied to the site automatically; there is no separate release step.";
+    exports2.SITE_CODEGEN_RULES = [
+      { filename: "site-data-layer-rules.md", content: rules_1.SITE_DATA_LAYER_RULES },
+      {
+        filename: "stores-catalog-version-rules.md",
+        content: rules_1.STORES_CATALOG_VERSION_RULES
+      }
+    ];
+  }
+});
 
-- **Product Page (New Version)** (Wix Stores)
-- **Product Page (Old Version)** (Wix Stores)
-- **Service Page** (Wix Bookings)
-- **Event Details Page** (Wix Events)
+// ../codegen-common-logic/dist/tool-policies/site.js
+var require_site = __commonJS({
+  "../codegen-common-logic/dist/tool-policies/site.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SITE_POLICIES = exports2.SITE_DATA_COLLECTION_GENERATE_POLICY = exports2.STORES_VERSIONING_POLICY = void 0;
+    exports2.STORES_VERSIONING_POLICY = {
+      type: "read",
+      mode: "prepend",
+      pathFragments: ["wix-app/references/STORES_VERSIONING"],
+      message: `ENVIRONMENT OVERRIDE (live site, single catalog): this site runs exactly ONE Stores catalog version. Ignore every dual-catalog instruction in this document: do not call catalogVersioning.getCatalogVersion(), do not branch on V1/V3, and do not tell the user their app must support both versions. Invoke the wix-stores-catalog-version skill to detect this site's version, then apply only that version's guidance from this document.`,
+      driftMarkers: ["must support both"]
+    };
+    exports2.SITE_DATA_COLLECTION_GENERATE_POLICY = {
+      type: "generate",
+      blockedExtensionTypes: ["DATA_COLLECTION"],
+      message: `BLOCKED: DATA_COLLECTION extensions are not scaffolded in this environment. Invoke the wix-site-data-collection skill to create or change collections. Do not retry with wix generate.`
+    };
+    exports2.SITE_POLICIES = [
+      exports2.STORES_VERSIONING_POLICY,
+      exports2.SITE_DATA_COLLECTION_GENERATE_POLICY
+    ];
+  }
+});
 
-Build the appropriate Studio 2 extension instead:
-- **Need to render UI on the page** \u2192 Editor React Component (\`extensionType: EDITOR_REACT_COMPONENT\`)
-- **Need to expose shared data or state to components on the page (no UI)** \u2192 Context Provider (use the \`wix-cli-context-provider\` skill)
+// ../codegen-common-logic/dist/tool-policies/studio-2.js
+var require_studio_2 = __commonJS({
+  "../codegen-common-logic/dist/tool-policies/studio-2.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.STUDIO_2_POLICIES = exports2.STUDIO_2_CUSTOM_ELEMENT_GENERATE_POLICY = exports2.STUDIO_2_SITE_PLUGIN_SLOTS_GENERATE_POLICY = exports2.SITE_PLUGIN_SCHEMA_COMMAND_POLICY = exports2.STUDIO_2_SKILL_ROUTING_POLICY = exports2.SITE_PLUGIN_PAGES_POLICY = exports2.SITE_PLUGIN_REDIRECT = exports2.SITE_PLUGIN_UNSUPPORTED_PAGES = exports2.CUSTOM_ELEMENT_REFERENCES_POLICY = void 0;
+    exports2.CUSTOM_ELEMENT_REFERENCES_POLICY = {
+      type: "read",
+      mode: "block",
+      pathFragments: [
+        "wix-app/references/CUSTOM_ELEMENT_WIDGET",
+        "wix-app/references/custom-element-widget/"
+      ],
+      message: `BLOCKED: Custom Element widgets are not available in this environment. All site UI must be an Editor React Component (extensionType: EDITOR_REACT_COMPONENT). Read wix-app's references/EDITOR_REACT_COMPONENT.md instead. Do not retry this read.`
+    };
+    exports2.SITE_PLUGIN_UNSUPPORTED_PAGES = `Product Page (New Version), Product Page (Old Version), Service Page (Wix Bookings), Event Details Page (Wix Events)`;
+    exports2.SITE_PLUGIN_REDIRECT = `For UI on those pages build an Editor React Component; for shared data or state without UI use the wix-cli-context-provider skill. Site plugins remain supported on all other listed pages.`;
+    var STUDIO_2_SITE_UI_ROUTING = `- All site UI MUST be an Editor React Component (\`extensionType: EDITOR_REACT_COMPONENT\`); Custom Elements (\`CUSTOM_ELEMENT\`, \`CUSTOM_ELEMENT_WIDGET\`) are unavailable in this environment, even if the prompt says "custom element" or "widget".
