agency-lang 0.7.0 → 0.7.2

package/dist/lib/agents/agency-agent/lib/attachments.js

@@ -269,7 +269,7 @@ async function __detectAttachments_impl(msg, maxBytes = __UNSET) {
       await runner.step(3, async (runner2) => {
         __stack.locals.seen = [];
       });
-      await runner.loop(4, await __call(_scanMediaPaths, {
+      await runner.loop(4, async () => await __call(_scanMediaPaths, {
         type: "positional",
         args: [__stack.args.msg]
       }), async (candidate, _, runner2) => {
@@ -641,7 +641,7 @@ async function __modalityFilter_impl(detected) {
       await runner.step(9, async (runner2) => {
         __stack.locals.skipped = [...__stack.args.detected.skipped];
       });
-      await runner.loop(10, __stack.args.detected.attached, async (item, _, runner2) => {
+      await runner.loop(10, async () => __stack.args.detected.attached, async (item, _, runner2) => {
         await runner2.step(0, async (runner3) => {
           __stack.locals.noImageInput = __eq(item.attachment.type, `image`) && __eq(__stack.locals.imageOk, false);
         });

package/dist/lib/agents/agency-agent/lib/config.agency

@@ -7,6 +7,11 @@ export static const POLICY_FILE = "policy.json"
 export static const HISTORY_FILE = "history"
 export static const POLICY_DIR = path.join(os.homedir(), ".agency-agent")
 export static const POLICY_PATH = path.join(POLICY_DIR, POLICY_FILE)
+// A --policy built-in is materialized here (not to POLICY_PATH) so a
+// one-off override never clobbers the user's saved policy, and a
+// cwd-scoped built-in can't leak into a later run from another directory.
+export static const SESSION_POLICY_FILE = "session-policy.json"
+export static const SESSION_POLICY_PATH = path.join(POLICY_DIR, SESSION_POLICY_FILE)
 export static const HISTORY_PATH = path.join(POLICY_DIR, HISTORY_FILE)
 export static const SETTINGS_FILE = "settings.json"
 export static const SETTINGS_PATH = path.join(POLICY_DIR, SETTINGS_FILE)

package/dist/lib/agents/agency-agent/lib/config.js

@@ -153,6 +153,8 @@ let POLICY_FILE = __UNINIT_STATIC;
 let HISTORY_FILE = __UNINIT_STATIC;
 let POLICY_DIR = __UNINIT_STATIC;
 let POLICY_PATH = __UNINIT_STATIC;
+let SESSION_POLICY_FILE = __UNINIT_STATIC;
+let SESSION_POLICY_PATH = __UNINIT_STATIC;
 let HISTORY_PATH = __UNINIT_STATIC;
 let SETTINGS_FILE = __UNINIT_STATIC;
 let SETTINGS_PATH = __UNINIT_STATIC;
@@ -176,6 +178,11 @@ async function __initializeStatic(__ctx) {
       type: "positional",
       args: [__readStatic(POLICY_DIR, "POLICY_DIR", "dist/lib/agents/agency-agent/lib/config.agency"), __readStatic(POLICY_FILE, "POLICY_FILE", "dist/lib/agents/agency-agent/lib/config.agency")]
     }));
+    SESSION_POLICY_FILE = __deepFreeze(`session-policy.json`);
+    SESSION_POLICY_PATH = __deepFreeze(await __callMethod(path, "join", {
+      type: "positional",
+      args: [__readStatic(POLICY_DIR, "POLICY_DIR", "dist/lib/agents/agency-agent/lib/config.agency"), __readStatic(SESSION_POLICY_FILE, "SESSION_POLICY_FILE", "dist/lib/agents/agency-agent/lib/config.agency")]
+    }));
     HISTORY_PATH = __deepFreeze(await __callMethod(path, "join", {
       type: "positional",
       args: [__readStatic(POLICY_DIR, "POLICY_DIR", "dist/lib/agents/agency-agent/lib/config.agency"), __readStatic(HISTORY_FILE, "HISTORY_FILE", "dist/lib/agents/agency-agent/lib/config.agency")]
@@ -242,6 +249,8 @@ function __getStaticVars() {
     HISTORY_FILE,
     POLICY_DIR,
     POLICY_PATH,
+    SESSION_POLICY_FILE,
+    SESSION_POLICY_PATH,
     HISTORY_PATH,
     SETTINGS_FILE,
     SETTINGS_PATH,
@@ -272,6 +281,8 @@ export {
   POLICY_DIR,
   POLICY_FILE,
   POLICY_PATH,
+  SESSION_POLICY_FILE,
+  SESSION_POLICY_PATH,
   SETTINGS_FILE,
   SETTINGS_PATH,
   __getCheckpoints,

