gcf-aif-ext 0.7.4 → 0.7.6

package/README.md

@@ -50,9 +50,15 @@ Updating preserves `gcf/`, `cnlp.config.json` and the pre-commit hook. Run `ai-f
 
 On Windows, run `extension add` and `extension update` from PowerShell or cmd, not Git Bash: the installer unpacks with `tar`, and Git Bash's GNU tar reads `C:\…` as a remote host (`Cannot connect to C: resolve failed`). The Windows `tar.exe` handles it.
 
+### 0.7.6
+
+- `ai-factory gcf permissions [--on <group>] [--off <group>] [--deny <rule>] [--undeny <rule>]` — what agent runs may not do: deny groups and the human's own rules in the `agent:` section of `gcf/config.yml`, one `gcf(permissions)` commit; with no change it lists them. On by default: `git-destroy`, `mass-delete`, `publish`, `human-moves`, `guards`; off: `secrets`, `outside`, `processes`. `agent.groups` keeps only the human's choices (`secrets: true`): a group it does not name keeps its default, so one a later version adds comes on. `git push` is in none. `gcf board --json` carries `agent` (`groups`, `deny_extra`, the resolved `deny`, `allow`).
+- New `config.yml` keys for harness runs: `context_handoff_pct` (60; 0 turns the handoff off), `context_window` (0: the model's) and `auto_compact_pct` (0: the agent's default; at least the handoff share + 15). `gcf board --json` carries them as `context`; a kept session that handed over reads `resume: {ended: 'handoff', handoffs}`.
+- The AGENTS.md block tells the agent that the permissions are the human's.
+
 ### 0.7.1
 
-- `gcf board --json`: a ready item's worktree with no run lock and no session mark is a run that stopped (a timeout, a stop, a crash), not a run: the item reads `running: false`, `resumable: true`, and keeps its moves; its next run resumes the worktree.
+- `gcf board --json`: a ready item's worktree with no run lock and no session mark is a run that stopped (a timeout, a stop, a crash), not a run: the item reads `running: false`, `resumable: true`, and keeps its moves; its next run resumes the worktree. An agent session the harness kept (`.gcf-session/runs/<id>.agent.json`) makes a ready item `resumable` too, in either run mode, and shows as `resume: {ended, resets?}` (null without one).
 
 ### 0.7.0
 

package/commands/gcf.js

@@ -977,6 +977,31 @@ function registerBoard(gcf) {
         ].join('\n'),
       );
     });
+  const many = (v, prev = []) => [...prev, v];
+  gcf
+    .command('permissions')
+    .description("What agent runs may not do: deny groups and custom rules (the human's; commit)")
+    .option('--on <group>', 'turn a deny group on (repeatable)', many)
+    .option('--off <group>', 'turn a deny group off (repeatable)', many)
+    .option('--deny <rule>', 'add a custom deny rule, like Bash(cmd*) (repeatable)', many)
+    .option('--undeny <rule>', 'remove a custom deny rule (repeatable)', many)
+    .option('--json', 'machine output')
+    .option('--no-commit', 'skip the commit (tests only)')
+    .action(async (o) => {
+      const perms = await lib('agent-permissions');
+      const { gcfRoot, readConfig } = await lib('gcf-paths');
+      const change = [o.on, o.off, o.deny, o.undeny].some(Boolean);
+      const r = change
+        ? await perms.setPermissions(process.cwd(), o, { commit: o.commit })
+        : perms.agentOf(await readConfig(gcfRoot()));
+      out(o.json, r, (x) =>
+        [
+          ...x.groups.map((g) => `${g.on ? '[x]' : '[ ]'} ${g.id}: ${g.label}`),
+          ...x.deny_extra.map((d) => `deny: ${d}`),
+          ...(x.hash ? [`committed${shortHash(x.hash)}`] : []),
+        ].join('\n'),
+      );
+    });
 }
 
 function registerIntegrate(gcf) {

package/extension.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/lee-to/ai-factory/2.x/schemas/extension.schema.json",
   "name": "gcf-aif-ext",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Game Context Framework for AI Factory",
   "skills": [
     "skills/gcf-init",