+- Site plugins are not supported on these pages: ${exports2.SITE_PLUGIN_UNSUPPORTED_PAGES}. ${exports2.SITE_PLUGIN_REDIRECT}`;
+    exports2.SITE_PLUGIN_PAGES_POLICY = {
+      type: "read",
+      mode: "prepend",
+      pathFragments: [
+        "wix-app/references/SITE_PLUGIN",
+        "wix-app/references/site-plugin/"
+      ],
+      message: `ENVIRONMENT OVERRIDE: site plugins are NOT supported on these pages in this environment, even where this document lists them: ${exports2.SITE_PLUGIN_UNSUPPORTED_PAGES}. ${exports2.SITE_PLUGIN_REDIRECT}`
+    };
+    exports2.STUDIO_2_SKILL_ROUTING_POLICY = {
+      type: "skillContent",
+      skillNames: ["wix-app"],
+      message: `ENVIRONMENT OVERRIDE: this skill's extension-type routing does not fully apply in this environment. Where the content below says otherwise:
+${STUDIO_2_SITE_UI_ROUTING}`
+    };
+    exports2.SITE_PLUGIN_SCHEMA_COMMAND_POLICY = {
+      type: "commandOutput",
+      commandFragments: ["wix schema generate", "SITE_PLUGIN"],
+      message: `ENVIRONMENT OVERRIDE: this schema output includes slots on pages where site plugins are NOT supported in this environment: ${exports2.SITE_PLUGIN_UNSUPPORTED_PAGES}. Do not scaffold a site plugin into slots on those pages, even though the schema lists them. ${exports2.SITE_PLUGIN_REDIRECT}`
+    };
+    exports2.STUDIO_2_SITE_PLUGIN_SLOTS_GENERATE_POLICY = {
+      type: "generate",
+      blockedExtensionTypes: ["SITE_PLUGIN"],
+      whenArgsInclude: [
+        "6a25b678-53ec-4b37-a190-65fcd1ca1a63",
+        // Product Page (New Version)
+        "13a94f09-2766-3c40-4a32-8edb5acdd8bc",
+        // Product Page (Old Version)
+        "a91a0543-d4bd-4e6b-b315-9410aa27bcde",
+        // Service Page (Wix Bookings)
+        "14d2abc2-5350-6322-487d-8c16ff833c8a"
+        // Event Details Page (Wix Events)
+      ],
+      driftSkill: "wix-app",
+      message: `BLOCKED: site plugins are not supported on this page in this environment (${exports2.SITE_PLUGIN_UNSUPPORTED_PAGES}). ${exports2.SITE_PLUGIN_REDIRECT} Do not retry with another slot on the same page.`
+    };
+    exports2.STUDIO_2_CUSTOM_ELEMENT_GENERATE_POLICY = {
+      type: "generate",
+      blockedExtensionTypes: ["CUSTOM_ELEMENT", "CUSTOM_ELEMENT_WIDGET"],
+      message: `BLOCKED: extensionType CUSTOM_ELEMENT / CUSTOM_ELEMENT_WIDGET cannot be generated in this environment. Build an Editor React Component (extensionType: EDITOR_REACT_COMPONENT) instead. Do not retry with a custom element type.`
+    };
+    exports2.STUDIO_2_POLICIES = [
+      exports2.CUSTOM_ELEMENT_REFERENCES_POLICY,
+      exports2.SITE_PLUGIN_PAGES_POLICY,
+      exports2.SITE_PLUGIN_SCHEMA_COMMAND_POLICY,
+      exports2.STUDIO_2_SKILL_ROUTING_POLICY,
+      exports2.STUDIO_2_SITE_PLUGIN_SLOTS_GENERATE_POLICY,
+      exports2.STUDIO_2_CUSTOM_ELEMENT_GENERATE_POLICY
+    ];
+  }
+});
 
-Both can be combined when the use case requires rendering UI and sharing state.`;
+// ../codegen-common-logic/dist/tool-policies/index.js
+var require_tool_policies2 = __commonJS({
+  "../codegen-common-logic/dist/tool-policies/index.js"(exports2) {
+    "use strict";
+    var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar2 = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding2(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar2(require_site(), exports2);
+    __exportStar2(require_studio_2(), exports2);
   }
 });
 
@@ -14801,9 +14949,9 @@ var require_dist7 = __commonJS({
     __exportStar2(require_commonUseCasesGuide(), exports2);
     __exportStar2(require_availableSdks(), exports2);
     __exportStar2(require_system_prompts(), exports2);
-    __exportStar2(require_site_data_layer_rules(), exports2);
-    __exportStar2(require_stores_catalog_version_rules(), exports2);
-    __exportStar2(require_studio_2_site_ui_rules(), exports2);
+    __exportStar2(require_site_environment(), exports2);
+    __exportStar2(require_rules(), exports2);
+    __exportStar2(require_tool_policies2(), exports2);
   }
 });
 
@@ -14816,19 +14964,13 @@ var require_dist8 = __commonJS({
     var codegen_checkpoint_plugin_1 = require_dist6();
     var codegen_common_logic_1 = require_dist7();
     exports2.studio2CodegenConfig = {
-      environmentIdentity: "You generate code for the user's own live Wix site \u2014 to the user it's just their site, not a separate app they're aware of. Your changes are saved and applied to the site automatically; there is no separate release step.",
-      codegenRules: [
-        { filename: "site-data-layer-rules.md", content: codegen_common_logic_1.SITE_DATA_LAYER_RULES },
-        {
-          filename: "stores-catalog-version-rules.md",
-          content: codegen_common_logic_1.STORES_CATALOG_VERSION_RULES
-        },
