agency-lang 0.7.5 → 0.7.6

package/dist/lib/agents/agency-agent/agent.agency

@@ -1257,7 +1257,7 @@ node main() {
       policy: {
         type: "string",
         optional: true,
-        description: "Approval policy for this run: a built-in name (minimal, recommended, with-writes, with-bash) or a path to a policy JSON file. with-writes/with-bash auto-approve writes (and, for with-bash, shell) scoped to the current directory and its children. Overrides the saved policy without persisting it. Pass --policy with no value to list the built-in policies."
+        description: "Approval policy for this run: a built-in name (minimal, recommended, with-writes, approve-all) or a path to a policy JSON file. with-writes auto-approves file writes and git changes scoped to the current directory and its children; approve-all approves EVERY interrupt with no scoping (sandbox use only). Overrides the saved policy without persisting it. Pass --policy with no value to list the built-in policies."
       },
       local: {
         type: "string",

package/dist/lib/agents/agency-agent/agent.js

@@ -7354,7 +7354,7 @@ graph.node("main", async (__state) => {
               "policy": {
                 "type": `string`,
                 "optional": true,
-                "description": `Approval policy for this run: a built-in name (minimal, recommended, with-writes, with-bash) or a path to a policy JSON file. with-writes/with-bash auto-approve writes (and, for with-bash, shell) scoped to the current directory and its children. Overrides the saved policy without persisting it. Pass --policy with no value to list the built-in policies.`
+                "description": `Approval policy for this run: a built-in name (minimal, recommended, with-writes, approve-all) or a path to a policy JSON file. with-writes auto-approves file writes and git changes scoped to the current directory and its children; approve-all approves EVERY interrupt with no scoping (sandbox use only). Overrides the saved policy without persisting it. Pass --policy with no value to list the built-in policies.`
               },
               "local": {
                 "type": `string`,

package/dist/lib/agents/agency-agent/lib/defaultPolicy.agency

@@ -163,19 +163,18 @@ export def withWritesPolicy(baseDir: string) {
   }
 }
 
-// `with-writes` plus auto-approval of `std::bash`, scoped to `baseDir`
-// on the command's `cwd`. NOTE: a shell command can still reach outside
-// `baseDir` via an absolute path or `cd` inside the command string —
-// the policy matches the declared `cwd`, not the shell's actual effects,
-// so this is best-effort confinement, not a hard sandbox. It exists so
-// autonomous / sandbox runs (e.g. a benchmark container) can drive the
-// shell without a human answering every approval.
-export def withBashPolicy(baseDir: string) {
-  const scope = dirScope(baseDir)
-  return {
-    ...withWritesPolicy(baseDir),
-    "std::bash": [{ match: { cwd: scope }, action: "approve" }]
-  }
+// Approve EVERY interrupt — reads, writes, shell, git, anything, anywhere,
+// with no path scoping. The `"*"` wildcard is a catch-all that `checkPolicy`
+// consults for any effect without a more specific rule (see
+// lib/runtime/policy.ts). This is NOT confined in any way: it will approve
+// writes and shell commands outside the working directory, deletes, network
+// calls — everything. Use it ONLY in a disposable sandbox (e.g. a benchmark
+// container) where the whole environment is throwaway. `std::bash` cannot be
+// meaningfully confined to a directory anyway (a command can `cd` or use
+// absolute paths), so for autonomous sandbox runs a blanket approve-all is
+// both simpler and more honest than a best-effort per-effect scope.
+export static const approveAllPolicy = {
+  "*": [{ action: "approve" }]
 }
 
 // Built-in policies accepted by the `--policy` flag (anything else is
@@ -196,8 +195,8 @@ export static const BUILTIN_POLICIES = [
     description: "recommended + auto-approve file writes and git changes, scoped to the current directory and its children."
   },
   {
-    name: "with-bash",
-    description: "with-writes + auto-approve shell commands, scoped to the current directory. Best-effort confinement — use in disposable/sandbox runs."
+    name: "approve-all",
+    description: "Approve EVERY interrupt — reads, writes, shell, git, anywhere, no scoping. UNSAFE outside a disposable sandbox."
   },
 ]
 
