@wix/ditto-codegen-public 1.0.472 → 1.0.473

package/dist/out.js

@@ -14378,7 +14378,7 @@ var require_site = __commonJS({
   "../codegen-common-logic/dist/tool-policies/site.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.SITE_POLICIES = exports2.SITE_DATA_COLLECTION_GENERATE_POLICY = exports2.STORES_VERSIONING_POLICY = void 0;
+    exports2.SITE_POLICIES = exports2.SITE_PACKAGE_LOCK_POLICY = exports2.SITE_DATA_COLLECTION_GENERATE_POLICY = exports2.STORES_VERSIONING_POLICY = void 0;
     exports2.STORES_VERSIONING_POLICY = {
       type: "read",
       mode: "prepend",
@@ -14391,9 +14391,20 @@ var require_site = __commonJS({
       blockedExtensionTypes: ["DATA_COLLECTION"],
       message: `BLOCKED: DATA_COLLECTION extensions are not scaffolded in this environment. Invoke the wix-site-data-collection skill to create or change collections. Do not retry with wix generate.`
     };
+    exports2.SITE_PACKAGE_LOCK_POLICY = {
+      type: "commandBlock",
+      commandFragments: [
+        "--package-lock=false",
+        "--package-lock false",
+        "--no-package-lock",
+        "npm_config_package_lock=false"
+      ],
+      message: `BLOCKED: do not disable the package lockfile (--package-lock=false, --package-lock false, --no-package-lock). Run the install without it; if the packages are heavy, install them in several smaller commands (the sandbox has a memory limit).`
+    };
     exports2.SITE_POLICIES = [
       exports2.STORES_VERSIONING_POLICY,
-      exports2.SITE_DATA_COLLECTION_GENERATE_POLICY
+      exports2.SITE_DATA_COLLECTION_GENERATE_POLICY,
+      exports2.SITE_PACKAGE_LOCK_POLICY
     ];
   }
 });
@@ -14939,7 +14950,7 @@ ${environmentIdentity}`;
 - List any manual setup the user must still do for the feature to work, as short "next steps" (e.g. installing a dependent app or enabling a dashboard setting).
 - Be honest: if you didn't fully build what was asked (e.g. stored data but didn't send it), say so. Keep it short.`;
     function buildFileOperationsRules(multiEditContextClause) {
-      return `- Package dependencies \u2014 \`npm install <pkg>\` any package not already in \`package.json\` BEFORE the first \`validate\` (do NOT wait for \`TS2307\`); install all needed packages in ONE command. Do NOT hand-edit \`package.json\` for deps unless npm cannot be used.
+      return `- Package dependencies \u2014 \`npm install <pkg>\` any package not already in \`package.json\` BEFORE the first \`validate\` (do NOT wait for \`TS2307\`); install all needed packages in ONE command, except heavy ones: the sandbox has a memory limit and an install that exceeds it kills the machine and loses the whole run, so install those in several smaller commands. Do NOT hand-edit \`package.json\` for deps unless npm cannot be used. Never pass \`--package-lock=false\`.
 - File operations \u2014 pick the BATCH tool whenever you have 2+ files; the single-file variants are 5\u201310\xD7 slower:
   - \`batch-write\` to create N new files in one call. NEVER call \`write\` more than once per turn \u2014 use batch-write instead. \`write\` is reserved for single-file creation.
   - \`batch-read\` to read N files in one call. NEVER call \`read\` more than once per turn \u2014 use batch-read instead.
@@ -24082,6 +24093,7 @@ var require_tool_policies3 = __commonJS({
         commandFragments,
         message
       }));
+      const commandBlocks = emitKind("commandBlock", ({ commandFragments, message }) => ({ commandFragments, message }));
       const skillPrepends = emitKind("skillContent", ({ skillNames, message }) => ({
         skillNames,
         message
@@ -24091,6 +24103,7 @@ const BLOCK_READS = ${emitReads("block")};
 const PREPEND_READS = ${emitReads("prepend")};
 const GENERATE_POLICIES = ${generatePolicies};
 const COMMAND_PREPENDS = ${commandPrepends};
+const COMMAND_BLOCKS = ${commandBlocks};
 const SKILL_PREPENDS = ${skillPrepends};
 // Appended once after every prepend banner (see OVERRIDE_AUTHORITY_NOTE):
 // part of the override contract, so no policy can ship without it.
@@ -24131,6 +24144,14 @@ export const ToolPolicies = async () => ({
     )[0];
     if (blocked) throw new Error(blocked.message);
 
+    if (input.tool === "${"bash"}" && typeof args.command === "string") {
+      const command = args.command.replace(/\\s+/g, " ");
+      const blockedCommand = COMMAND_BLOCKS.find((policy) =>
+        policy.commandFragments.some((fragment) => command.includes(fragment)),
+      );
+      if (blockedCommand) throw new Error(blockedCommand.message);
+    }
+
     if (GENERATE_POLICIES.length === 0) return;
     if (input.tool === "${"wix-generate"}" && Array.isArray(args.extensions)) {
       for (const extension of args.extensions) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/ditto-codegen-public",
-  "version": "1.0.472",
+  "version": "1.0.473",
   "description": "AI-powered Wix CLI app generator - standalone executable",
   "scripts": {
     "build": "node build.mjs",
@@ -29,5 +29,5 @@
     "esbuild": "^0.27.2",
     "vitest": "^4.0.16"
   },
-  "falconPackageHash": "84b0cfe2378ce074540cb35f691a391df6b55997ff33fdcda28a5a8d"
+  "falconPackageHash": "d57aed781560712e54702652eaf61c531616393b40b98cca45a25e11"
 }