-        { filename: "studio-2-site-ui-rules.md", content: codegen_common_logic_1.STUDIO_2_SITE_UI_RULES }
-      ],
+      environmentIdentity: codegen_common_logic_1.SITE_ENVIRONMENT_IDENTITY,
+      codegenRules: codegen_common_logic_1.SITE_CODEGEN_RULES,
       askRules: [],
       gitConflictsRules: [],
       decisionCheckers: [],
       plugins: [codegen_checkpoint_plugin_1.checkpointPluginFactory],
+      toolPolicies: [...codegen_common_logic_1.SITE_POLICIES, ...codegen_common_logic_1.STUDIO_2_POLICIES],
       chargingMode: "app"
     };
   }
@@ -15025,7 +15167,7 @@ var require_feature_vibe_save = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.featureVibePluginFactory = void 0;
     var fs_1 = require("fs");
-    var path_1 = require("path");
+    var path_12 = require("path");
     var http_1 = require_http_impl4();
     var http_client_1 = require_index_node();
     var FALLBACK_COMMIT_MESSAGE = "Auto-save";
@@ -15033,8 +15175,8 @@ var require_feature_vibe_save = __commonJS({
     var MAX_COMMIT_MESSAGE_LENGTH = 1e3;
     var TRUNCATION_SUFFIX = "\u2026";
     var FEATURE_VIBE_BASE_URL = "https://editor.wix.com";
-    var ASSETS_DIR = (0, path_1.join)(__dirname, "..", "assets");
-    var readAsset = (name) => (0, fs_1.readFileSync)((0, path_1.join)(ASSETS_DIR, name), "utf-8");
+    var ASSETS_DIR = (0, path_12.join)(__dirname, "..", "assets");
+    var readAsset = (name) => (0, fs_1.readFileSync)((0, path_12.join)(ASSETS_DIR, name), "utf-8");
     var buildSaveRules = () => [
       {
         filename: "save-commit-message.md",
@@ -15174,18 +15316,13 @@ var require_dist10 = __commonJS({
     var codegen_feature_vibe_plugin_1 = require_dist9();
     var codegen_common_logic_1 = require_dist7();
     exports2.harmonyCodegenConfig = {
-      environmentIdentity: "You generate code for the user's own live Wix site \u2014 to the user it's just their site, not a separate app they're aware of. Your changes are saved and applied to the site automatically; there is no separate release step.",
-      codegenRules: [
-        { filename: "site-data-layer-rules.md", content: codegen_common_logic_1.SITE_DATA_LAYER_RULES },
-        {
-          filename: "stores-catalog-version-rules.md",
-          content: codegen_common_logic_1.STORES_CATALOG_VERSION_RULES
-        }
-      ],
+      environmentIdentity: codegen_common_logic_1.SITE_ENVIRONMENT_IDENTITY,
+      codegenRules: codegen_common_logic_1.SITE_CODEGEN_RULES,
       askRules: [],
       gitConflictsRules: [],
       decisionCheckers: [],
       plugins: [codegen_feature_vibe_plugin_1.featureVibePluginFactory],
+      toolPolicies: codegen_common_logic_1.SITE_POLICIES,
       chargingMode: "app"
     };
   }
@@ -15620,6 +15757,13 @@ var require_config = __commonJS({
     var READABLE_EXTERNAL_DIRS = {
       "/root/.agents/**": "allow",
       "/root/.claude/**": "allow",
+      // Our generated rule files. Their content is already inlined into the system
+      // prompt (via `instructions`) with the source path visible, so agents
+      // sometimes read the file back "to verify the rule". Denying that read
+      // auto-rejects in headless mode, which the retry loop classifies as a
+      // session error and restarts the whole session, an expensive failure for a
+      // harmless read.
+      "/root/.config/opencode/rules/**": "allow",
       "/root/.opencode/**": "allow",
       "/tmp/**": "allow"
     };
@@ -15757,19 +15901,14 @@ var require_subagent_tool_logger = __commonJS({
   "dist/opencode-integration/subagent-tool-logger.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.SUBAGENT_TOOL_LOGGER_PLUGIN_PATH = exports2.SUBAGENT_STARTED_EVENT_TYPE = exports2.SUBAGENT_TOOL_EVENT_TYPE = void 0;
+    exports2.SUBAGENT_STARTED_EVENT_TYPE = exports2.SUBAGENT_TOOL_EVENT_TYPE = void 0;
     exports2.buildSubagentToolLoggerPluginSource = buildSubagentToolLoggerPluginSource;
     exports2.writeSubagentToolLoggerPlugin = writeSubagentToolLoggerPlugin;
-    var promises_1 = require("fs/promises");
-    var os_1 = require("os");
-    var path_1 = require("path");
-    var logger_12 = require_logger();
+    var generated_plugins_1 = require_generated_plugins();
     var subagents_1 = require_subagents();
     exports2.SUBAGENT_TOOL_EVENT_TYPE = "subagent_tool_use";
     exports2.SUBAGENT_STARTED_EVENT_TYPE = "subagent_started";
-    var GLOBAL_PLUGIN_DIR = (0, path_1.join)((0, os_1.homedir)(), ".config", "opencode", "plugin");
     var PLUGIN_FILENAME = "subagent-tool-logger.ts";
-    exports2.SUBAGENT_TOOL_LOGGER_PLUGIN_PATH = (0, path_1.join)(GLOBAL_PLUGIN_DIR, PLUGIN_FILENAME);
     function buildSubagentToolLoggerPluginSource() {
       return `// Generated by @wix/ditto-codegen (subagent-tool-logger) \u2014 do not edit.