@@ -221,8 +220,8 @@ export def builtinPolicy(name: string, baseDir: string) {
   if (name == "with-writes") {
     return withWritesPolicy(baseDir)
   }
-  if (name == "with-bash") {
-    return withBashPolicy(baseDir)
+  if (name == "approve-all") {
+    return approveAllPolicy
   }
   return null
 }

package/dist/lib/agents/agency-agent/lib/defaultPolicy.js

@@ -164,6 +164,7 @@ let __staticInitPromise = null;
 let AGENCY_SAFE_SUBCOMMANDS = __UNINIT_STATIC;
 let minimalAutoApprovePolicy = __UNINIT_STATIC;
 let recommendedAutoApprovePolicy = __UNINIT_STATIC;
+let approveAllPolicy = __UNINIT_STATIC;
 let BUILTIN_POLICIES = __UNINIT_STATIC;
 async function __initializeStatic(__ctx) {
   if (__staticInitPromise) {
@@ -264,6 +265,11 @@ async function __initializeStatic(__ctx) {
         "action": `approve`
       }]
     });
+    approveAllPolicy = __deepFreeze({
+      "*": [{
+        "action": `approve`
+      }]
+    });
     BUILTIN_POLICIES = __deepFreeze([{
       "name": `recommended`,
       "description": `Auto-approve reads and web/search; prompt for writes, shell, and git changes. (Default.)`
@@ -274,8 +280,8 @@ async function __initializeStatic(__ctx) {
       "name": `with-writes`,
       "description": `recommended + auto-approve file writes and git changes, scoped to the current directory and its children.`
     }, {
-      "name": `with-bash`,
-      "description": `with-writes + auto-approve shell commands, scoped to the current directory. Best-effort confinement \u2014 use in disposable/sandbox runs.`
+      "name": `approve-all`,
+      "description": `Approve EVERY interrupt \u2014 reads, writes, shell, git, anywhere, no scoping. UNSAFE outside a disposable sandbox.`
     }]);
   })();
   return __staticInitPromise;
@@ -285,6 +291,7 @@ function __getStaticVars() {
     AGENCY_SAFE_SUBCOMMANDS,
     minimalAutoApprovePolicy,
     recommendedAutoApprovePolicy,
+    approveAllPolicy,
     BUILTIN_POLICIES
   };
 }
@@ -728,144 +735,6 @@ const withWritesPolicy = __AgencyFunction.create({
   safe: false,
   exported: true
 }, __toolRegistry);
-async function __withBashPolicy_impl(baseDir) {
-  const __setupData = setupFunction();
-  const __stack = __setupData.stack;
-  const __step = __setupData.step;
-  const __self = __setupData.self;
-  const __ctx = getRuntimeContext().ctx;
-  let __forked;
-  let __functionCompleted = false;
-  if (!__globals().isInitialized("dist/lib/agents/agency-agent/lib/defaultPolicy.agency")) {
-    await __initializeGlobals(__ctx);
-  }
-  let __funcStartTime = performance.now();
-  __stack.args["baseDir"] = baseDir;
-  __self.__retryable = __self.__retryable ?? true;
-  const runner = new Runner(__ctx, __stack, { state: __stack, moduleId: "dist/lib/agents/agency-agent/lib/defaultPolicy.agency", scopeName: "withBashPolicy", threads: __setupData.threads });
-  let __resultCheckpointId = -1;
-  if (__ctx._pendingArgOverrides) {
-    const __overrides = __ctx._pendingArgOverrides;
-    __ctx._pendingArgOverrides = void 0;
-    if ("baseDir" in __overrides) {
-      baseDir = __overrides["baseDir"];
-      __stack.args["baseDir"] = baseDir;
-    }
-  }
-  try {
-    await agencyStore.run({
-      ...getRuntimeContext(),
-      ctx: __ctx,
-      stack: __setupData.stateStack,
-      threads: __setupData.threads
-    }, async () => {
-      await runner.hook(0, async () => {
-        await callHook({
-          name: "onFunctionStart",
-          data: {
-            functionName: "withBashPolicy",
-            args: {
-              baseDir
-            },
-            moduleId: "dist/lib/agents/agency-agent/lib/defaultPolicy.agency"
-          }
-        });
-      });
-      await runner.step(1, async (runner2) => {
-        __stack.locals.scope = await __call(dirScope, {
-          type: "positional",
-          args: [__stack.args.baseDir]
-        });
-        if (hasInterrupts(__stack.locals.scope)) {
-          await getRuntimeContext().ctx.pendingPromises.awaitAll();
-          runner2.halt(__stack.locals.scope);
-          return;
-        }
-      });
-      await runner.step(2, async (runner2) => {
-        __functionCompleted = true;
-        runner2.halt({
-          ...await __call(withWritesPolicy, {
-            type: "positional",
-            args: [__stack.args.baseDir]
-          }),
-          "std::bash": [{
-            "match": {
-              "cwd": __stack.locals.scope
-            },
-            "action": `approve`
-          }]
-        });
-        return;
-      });
-    });
-    if (runner.halted) {
-      if (isFailure(runner.haltResult)) {
-        runner.haltResult.retryable = runner.haltResult.retryable && __self.__retryable;
-      }
-      return runner.haltResult;
-    }
-  } catch (__error) {
-    if (__error instanceof RestoreSignal) {
-      throw __error;
-    }
-    if (__error instanceof AgencyAbort) {
-      throw __error;
-    }
-    {
-      const __errMsg = __error instanceof Error ? __error.message : String(__error);
-      const __errStack = __error instanceof Error && __error.stack ? __error.stack : "";
-      const __log = __createLogger(__ctx.logLevel);
