ai-ops-cli 1.5.0 → 1.5.1

package/data/context-layer/docs/agent/workflow.md

@@ -32,6 +32,14 @@ update_when:
 - project-owned 문서가 비어 있거나 stale하면 실제 코드, 설정, schema, runtime 파일을 우선한다.
 - 문서 상태가 애매하면 `docs/docs-status.md`와 각 문서 frontmatter를 함께 확인한다.
 
+## Reference-Backed Implementation
+
+reference 문서에 근거해 구현할 때는 문서의 핵심 제약을 먼저 검증 가능한 acceptance condition으로 바꾼다.
+
+- `must`, `required`, `top-level`, `cannot mix`, `does not compose` 같은 강제 제약은 그냥 읽고 넘어가지 않는다.
+- config, schema, parser, runtime이 직접 해석하는 구조와 permission, sandbox, credential, network, filesystem boundary는 테스트, fixture, smoke command, audit check 중 하나로 고정한다.
+- 문서의 중요한 문장을 테스트 이름으로 바꾼다.
+
 ## 보존 원칙
 
 - 사용자 변경으로 보이는 diff는 되돌리지 않는다.

package/dist/bin/index.js

@@ -1246,6 +1246,25 @@ var replaceOrAppendBlock = (content, start, end, block) => {
   const separator = content.trim().length > 0 && !content.endsWith("\n") ? "\n\n" : content.length > 0 ? "\n" : "";
   return `${content}${separator}${cleanBlock}`;
 };
+var insertBlockBeforeFirstTable = (content, block) => {
+  const cleanBlock = block.endsWith("\n") ? block : `${block}
+`;
+  if (content.trim().length === 0) {
+    return cleanBlock;
+  }
+  const lines = content.split("\n");
+  const firstTableIndex = lines.findIndex(
+    (line) => !line.trimStart().startsWith("#") && /^\s*\[[^\]]+\]\s*(?:#.*)?$/.test(line)
+  );
+  if (firstTableIndex < 0) {
+    const separator = content.endsWith("\n") ? "\n" : "\n\n";
+    return `${content}${separator}${cleanBlock}`;
+  }
+  const before = lines.slice(0, firstTableIndex).join("\n").trimEnd();
+  const after = lines.slice(firstTableIndex).join("\n").trimStart();
+  return `${[before, cleanBlock.trimEnd(), after].filter((section) => section.length > 0).join("\n\n")}
+`;
+};
 var quoteTomlString = (value) => JSON.stringify(value);
 var readActiveStringAssignment = (content, key) => {
   for (const line of content.split("\n")) {
@@ -1259,6 +1278,22 @@ var readActiveStringAssignment = (content, key) => {
   }
   return null;
 };
+var readTopLevelStringAssignment = (content, key) => {
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) {
+      continue;
+    }
+    if (/^\[[^\]]+\]\s*(?:#.*)?$/.test(trimmed)) {
+      return null;
+    }
+    const match = new RegExp(`^\\s*${key}\\s*=\\s*["']([^"']+)["']`).exec(line);
+    if (match) {
+      return match[1];
+    }
+  }
+  return null;
+};
 var hasActiveTable = (content, tableName) => {
   const tablePattern = new RegExp(`^\\s*\\[${escapeRegExp(tableName)}\\]\\s*(?:#.*)?$`);
   return content.split("\n").some((line) => !line.trimStart().startsWith("#") && tablePattern.test(line));
@@ -1450,7 +1485,7 @@ var cleanupLegacySandboxConfig = (content) => removeLegacyManagedSandboxWorkspac
 var editConfigForInstall = (content, paths) => {
   const withoutCurrentProfileBlock = stripBlock(content, PROFILE_BLOCK_START, PROFILE_BLOCK_END);
   const withoutLegacy = cleanupLegacySandboxConfig(withoutCurrentProfileBlock);
-  const activeDefaultPermissions = readActiveStringAssignment(withoutLegacy, "default_permissions");
+  const activeDefaultPermissions = readTopLevelStringAssignment(withoutLegacy, "default_permissions");
   if (readActiveStringAssignment(withoutLegacy, "sandbox_mode") || hasActiveTable(withoutLegacy, "sandbox_workspace_write")) {
     return {
       content,
@@ -1475,12 +1510,9 @@ var editConfigForInstall = (content, paths) => {
       conflict: CONFIG_CONFLICT_EXISTING_PROFILE
     };
   }
-  const nextContent = replaceOrAppendBlock(
-    withoutLegacy,
-    PROFILE_BLOCK_START,
-    PROFILE_BLOCK_END,
-    buildPermissionProfileBlock(paths, activeDefaultPermissions !== SAFE_LOCAL_CODEX_PERMISSION_NAME)
-  );
+  const shouldWriteDefaultPermissions = activeDefaultPermissions !== SAFE_LOCAL_CODEX_PERMISSION_NAME;
+  const profileBlock = buildPermissionProfileBlock(paths, shouldWriteDefaultPermissions);
+  const nextContent = shouldWriteDefaultPermissions ? insertBlockBeforeFirstTable(withoutLegacy, profileBlock) : replaceOrAppendBlock(withoutLegacy, PROFILE_BLOCK_START, PROFILE_BLOCK_END, profileBlock);
   return {
     content: nextContent,
     installed: true,