 const EVENT_TYPE = ${JSON.stringify(exports2.SUBAGENT_TOOL_EVENT_TYPE)};
@@ -15883,11 +16022,7 @@ export const SubagentToolLogger = async () => {
 `;
     }
     async function writeSubagentToolLoggerPlugin() {
-      await (0, promises_1.mkdir)(GLOBAL_PLUGIN_DIR, { recursive: true });
-      await (0, promises_1.writeFile)(exports2.SUBAGENT_TOOL_LOGGER_PLUGIN_PATH, buildSubagentToolLoggerPluginSource(), "utf-8");
-      logger_12.logger.info("[OpenCode] Wrote subagent tool logger plugin", {
-        path: exports2.SUBAGENT_TOOL_LOGGER_PLUGIN_PATH
-      });
+      await (0, generated_plugins_1.writeGeneratedPlugin)(PLUGIN_FILENAME, buildSubagentToolLoggerPluginSource());
     }
   }
 });
@@ -17301,14 +17436,14 @@ var require_collect_extensions_created = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.collectInsertedExtensionsMetadata = collectInsertedExtensionsMetadata;
     exports2.buildExtensionsJobPayload = buildExtensionsJobPayload;
-    var path_1 = require("path");
+    var path_12 = require("path");
     var promises_1 = require("fs/promises");
     var ditto_codegen_types_12 = require_dist4();
     var constants_1 = require_constants5();
     var DATA_COLLECTION_MARKER = /import\s+(?:type\s+)?\{[^}]*\bDataCollection\b[^}]*\}\s+from\s+['"](?:@wix\/astro\/builders|@wix\/custom-extensions)['"]/;
-    var getExtensionDirectory = (extensionDefinitionPath) => `${path_1.posix.dirname(extensionDefinitionPath)}/`;
+    var getExtensionDirectory = (extensionDefinitionPath) => `${path_12.posix.dirname(extensionDefinitionPath)}/`;
     var isFileInExtensionFolder = (filePath, extensionDefinitionPath) => filePath === extensionDefinitionPath || filePath.startsWith(getExtensionDirectory(extensionDefinitionPath));
-    var resolveFilePath = (outputPath, filePath) => (0, path_1.isAbsolute)(filePath) ? filePath : (0, path_1.join)(outputPath, filePath);
+    var resolveFilePath = (outputPath, filePath) => (0, path_12.isAbsolute)(filePath) ? filePath : (0, path_12.join)(outputPath, filePath);
     var buildJobExtension = (definitionPath, extensionType, contentForTitle, titlePath, files) => ({
       path: definitionPath,
       extensionType,
@@ -17469,38 +17604,38 @@ var require_agent_io = __commonJS({
     exports2.writeAgentInput = writeAgentInput;
     exports2.readAgentOutput = readAgentOutput;
     var fs_1 = __importDefault2(require("fs"));
-    var path_1 = __importDefault2(require("path"));
+    var path_12 = __importDefault2(require("path"));
     var logger_12 = require_logger();
-    var AGENT_INPUT_DIR = path_1.default.join(".wix", "agentInput");
-    var AGENT_OUTPUT_DIR = path_1.default.join(".wix", "agentOutput");
+    var AGENT_INPUT_DIR = path_12.default.join(".wix", "agentInput");
+    var AGENT_OUTPUT_DIR = path_12.default.join(".wix", "agentOutput");
     function ensureEmptyJsonDir(dir) {
       fs_1.default.mkdirSync(dir, { recursive: true });
       for (const file of fs_1.default.readdirSync(dir)) {
         if (file.endsWith(".json")) {
-          fs_1.default.unlinkSync(path_1.default.join(dir, file));
+          fs_1.default.unlinkSync(path_12.default.join(dir, file));
         }
       }
     }
     function writeAgentInput(outputPath, agentData) {
-      const inputDir = path_1.default.join(outputPath, AGENT_INPUT_DIR);
-      const outputDir = path_1.default.join(outputPath, AGENT_OUTPUT_DIR);
+      const inputDir = path_12.default.join(outputPath, AGENT_INPUT_DIR);
+      const outputDir = path_12.default.join(outputPath, AGENT_OUTPUT_DIR);
       ensureEmptyJsonDir(inputDir);
       ensureEmptyJsonDir(outputDir);
       if (!agentData)
         return;
       for (const [key, value] of Object.entries(agentData)) {
-        fs_1.default.writeFileSync(path_1.default.join(inputDir, `${key}.json`), JSON.stringify({ [key]: value }));
+        fs_1.default.writeFileSync(path_12.default.join(inputDir, `${key}.json`), JSON.stringify({ [key]: value }));
       }
     }
     function readAgentOutput(outputPath) {
-      const outputDir = path_1.default.join(outputPath, AGENT_OUTPUT_DIR);
+      const outputDir = path_12.default.join(outputPath, AGENT_OUTPUT_DIR);
       if (!fs_1.default.existsSync(outputDir))
         return {};
       const merged = {};
       for (const file of fs_1.default.readdirSync(outputDir)) {
         if (!file.endsWith(".json"))
           continue;
-        const filePath = path_1.default.join(outputDir, file);
+        const filePath = path_12.default.join(outputDir, file);
         const raw = fs_1.default.readFileSync(filePath, "utf-8").trim();
         if (!raw)
           continue;
@@ -17530,7 +17665,7 @@ var require_codegen_flow_helpers = __commonJS({
     exports2.buildFailedRunPayload = buildFailedRunPayload;
     exports2.updateParentTaskStatus = updateParentTaskStatus;
     exports2.getOutputPath = getOutputPath;
-    var path_1 = __importDefault2(require("path"));
+    var path_12 = __importDefault2(require("path"));
     var codeGenerationService_12 = require_codeGenerationService();
     var git_file_changes_1 = require_git_file_changes();
     var collect_extensions_created_1 = require_collect_extensions_created();
@@ -17558,7 +17693,7 @@ var require_codegen_flow_helpers = __commonJS({
     }
     function getOutputPath() {
       const outputDir = process.env.OUTPUT_PATH || DEFAULT_OUTPUT_PATH;
-      return outputDir.startsWith("/") ? outputDir : path_1.default.join(process.cwd(), outputDir);
+      return outputDir.startsWith("/") ? outputDir : path_12.default.join(process.cwd(), outputDir);
     }
   }
 });
@@ -17570,12 +17705,12 @@ var require_inject_created_by = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.injectCreatedByIntoExtensionFiles = injectCreatedByIntoExtensionFiles;
     var promises_1 = require("fs/promises");
-    var path_1 = require("path");
+    var path_12 = require("path");
     var logger_12 = require_logger();
     var constants_1 = require_constants5();
     async function injectCreatedByIntoExtensionFiles(cwd, createdExtensions) {
       for (const { path: filePath } of createdExtensions) {
-        const absolutePath = (0, path_1.join)(cwd, filePath);
+        const absolutePath = (0, path_12.join)(cwd, filePath);
         try {
           const original = await (0, promises_1.readFile)(absolutePath, "utf-8");