-      __log.error("Function withBashPolicy threw an exception (converted to Failure): " + __errMsg);
-      if (__errStack) __log.error(__errStack);
-      __ctx.statelogClient?.error?.({
-        errorType: "runtimeError",
-        message: __errMsg,
-        functionName: "withBashPolicy",
-        retryable: __self.__retryable
-      });
-    }
-    return failure(
-      __error instanceof Error ? __error.message : String(__error),
-      {
-        checkpoint: getRuntimeContext().ctx.getResultCheckpoint(),
-        retryable: __self.__retryable,
-        functionName: "withBashPolicy",
-        args: __stack.args
-      }
-    );
-  } finally {
-    __stateStack()?.pop();
-    if (__functionCompleted) {
-      await callHook({
-        name: "onFunctionEnd",
-        data: {
-          functionName: "withBashPolicy",
-          timeTaken: performance.now() - __funcStartTime
-        }
-      });
-    }
-  }
-}
-const withBashPolicy = __AgencyFunction.create({
-  name: "withBashPolicy",
-  module: "dist/lib/agents/agency-agent/lib/defaultPolicy.agency",
-  fn: __withBashPolicy_impl,
-  params: [{
-    name: "baseDir",
-    hasDefault: false,
-    defaultValue: void 0,
-    variadic: false,
-    isFunctionTyped: false
-  }],
-  toolDefinition: {
-    name: "withBashPolicy",
-    description: "No description provided.",
-    schema: z.object({ "baseDir": z.string() })
-  },
-  safe: false,
-  exported: true
-}, __toolRegistry);
 async function __builtinPolicyNames_impl() {
   const __setupData = setupFunction();
   const __stack = __setupData.stack;
@@ -1081,14 +950,11 @@ async function __builtinPolicy_impl(name, baseDir) {
       ]);
       await runner.ifElse(4, [
         {
-          condition: async () => __eq(__stack.args.name, `with-bash`),
+          condition: async () => __eq(__stack.args.name, `approve-all`),
           body: async (runner2) => {
             await runner2.step(0, async (runner3) => {
               __functionCompleted = true;
-              runner3.halt(await __call(withBashPolicy, {
-                type: "positional",
-                args: [__stack.args.baseDir]
-              }));
+              runner3.halt(__readStatic(approveAllPolicy, "approveAllPolicy", "dist/lib/agents/agency-agent/lib/defaultPolicy.agency"));
               return;
             });
           }
@@ -1174,7 +1040,7 @@ const builtinPolicy = __AgencyFunction.create({
   exported: true
 }, __toolRegistry);
 var stdin_default = graph;
-const __sourceMap = { "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:agencyExecApproveRules": { "1": { "line": 20, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:__block_0": { "1.0": { "line": 21, "col": 4 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:dirScope": { "1": { "line": 130, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:withWritesPolicy": { "1": { "line": 141, "col": 2 }, "2": { "line": 142, "col": 2 }, "3": { "line": 143, "col": 2 }, "4": { "line": 144, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:withBashPolicy": { "1": { "line": 173, "col": 2 }, "2": { "line": 174, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:builtinPolicyNames": { "1": { "line": 205, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:__block_1": { "1.0": { "line": 206, "col": 4 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:builtinPolicy": { "1": { "line": 214, "col": 2 }, "2": { "line": 217, "col": 2 }, "3": { "line": 220, "col": 2 }, "4": { "line": 223, "col": 2 }, "5": { "line": 226, "col": 2 }, "1.0": { "line": 215, "col": 4 }, "2.0": { "line": 218, "col": 4 }, "3.0": { "line": 221, "col": 4 }, "4.0": { "line": 224, "col": 4 } } };
+const __sourceMap = { "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:agencyExecApproveRules": { "1": { "line": 20, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:__block_0": { "1.0": { "line": 21, "col": 4 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:dirScope": { "1": { "line": 130, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:withWritesPolicy": { "1": { "line": 141, "col": 2 }, "2": { "line": 142, "col": 2 }, "3": { "line": 143, "col": 2 }, "4": { "line": 144, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:builtinPolicyNames": { "1": { "line": 204, "col": 2 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:__block_1": { "1.0": { "line": 205, "col": 4 } }, "dist/lib/agents/agency-agent/lib/defaultPolicy.agency:builtinPolicy": { "1": { "line": 213, "col": 2 }, "2": { "line": 216, "col": 2 }, "3": { "line": 219, "col": 2 }, "4": { "line": 222, "col": 2 }, "5": { "line": 225, "col": 2 }, "1.0": { "line": 214, "col": 4 }, "2.0": { "line": 217, "col": 4 }, "3.0": { "line": 220, "col": 4 }, "4.0": { "line": 223, "col": 4 } } };
 export {
   BUILTIN_POLICIES,
   __getCheckpoints,
@@ -1186,6 +1052,7 @@ export {
   __toolRegistry,
   agencyExecApproveRules,
   approve,
+  approveAllPolicy,
   builtinPolicy,
   builtinPolicyNames,
   stdin_default as default,
@@ -1199,6 +1066,5 @@ export {
   reject,
   respondToInterrupts,
   rewindFrom,
-  withBashPolicy,
   withWritesPolicy
 };