package/dist/lib/agents/agency-agent/lib/defaultPolicy.agency

@@ -120,3 +120,109 @@ export static const recommendedAutoApprovePolicy = {
     action: "approve"
   }]
 }
+
+// Glob that matches a directory and everything under it. This is the
+// same convention `std::policy`'s `buildScopedMatch` uses for the
+// interactive "approve-always-here" rule: the exact path OR any nested
+// path. `baseDir` must be absolute (the agent pins it to the launch cwd
+// via `setAgentCwd(cwd())`), so relative paths the model passes resolve
+// into this range and outside paths fall through to prompting.
+def dirScope(baseDir: string): string {
+  return "{${baseDir},${baseDir}/**}"
+}
+
+// `recommended` plus auto-approval of the mutating file-system and
+// git-write effects, each scoped to `baseDir` and its children; anything
+// outside still prompts. Matched on each effect's path field: `dir`
+// (write/edit/mkdir), `target` (remove), `src`+`dest` (copy/move), `cwd`
+// (git). Confinement is real: write/edit run `filename` through
+// `resolvePath` (rejects `..`/absolute/`~`/symlink) and the scope glob
+// won't match a `..`-containing path.
+export def withWritesPolicy(baseDir: string) {
+  const scope = dirScope(baseDir)
+  const dirRule = [{ match: { dir: scope }, action: "approve" }]
+  const cwdRule = [{ match: { cwd: scope }, action: "approve" }]
+  return {
+    ...recommendedAutoApprovePolicy,
+    "std::write": dirRule,
+    "std::writeBinary": dirRule,
+    "std::edit": dirRule,
+    "std::mkdir": dirRule,
+    "std::remove": [{ match: { target: scope }, action: "approve" }],
+    "std::copy": [{ match: { src: scope, dest: scope }, action: "approve" }],
+    "std::move": [{ match: { src: scope, dest: scope }, action: "approve" }],
+    "std::git::add": cwdRule,
+    "std::git::commit": cwdRule,
+    "std::git::checkout": cwdRule,
+    "std::git::switch": cwdRule,
+    "std::git::branchCreate": cwdRule,
+    "std::git::branchDelete": cwdRule,
+    "std::git::stashPush": cwdRule,
+    "std::git::stashPop": cwdRule,
+    "std::git::restore": cwdRule
+  }
+}
+
+// `with-writes` plus auto-approval of `std::bash`, scoped to `baseDir`
+// on the command's `cwd`. NOTE: a shell command can still reach outside
+// `baseDir` via an absolute path or `cd` inside the command string —
+// the policy matches the declared `cwd`, not the shell's actual effects,
+// so this is best-effort confinement, not a hard sandbox. It exists so
+// autonomous / sandbox runs (e.g. a benchmark container) can drive the
+// shell without a human answering every approval.
+export def withBashPolicy(baseDir: string) {
+  const scope = dirScope(baseDir)
+  return {
+    ...withWritesPolicy(baseDir),
+    "std::bash": [{ match: { cwd: scope }, action: "approve" }]
+  }
+}
+
+// Built-in policies accepted by the `--policy` flag (anything else is
+// treated as a path to a policy JSON file), in display order with a
+// one-line description each. Single source of truth for the flag's help
+// text and its unknown-value error.
+export static const BUILTIN_POLICIES = [
+  {
+    name: "recommended",
+    description: "Auto-approve reads and web/search; prompt for writes, shell, and git changes. (Default.)"
+  },
+  {
+    name: "minimal",
+    description: "Auto-approve only memory and the safe read-only agency subcommands; prompt for everything else."
+  },
+  {
+    name: "with-writes",
+    description: "recommended + auto-approve file writes and git changes, scoped to the current directory and its children."
+  },
+  {
+    name: "with-bash",
+    description: "with-writes + auto-approve shell commands, scoped to the current directory. Best-effort confinement — use in disposable/sandbox runs."
+  },
+]
+
+// Just the built-in names, e.g. for the unknown-value error message.
+export def builtinPolicyNames(): string[] {
+  return map(BUILTIN_POLICIES) as p {
+    return p.name
+  }
+}
+
+// Resolve a built-in policy name to a concrete `Policy`, scoping the
+// cwd-relative variants to `baseDir`. Returns null for an unknown name
+// so the caller can fall back to treating the argument as a file path.
+export def builtinPolicy(name: string, baseDir: string) {
+  if (name == "minimal") {
+    return minimalAutoApprovePolicy
+  }
+  if (name == "recommended") {
+    return recommendedAutoApprovePolicy
+  }
+  if (name == "with-writes") {
+    return withWritesPolicy(baseDir)
+  }
+  if (name == "with-bash") {
+    return withBashPolicy(baseDir)
+  }
+  return null
+}