           const injected = (0, constants_1.injectCreatedBy)(original);
@@ -23630,9 +23765,9 @@ var require_skills_installer = __commonJS({
     exports2.applySkillsOverride = applySkillsOverride;
     exports2.ensureSkillsReady = ensureSkillsReady;
     var fs_1 = require("fs");
-    var path_1 = require("path");
+    var path_12 = require("path");
     var ditto_codegen_types_12 = require_dist4();
-    var skills_override_1 = require_skills_override();
+    var skills_override_12 = require_skills_override();
     function hasSkills(dir) {
       return (0, fs_1.existsSync)(dir) && (0, fs_1.readdirSync)(dir).length > 0;
     }
@@ -23643,8 +23778,8 @@ var require_skills_installer = __commonJS({
         return;
       }
       try {
-        const overrides = (0, skills_override_1.parseSkillsOverrides)(skillsOverride);
-        await (0, skills_override_1.overrideSkills)(overrides, outputPath, log);
+        const overrides = (0, skills_override_12.parseSkillsOverrides)(skillsOverride);
+        await (0, skills_override_12.overrideSkills)(overrides, outputPath, log);
       } catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
         log.error("[Skills] Branch override failed", { error: errorMessage });
@@ -23655,13 +23790,13 @@ var require_skills_installer = __commonJS({
       }
     }
     async function ensureSkillsReady(outputPath, log, { timeoutMs = 6e4, intervalMs = 1e3 } = {}) {
-      const projectSkillsDir = (0, path_1.join)(outputPath, ".agents", "skills");
-      const skillsPresent = () => hasSkills(skills_override_1.SKILLS_DIR) || hasSkills(projectSkillsDir);
+      const projectSkillsDir = (0, path_12.join)(outputPath, ".agents", "skills");
+      const skillsPresent = () => hasSkills(skills_override_12.SKILLS_DIR) || hasSkills(projectSkillsDir);
       if (skillsPresent()) {
         return;
       }
       log.info("[Skills] Not present yet \u2014 waiting for the startup install", {
-        globalSkillsDir: skills_override_1.SKILLS_DIR,
+        globalSkillsDir: skills_override_12.SKILLS_DIR,
         projectSkillsDir,
         timeoutMs
       });
@@ -23674,7 +23809,7 @@ var require_skills_installer = __commonJS({
         }
       }
       log.error("[Skills] No skills available after waiting", {
-        globalSkillsDir: skills_override_1.SKILLS_DIR,
+        globalSkillsDir: skills_override_12.SKILLS_DIR,
         projectSkillsDir,
         environment: process.env.CODEGEN_ENVIRONMENT,
         timeoutMs
@@ -23692,17 +23827,17 @@ var require_tools_writer = __commonJS({
     exports2.writeToolFiles = writeToolFiles;
     var promises_1 = require("fs/promises");
     var os_1 = require("os");
-    var path_1 = require("path");
+    var path_12 = require("path");
     var logger_12 = require_logger();
-    var GLOBAL_TOOLS_DIR = (0, path_1.join)((0, os_1.homedir)(), ".config", "opencode", "tools");
-    var OPENCODE_TOOLS_DIR = (0, path_1.join)(__dirname, "opencode-tools");
+    var GLOBAL_TOOLS_DIR = (0, path_12.join)((0, os_1.homedir)(), ".config", "opencode", "tools");
+    var OPENCODE_TOOLS_DIR = (0, path_12.join)(__dirname, "opencode-tools");
     async function writeToolFiles(pluginTools = []) {
       await (0, promises_1.mkdir)(GLOBAL_TOOLS_DIR, { recursive: true });
       const entries = await (0, promises_1.readdir)(OPENCODE_TOOLS_DIR);
       const alwaysOnTools = entries.filter((f) => f.endsWith(".ts"));
       await Promise.all([
-        ...alwaysOnTools.map((file) => (0, promises_1.copyFile)((0, path_1.join)(OPENCODE_TOOLS_DIR, file), (0, path_1.join)(GLOBAL_TOOLS_DIR, file))),
-        ...pluginTools.map((tool) => (0, promises_1.writeFile)((0, path_1.join)(GLOBAL_TOOLS_DIR, tool.filename), tool.source, "utf-8"))
+        ...alwaysOnTools.map((file) => (0, promises_1.copyFile)((0, path_12.join)(OPENCODE_TOOLS_DIR, file), (0, path_12.join)(GLOBAL_TOOLS_DIR, file))),
+        ...pluginTools.map((tool) => (0, promises_1.writeFile)((0, path_12.join)(GLOBAL_TOOLS_DIR, tool.filename), tool.source, "utf-8"))
       ]);
       logger_12.logger.info("[OpenCode] Wrote global tool files", {
         targetDir: GLOBAL_TOOLS_DIR,
@@ -23713,20 +23848,266 @@ var require_tools_writer = __commonJS({
   }
 });
 
+// dist/opencode-integration/tool-policies.js
+var require_tool_policies3 = __commonJS({
+  "dist/opencode-integration/tool-policies.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.TOOL_POLICIES_PLUGIN_FILENAME = exports2.GENERATE_CMD_RE = void 0;
+    exports2.policyMatchesPath = policyMatchesPath;
+    exports2.skillRootOf = skillRootOf;
+    exports2.buildToolPoliciesPluginSource = buildToolPoliciesPluginSource;
+    exports2.writeToolPoliciesPlugin = writeToolPoliciesPlugin;
+    exports2.validateToolPolicies = validateToolPolicies;
+    var promises_1 = require("fs/promises");
+    var path_12 = require("path");
+    var ditto_codegen_types_12 = require_dist4();
+    var logger_12 = require_logger();
+    var generated_plugins_1 = require_generated_plugins();
+    var skills_override_12 = require_skills_override();
+    exports2.GENERATE_CMD_RE = /\bwix\s+(schema\s+)?generate\b/;
+    function policyMatchesPath(policy, path) {
+      return policy.pathFragments.some((fragment) => path.includes(fragment));
+    }
+    function skillRootOf(fragment) {
+      return fragment.split("/")[0];
+    }
+    exports2.TOOL_POLICIES_PLUGIN_FILENAME = "tool-policies.ts";
+    function buildToolPoliciesPluginSource(policies) {
+      const emitKind = (type, toRuntime, extraFilter = () => true) => JSON.stringify(policies.filter((policy) => policy.type === type).filter(extraFilter).map(toRuntime));
+      const emitReads = (mode) => emitKind("read", ({ pathFragments, message }) => ({ pathFragments, message }), (policy) => policy.mode === mode);
+      const generatePolicies = emitKind("generate", ({ blockedExtensionTypes, whenArgsInclude, message }) => ({
+        blockedExtensionTypes,
+        whenArgsInclude,
+        message
+      }));
+      const commandPrepends = emitKind("commandOutput", ({ commandFragments, message }) => ({
+        commandFragments,
+        message
+      }));
+      const skillPrepends = emitKind("skillContent", ({ skillNames, message }) => ({
+        skillNames,
+        message
+      }));
+      return `// Generated by @wix/ditto-codegen (tool-policies). Do not edit.