package/lib/agent-permissions.js

@@ -0,0 +1,243 @@
+// What a headless agent run may not do (Harness-PRD §7). The run allows everything else
+// (`--permission-mode bypassPermissions`): a deny rule holds in every mode. The groups guard
+// the edge cases only — what git cannot undo, what leaves the machine, the human's own moves
+// and the guards themselves. `git push` is not one of them: a feature ends tested and pushed.
+// Deny rules match the command as written, so they catch accidents, not a determined
+// rewording; the gcf-run skill makes a refusal a stop.
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import YAML from 'yaml';
+import { commitMove } from './unit-ops.js';
+import { atomicWrite } from './safe-path.js';
+import { gcfRoot } from './gcf-paths.js';
+
+// A shell command pattern turns into a rule for both shell tools: on Windows the agent runs
+// commands through PowerShell, which Bash rules do not cover.
+const shell = (...patterns) => patterns.flatMap((p) => [`Bash(${p})`, `PowerShell(${p})`]);
+const files = (tools, ...globs) => globs.flatMap((g) => tools.map((t) => `${t}(${g})`));
+
+/** @type {{ id: string, label: string, on: boolean, rules: string[] }[]} */
+export const DENY_GROUPS = [
+  {
+    id: 'git-destroy',
+    label: 'git history and uncommitted work: reset --hard, clean, stash, force push',
+    on: true,
+    rules: shell(
+      'git reset --hard*',
+      'git clean*',
+      'git stash*',
+      'git branch -D*',
+      'git filter-branch*',
+      'git update-ref -d*',
+      'git push*--force*',
+      'git push -f*',
+      'git push -uf*',
+      'git push * -f',
+      'git push * -f *',
+      'git push *+*',
+      'git push*--mirror*',
+      'git push*--delete*',
+      'git checkout .',
+      'git checkout -- .',
+      'git restore .',
+      'git restore -- .',
+    ),
+  },
+  {
+    id: 'mass-delete',
+    label: 'recursive delete: rm -r, Remove-Item -Recurse, rd /s',
+    on: true,
+    rules: shell(
+      'rm -r*',
+      'rm -R*',
+      'rm -fr*',
+      'rm -fR*',
+      'rm -f -r*',
+      'rm --recursive*',
+      'Remove-Item*-Recurse*',
+      'Remove-Item* -r',
+      'Remove-Item* -r *',
+      'rmdir /s*',
+      'rd /s*',
+      'del /s*',
+      'cmd /c rd /s*',
+      'cmd /c rmdir /s*',
+      'cmd /c del /s*',
+    ),
+  },
+  {
+    id: 'publish',
+    label: 'publishing: npm publish, stage, unpublish, deprecate; docker push',
+    on: true,
+    rules: shell('npm publish*', 'npm stage*', 'npm unpublish*', 'npm deprecate*', 'docker push*'),
+  },
+  {
+    id: 'human-moves',
+    label:
+      "the human's GCF moves: verdict, decide, answer, unblock, phase, pillars, permissions, setup",
+    on: true,
+    rules: shell(
+      'ai-factory gcf verdict*',
+      'ai-factory gcf decide*',
+      'ai-factory gcf question answer*',
+      'ai-factory gcf unblock*',
+      'ai-factory gcf phase next*',
+      'ai-factory gcf pillar*',
+      'ai-factory gcf permissions*',
+      'ai-factory gcf hooks-install*',
+      'ai-factory gcf-harness init*',
+      'ai-factory gcf-harness run*',
+      'ai-factory gcf-harness stop*',
+      'ai-factory extension*',
+    ),
+  },
+  {
+    id: 'guards',
+    label: 'the guards: .claude/, extension code, gcf/LIVE.md, gcf/.metrics/, the run files',
+    on: true,
+    rules: files(
+      ['Edit', 'Write'],
+      '.claude/**',
+      '.ai-factory/extensions/**',
+      'gcf/LIVE.md',
+      'gcf/.metrics/**',
+      '.gcf-session/runs/**',
+      '.gcf-session/handoff.json',
+    ),
+  },
+  {
+    id: 'secrets',
+    label: 'reading secrets: ~/.npmrc, ~/.ssh, ~/.claude.json, .env',
+    on: false,
+    rules: files(['Read'], '~/.npmrc', '~/.ssh/**', '~/.claude.json', '**/.env'),
+  },
+  {
+    id: 'outside',
+    label:
+      'changes outside the project: global installs, git config --global, setx, registry, shutdown',
+    on: false,
+    rules: shell(
+      'npm i -g*',
+      'npm install -g*',
+      'npm install --global*',
+      'git config --global*',
+      'setx*',
+      'reg add*',
+      'reg delete*',
+      'shutdown*',
+      'Restart-Computer*',
+      'Stop-Computer*',
+    ),
+  },
+  {
+    id: 'processes',
+    label: 'killing processes: taskkill, Stop-Process, kill',
+    on: false,
+    rules: shell('taskkill*', 'Stop-Process*', 'kill *', 'pkill*'),
+  },
+];
+
+const GROUP_IDS = DENY_GROUPS.map((g) => g.id);
+// A permission rule: a tool name, optionally with a specifier — `Bash(npm test*)`, `Read`.
+const RULE_RE = /^[A-Za-z_][\w-]*(\(.+\))?$/;
+const known = (x) => GROUP_IDS.includes(x);