package/dist/lib/runtime/policy.js

@@ -6,13 +6,25 @@ export const PolicyRuleSchema = z.object({
 });
 export const PolicySchema = z.record(z.string(), z.array(PolicyRuleSchema));
 export function checkPolicy(policy, interrupt) {
+    // Effect-specific rules take precedence over the wildcard.
     const rules = policy[interrupt.effect];
-    if (!rules) {
-        return { type: "propagate" };
+    if (rules) {
+        for (const rule of rules) {
+            if (matchesRule(rule, interrupt)) {
+                return { type: rule.action };
+            }
+        }
     }
-    for (const rule of rules) {
-        if (matchesRule(rule, interrupt)) {
-            return { type: rule.action };
+    // Wildcard catch-all: the `"*"` effect key applies to any interrupt whose
+    // own effect had no matching rule. This is how an "approve-all" policy
+    // covers effects it doesn't enumerate (a plain per-effect map would
+    // `propagate` — i.e. prompt — on anything unlisted).
+    const wildcard = policy["*"];
+    if (wildcard) {
+        for (const rule of wildcard) {
+            if (matchesRule(rule, interrupt)) {
+                return { type: rule.action };
+            }
         }
     }
     return { type: "propagate" };

package/dist/lib/runtime/policy.test.js

@@ -111,6 +111,45 @@ describe("checkPolicy", () => {
         const result = checkPolicy(policy, { effect: "test::x", message: "", data: {}, origin: "" });
         expect(result).toEqual({ type: "reject" });
     });
+    describe('"*" wildcard catch-all', () => {
+        it("approve-all: applies to every effect, including unlisted ones", () => {
+            const policy = { "*": [{ action: "approve" }] };
+            for (const effect of ["std::write", "std::bash", "std::remove", "anything::else"]) {
+                expect(checkPolicy(policy, { effect, message: "", data: { dir: "/etc" }, origin: "" }))
+                    .toEqual({ type: "approve" });
+            }
+        });
+        it("effect-specific rules take precedence over the wildcard", () => {
+            const policy = {
+                "std::bash": [{ action: "reject" }],
+                "*": [{ action: "approve" }],
+            };
+            expect(checkPolicy(policy, { effect: "std::bash", message: "", data: {}, origin: "" }))
+                .toEqual({ type: "reject" });
+            // An effect with no specific rule falls through to the wildcard.
+            expect(checkPolicy(policy, { effect: "std::write", message: "", data: {}, origin: "" }))
+                .toEqual({ type: "approve" });
+        });
+        it("falls back to the wildcard when a specific effect's rules all miss", () => {
+            const policy = {
+                "std::write": [{ match: { dir: "/app/**" }, action: "approve" }],
+                "*": [{ action: "reject" }],
+            };
+            // Inside /app: matched by the specific rule.
+            expect(checkPolicy(policy, { effect: "std::write", message: "", data: { dir: "/app/x" }, origin: "" }))
+                .toEqual({ type: "approve" });
+            // Outside /app: the specific rule misses, so the wildcard rejects.
+            expect(checkPolicy(policy, { effect: "std::write", message: "", data: { dir: "/etc/x" }, origin: "" }))
+                .toEqual({ type: "reject" });
+        });
+        it("still propagates when neither the effect nor the wildcard matches", () => {
+            const policy = {
+                "*": [{ match: { dir: "/app/**" }, action: "approve" }],
+            };
+            expect(checkPolicy(policy, { effect: "std::write", message: "", data: { dir: "/etc/x" }, origin: "" }))
+                .toEqual({ type: "propagate" });
+        });
+    });
     describe("./ prefix normalization (picomatch workaround)", () => {
         // picomatch.isMatch returns false for patterns starting with `./`
         // when combined with `**` or brace expansions — e.g.

package/dist/lib/stdlib/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.7.5";
+export declare const VERSION = "0.7.6";

package/dist/lib/stdlib/version.js

@@ -1 +1 @@
-export const VERSION = "0.7.5";
+export const VERSION = "0.7.6";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agency-lang",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "The Agency language",
   "main": "lib/index.js",
   "bin": {