+const BLOCK_READS = ${emitReads("block")};
+const PREPEND_READS = ${emitReads("prepend")};
+const GENERATE_POLICIES = ${generatePolicies};
+const COMMAND_PREPENDS = ${commandPrepends};
+const SKILL_PREPENDS = ${skillPrepends};
+// Appended once after every prepend banner (see OVERRIDE_AUTHORITY_NOTE):
+// part of the override contract, so no policy can ship without it.
+const AUTHORITY_NOTE = ${JSON.stringify(ditto_codegen_types_12.OVERRIDE_AUTHORITY_NOTE)};
+const GENERATE_CMD_RE = /${exports2.GENERATE_CMD_RE.source}/;
+
+function extractReadPaths(tool, args) {
+  if (tool === "${"read"}") {
+    return typeof args.filePath === "string" ? [args.filePath] : [];
+  }
+  if (tool === "${"batch-read"}" && Array.isArray(args.paths)) {
+    return args.paths.filter((path) => typeof path === "string");
+  }
+  return [];
+}
+
+function matchingPolicies(policies, paths) {
+  return policies.filter((policy) =>
+    policy.pathFragments.some((fragment) =>
+      paths.some((path) => path.includes(fragment)),
+    ),
+  );
+}
+
+function generateArgsMatch(policy, haystack) {
+  return (
+    !policy.whenArgsInclude ||
+    policy.whenArgsInclude.some((fragment) => haystack.includes(fragment))
+  );
+}
+
+export const ToolPolicies = async () => ({
+  "tool.execute.before": async (input, output) => {
+    const args = output.args ?? {};
+    const blocked = matchingPolicies(
+      BLOCK_READS,
+      extractReadPaths(input.tool, args),
+    )[0];
+    if (blocked) throw new Error(blocked.message);
+
+    if (GENERATE_POLICIES.length === 0) return;
+    if (input.tool === "${"wix-generate"}" && Array.isArray(args.extensions)) {
+      for (const extension of args.extensions) {
+        const type = extension?.params?.extensionType;
+        if (typeof type !== "string") continue;
+        const params = JSON.stringify(extension.params);
+        for (const policy of GENERATE_POLICIES) {
+          if (
+            policy.blockedExtensionTypes.includes(type) &&
+            generateArgsMatch(policy, params)
+          ) {
+            throw new Error(policy.message);
+          }
+        }
+      }
+    }
+    if (
+      input.tool === "${"bash"}" &&
+      typeof args.command === "string" &&
+      GENERATE_CMD_RE.test(args.command)
+    ) {
+      for (const policy of GENERATE_POLICIES) {
+        if (
+          policy.blockedExtensionTypes.some((type) => args.command.includes(type)) &&
+          generateArgsMatch(policy, args.command)
+        ) {
+          throw new Error(policy.message);
+        }
+      }
+    }
+  },
+  "tool.execute.after": async (input, output) => {
+    if (typeof output.output !== "string") return;
+    const args = input.args ?? {};
+    const matched = matchingPolicies(
+      PREPEND_READS,
+      extractReadPaths(input.tool, args),
+    );
+    if (input.tool === "${"bash"}" && typeof args.command === "string") {
+      matched.push(
+        ...COMMAND_PREPENDS.filter((policy) =>
+          policy.commandFragments.every((fragment) => args.command.includes(fragment)),
+        ),
+      );
+    }
+    if (input.tool === "${"skill"}" && typeof args.name === "string") {
+      matched.push(
+        ...SKILL_PREPENDS.filter((policy) => policy.skillNames.includes(args.name)),
+      );
+    }
+    if (matched.length === 0) return;
+    output.output = [
+      ...matched.map((policy) => policy.message),
+      AUTHORITY_NOTE,
+      output.output,
+    ].join("\\n\\n");
+  },
+});
+`;
+    }
+    async function writeToolPoliciesPlugin(policies) {
+      await (0, generated_plugins_1.writeGeneratedPlugin)(exports2.TOOL_POLICIES_PLUGIN_FILENAME, buildToolPoliciesPluginSource(policies));
+    }
+    async function walkFiles(dir, depth = 6) {
+      if (depth === 0)
+        return [];
+      let entries;
+      try {
+        entries = await (0, promises_1.readdir)(dir, { withFileTypes: true });
+      } catch {
+        return [];
+      }
+      const nested = await Promise.all(entries.map(async (entry) => {
+        const full = (0, path_12.join)(dir, entry.name);
+        let isDirectory = entry.isDirectory();
+        let isFile = entry.isFile();
+        if (entry.isSymbolicLink()) {
+          try {
+            const stats = await (0, promises_1.stat)(full);
+            isDirectory = stats.isDirectory();
+            isFile = stats.isFile();
+          } catch {
+            return [];
+          }
+        }
+        if (isDirectory)
+          return walkFiles(full, depth - 1);
+        return isFile ? [full] : [];
+      }));
+      return nested.flat();
+    }
+    async function validateToolPolicies(policies, skillsDirs = [skills_override_12.SKILLS_DIR]) {
+      const reads = policies.filter((policy) => policy.type === "read");
+      const argChecks = policies.flatMap((policy) => policy.type === "generate" && policy.whenArgsInclude?.length && policy.driftSkill ? [{ skill: policy.driftSkill, argFragments: policy.whenArgsInclude }] : []);
+      const skillNames = policies.flatMap((policy) => policy.type === "skillContent" ? policy.skillNames : []);
+      if (reads.length === 0 && argChecks.length === 0 && skillNames.length === 0) {
+        return;
+      }
+      try {