+const rule = (x) => typeof x === 'string' && RULE_RE.test(x);
+
+function rules(agent, key) {
+  const v = agent[key] ?? [];
+  if (!Array.isArray(v) || !v.every(rule))
+    throw new Error(`gcf/config.yml: agent.${key} must be a list of rules like Bash(cmd*) or Read`);
+
+  return v;
+}
+
+/**
+ * The groups the human chose: `agent.groups` maps a group id to true or false. A group it does
+ * not name keeps its default, so a group a later version adds on comes on in every project.
+ */
+function choices(agent) {
+  const g = agent.groups ?? {};
+  if (typeof g !== 'object' || Array.isArray(g))
+    throw new Error('gcf/config.yml: agent.groups must map a group id to true or false');
+  for (const [id, on] of Object.entries(g))
+    if (!known(id) || typeof on !== 'boolean')
+      throw new Error(
+        `gcf/config.yml: agent.groups.${id} must be true or false, for one of ${GROUP_IDS.join(' | ')}`,
+      );
+
+  return g;
+}
+
+/**
+ * The `agent:` section resolved: each group on or off, the deny rules the run gets, the extra
+ * allow rules (for an agent run without bypass). No section: the default groups.
+ */
+export function agentOf(config) {
+  const agent = config.agent ?? {};
+  if (typeof agent !== 'object' || Array.isArray(agent))
+    throw new Error('gcf/config.yml: agent must be a mapping');
+  const chosen = choices(agent);
+  const extra = rules(agent, 'deny');
+  const allow = rules(agent, 'allow');
+  const groups = DENY_GROUPS.map((g) => ({ id: g.id, label: g.label, on: chosen[g.id] ?? g.on }));
+  const deny = [
+    ...new Set([...DENY_GROUPS.filter((g, i) => groups[i].on).flatMap((g) => g.rules), ...extra]),
+  ];
+
+  return { groups, deny_extra: extra, deny, allow };
+}
+
+/** Refuse a change that names no group, a group twice, a bad rule, or a rule it cannot remove. */
+function checkChange(change, current) {
+  const on = change.on ?? [];
+  const off = change.off ?? [];
+  for (const id of [...on, ...off])
+    if (!known(id)) throw new Error(`no permission group ${id}: ${GROUP_IDS.join(' | ')}`);
+  const both = on.find((id) => off.includes(id));
+  if (both) throw new Error(`${both} is turned on and off at once`);
+  for (const r of [...(change.deny ?? []), ...(change.undeny ?? [])])
+    if (!rule(r)) throw new Error(`not a permission rule: ${r}`);
+  const missing = (change.undeny ?? []).find((r) => !current.deny_extra.includes(r));
+  if (missing) throw new Error(`${missing} is not one of your own deny rules: turn its group off`);
+}
+
+/**
+ * Turn groups on or off, add or remove a custom rule; commit gcf(permissions). Only the
+ * `agent:` section changes: the rest of config.yml keeps its keys and comments. The file is
+ * read under the move's lock, so two changes at once both land.
+ */
+export async function setPermissions(projectDir, change, { commit = true } = {}) {
+  const file = path.join(gcfRoot(projectDir), 'config.yml');
+  let result;
+  const hash = await commitMove(projectDir, 'gcf(permissions): agent deny rules', {
+    files: [file],
+    mutate: async () => {
+      const doc = YAML.parseDocument(existsSync(file) ? await readFile(file, 'utf8') : '');
+      if (doc.errors.length) throw new Error(`gcf/config.yml: ${doc.errors[0].message}`);
+      if (!YAML.isMap(doc.contents)) doc.contents = doc.createNode({});
+      // A blank `agent:` (or one holding only comments) is no map yet.
+      const agent = doc.get('agent', true);
+      if (agent != null && !YAML.isMap(agent) && !(YAML.isScalar(agent) && agent.value == null))
+        throw new Error('gcf/config.yml: agent must be a mapping');
+      if (!YAML.isMap(agent)) doc.set('agent', doc.createNode({}));
+      const groups = doc.getIn(['agent', 'groups'], true);
+      if (groups != null && !YAML.isMap(groups) && !(YAML.isScalar(groups) && groups.value == null))
+        throw new Error('gcf/config.yml: agent.groups must map a group id to true or false');
+      if (!YAML.isMap(groups)) doc.setIn(['agent', 'groups'], doc.createNode({}));
+      const current = agentOf({ agent: doc.toJS().agent });
+      checkChange(change, current);
+      for (const id of change.on ?? []) doc.setIn(['agent', 'groups', id], true);
+      for (const id of change.off ?? []) doc.setIn(['agent', 'groups', id], false);
+      const deny = [...new Set([...current.deny_extra, ...(change.deny ?? [])])].filter(
+        (r) => !change.undeny?.includes(r),
+      );
+      doc.setIn(['agent', 'deny'], doc.createNode(deny, { flow: true }));
+      result = agentOf({ agent: doc.toJS().agent });
+      await atomicWrite(file, doc.toString());
+    },
+    commit,
+  });
+
+  return { ...result, hash };
+}