+        const files = (await Promise.all(skillsDirs.map((dir) => walkFiles(dir)))).flat();
+        const fragments = reads.flatMap((policy) => policy.pathFragments.map((fragment) => ({ fragment, policy })));
+        const isInstalled = (root) => files.some((file) => file.includes(`/${root}/`));
+        const missingRoots = [
+          ...new Set([
+            ...fragments.map(({ fragment }) => skillRootOf(fragment)),
+            ...argChecks.map(({ skill }) => skill),
+            ...skillNames
+          ].filter((root) => !isInstalled(root)))
+        ];
+        if (missingRoots.length > 0) {
+          logger_12.logger.info("[ToolPolicies] Skill not installed (yet); skipping its drift check", { skills: missingRoots, skillsDirs });
+        }
+        const checkable = fragments.filter(({ fragment }) => isInstalled(skillRootOf(fragment)));
+        for (const { fragment, policy } of checkable) {
+          if (!files.some((file) => file.includes(fragment))) {
+            logger_12.logger.warn("[ToolPolicies] Path fragment matched no installed skill file (stale policy?)", { fragment, mode: policy.mode });
+          }
+        }
+        const docCache = /* @__PURE__ */ new Map();
+        const readDoc = (file) => {
+          let content = docCache.get(file);
+          if (!content) {
+            content = (0, promises_1.readFile)(file, "utf-8").catch(() => "");
+            docCache.set(file, content);
+          }
+          return content;
+        };
+        const argFragmentSweep = Promise.all(argChecks.filter(({ skill }) => isInstalled(skill)).map(async ({ skill, argFragments }) => {
+          const docs = files.filter((file) => file.endsWith(".md") && file.includes(`/${skill}/`));
+          const contents = await Promise.all(docs.map(readDoc));
+          for (const fragment of argFragments) {
+            if (!contents.some((content) => content.includes(fragment))) {
+              logger_12.logger.warn("[ToolPolicies] Generate arg fragment not found in the drift skill's docs (stale policy?)", { fragment, skill });
+            }
+          }
+        }));
+        const markers = reads.flatMap((policy) => policy.driftMarkers ?? []);
+        const markerSweep = (async () => {
+          if (markers.length === 0 || checkable.length === 0)
+            return;
+          const sweptRoots = [
+            ...new Set(checkable.map(({ fragment }) => skillRootOf(fragment)))
+          ];
+          const uncoveredDocs = files.filter((file) => file.endsWith(".md") && sweptRoots.some((root) => file.includes(`/${root}/`)) && !reads.some((policy) => policyMatchesPath(policy, file)));
+          await Promise.all(uncoveredDocs.map(async (file) => {
+            const content = await readDoc(file);
+            for (const marker of markers) {
+              if (content.includes(marker)) {
+                logger_12.logger.warn("[ToolPolicies] Drift marker found in a file no policy covers (content moved?)", { marker, file });
+              }
+            }
+          }));
+        })();
+        await Promise.all([argFragmentSweep, markerSweep]);
+      } catch (error) {
+        logger_12.logger.warn("[ToolPolicies] Validation failed; continuing", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+});
+
 // dist/opencode-integration/generated-files-guard.js
 var require_generated_files_guard = __commonJS({
   "dist/opencode-integration/generated-files-guard.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.GENERATED_FILES_GUARD_PLUGIN_PATH = exports2.GUARD_MESSAGE = void 0;
+    exports2.GUARD_MESSAGE = void 0;
     exports2.isEditorComponentManifest = isEditorComponentManifest;
     exports2.extractWritePaths = extractWritePaths;
     exports2.buildGeneratedFilesGuardSource = buildGeneratedFilesGuardSource;
     exports2.writeGeneratedFilesGuardPlugin = writeGeneratedFilesGuardPlugin;
-    var promises_1 = require("fs/promises");
-    var os_1 = require("os");
-    var path_1 = require("path");
-    var logger_12 = require_logger();
+    var generated_plugins_1 = require_generated_plugins();
     var ERC_MANIFEST_RE = /(^|\/)src\/extensions\/site\/components\/.+\.generated\.tsx?$/;
     exports2.GUARD_MESSAGE = "BLOCKED: *.generated.ts is an auto-generated manifest. Do not create or edit it by hand. It is derived from the component's React markup (*.tsx) and CSS module (*.module.css) and regenerated by running `npx wix build && npx wix generate manifest`. To change it, edit the *.tsx / *.module.css / *.props.ts source and regenerate; to override manifest values, edit the component's *.extension.ts. Do not retry this write.";
     function isEditorComponentManifest(path) {
@@ -23741,9 +24122,7 @@ var require_generated_files_guard = __commonJS({
         return [];
       return list.map((item) => item.path).filter((p) => typeof p === "string");
     }
-    var GLOBAL_PLUGIN_DIR = (0, path_1.join)((0, os_1.homedir)(), ".config", "opencode", "plugin");
     var GUARD_PLUGIN_FILENAME = "generated-files-guard.ts";
-    exports2.GENERATED_FILES_GUARD_PLUGIN_PATH = (0, path_1.join)(GLOBAL_PLUGIN_DIR, GUARD_PLUGIN_FILENAME);
     function buildGeneratedFilesGuardSource() {
       return `// Generated by @wix/ditto-codegen (generated-files-guard). Do not edit.
 const ERC_MANIFEST_RE = /${ERC_MANIFEST_RE.source}/;
@@ -23774,11 +24153,7 @@ export const GeneratedFilesGuard = async () => ({
 `;
     }
     async function writeGeneratedFilesGuardPlugin() {
-      await (0, promises_1.mkdir)(GLOBAL_PLUGIN_DIR, { recursive: true });
-      await (0, promises_1.writeFile)(exports2.GENERATED_FILES_GUARD_PLUGIN_PATH, buildGeneratedFilesGuardSource(), "utf-8");
-      logger_12.logger.info("[OpenCode] Wrote generated-files guard plugin", {
-        path: exports2.GENERATED_FILES_GUARD_PLUGIN_PATH
-      });
+      await (0, generated_plugins_1.writeGeneratedPlugin)(GUARD_PLUGIN_FILENAME, buildGeneratedFilesGuardSource());
     }
   }
 });
@@ -23815,6 +24190,7 @@ var require_plugin_artifacts = __commonJS({
     function collectPluginArtifacts(envConfig) {
       const rules = [];
       const tools = [];
+      const toolPolicies = [];
       const host = (0, plugin_host_12.buildPluginHost)();
       for (const factory of envConfig.plugins) {
         const plugin = factory({ host });
@@ -23822,8 +24198,10 @@ var require_plugin_artifacts = __commonJS({
           rules.push(...plugin.rules);
         if (plugin.tools)
           tools.push(...plugin.tools);
+        if (plugin.toolPolicies)
+          toolPolicies.push(...plugin.toolPolicies);
       }
-      return { rules, tools };
+      return { rules, tools, toolPolicies };
     }
   }
 });
@@ -23843,12 +24221,15 @@ var job_cancellation_monitor_1 = require_job_cancellation_monitor();
 var job_timeout_monitor_1 = require_job_timeout_monitor();
 var codeGenerationService_1 = require_codeGenerationService();
 var crypto_1 = require("crypto");
+var path_1 = require("path");
 var ditto_codegen_types_1 = require_dist4();
 var logger_1 = require_logger();
 var skills_installer_1 = require_skills_installer();
 var rules_writer_1 = require_rules_writer();
 var tools_writer_1 = require_tools_writer();
 var node_modules_guard_1 = require_node_modules_guard();
+var tool_policies_1 = require_tool_policies3();
+var skills_override_1 = require_skills_override();
 var generated_files_guard_1 = require_generated_files_guard();
 var subagent_tool_logger_1 = require_subagent_tool_logger();
 var plugin_artifacts_1 = require_plugin_artifacts();
@@ -23915,6 +24296,10 @@ var alwaysOnLoop = async () => {
 async function initOpenCode() {
   const envConfig = (0, environments_1.getCodegenEnvironmentConfig)();
   const pluginArtifacts = (0, plugin_artifacts_1.collectPluginArtifacts)(envConfig);
+  const toolPolicies = [
+    ...envConfig.toolPolicies ?? [],
+    ...pluginArtifacts.toolPolicies
+  ];
   await Promise.all([
     (0, rules_writer_1.writeRuleFiles)([
       ...envConfig.codegenRules,
@@ -23926,7 +24311,12 @@ async function initOpenCode() {
     (0, tools_writer_1.writeToolFiles)(pluginArtifacts.tools),
     (0, node_modules_guard_1.writeGuardPlugin)(),
     (0, generated_files_guard_1.writeGeneratedFilesGuardPlugin)(),
-    (0, subagent_tool_logger_1.writeSubagentToolLoggerPlugin)()
+    (0, subagent_tool_logger_1.writeSubagentToolLoggerPlugin)(),
+    (0, tool_policies_1.writeToolPoliciesPlugin)(toolPolicies)
+  ]);
+  void (0, tool_policies_1.validateToolPolicies)(toolPolicies, [
+    skills_override_1.SKILLS_DIR,
+    (0, path_1.join)((0, codegen_flow_helpers_1.getOutputPath)(), ".agents", "skills")
   ]);
 }
 async function main(ctx) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/ditto-codegen-public",
-  "version": "1.0.437",
+  "version": "1.0.438",
   "description": "AI-powered Wix CLI app generator - standalone executable",
   "scripts": {
     "build": "node build.mjs",
@@ -29,5 +29,5 @@
     "esbuild": "^0.27.2",
     "vitest": "^4.0.16"
   },
-  "falconPackageHash": "fa7b527ce78aed885889951926ab8c492e1b9f58e57ba82962990fbf"
+  "falconPackageHash": "505e7fd77b8402842416d269ee4d6800b6ad3e313ae5d985dfd48792"
 }