package/lib/board.js

@@ -16,6 +16,7 @@ import { ITEM_TYPES } from './validate-item.js';
 import { movesOf } from './transitions.js';
 import { listQuestions } from './questions.js';
 import { sessionActive } from './session-mark.js';
+import { agentOf } from './agent-permissions.js';
 
 // The version of the JSON below (Methodology §11): a board refuses one it does not know. Bump it
 // when a field changes meaning or goes away; a new field does not bump it.
@@ -120,6 +121,27 @@ function logOf(projectDir, id) {
   return existsSync(path.join(projectDir, log)) ? log : null;
 }
 
+/**
+ * How the agent session of the item's last run ended, when the harness kept it for a rerun to
+ * resume (`<id>.agent.json`): `{ended, resets?}`, or null. A file that is not a record is none.
+ */
+async function resumeOf(projectDir, id) {
+  try {
+    const file = path.join(projectDir, '.gcf-session', 'runs', `${id}.agent.json`);
+    const rec = JSON.parse(await readFile(file, 'utf8'));
+    // A handoff needs no session: the next run starts a fresh one from the plan.
+    if (typeof rec?.session_id !== 'string' && rec?.ended !== 'handoff') return null;
+
+    return {
+      ended: String(rec.ended ?? ''),
+      ...(rec.resets ? { resets: String(rec.resets) } : {}),
+      ...(rec.handoffs ? { handoffs: Number(rec.handoffs) } : {}),
+    };
+  } catch {
+    return null;
+  }
+}
+
 // Fields of the item file a board shows as they are: null or [] when the file has none.
 const SCALARS = [
   'title',
@@ -163,10 +185,15 @@ async function itemOf(projectDir, c, verified) {
   const ready = c.data.status === 'ready' && verified.has(id);
   // `running` and `verify` are not stored (§4): a live harness run lock or a fresh session mark
   // is a run; a trailer is a passed DoD. A worktree with neither is a run that stopped (a
-  // timeout, a stop, a crash): the item is ready, and its next run resumes that worktree.
+  // timeout, a stop, a crash): the item is ready, and its next run resumes that worktree. A
+  // session the harness kept (`resume`) is resumed by the next run in either mode.
   const running = runHolder(projectDir, id) !== null || sessionActive(projectDir, id);
+  const resume = c.data.status === 'ready' ? await resumeOf(projectDir, id) : null;
   const resumable =
-    !running && c.data.status === 'ready' && !ready && existsSync(worktreeOf(projectDir, id));
+    !running &&
+    c.data.status === 'ready' &&
+    !ready &&
+    (resume !== null || existsSync(worktreeOf(projectDir, id)));
 
   return {
     id,
@@ -179,6 +206,7 @@ async function itemOf(projectDir, c, verified) {
     ...(c.data.blocked ? { blocked: c.data.blocked } : {}),
     running,
     resumable,
+    resume,
     verified: ready,
     // What a board may offer (§4.1): nothing while a run drives the item.
     moves: running ? [] : movesOf(c.data),
@@ -202,6 +230,13 @@ export async function board(projectDir) {
   return {
     schema: BOARD_SCHEMA,
     run_mode: config.run_mode,
+    // What the harness hands its agent runs (Harness-PRD §7): the deny rules and the context limits.
+    agent: agentOf(config),
+    context: {
+      handoff_pct: config.context_handoff_pct,
+      window: config.context_window,
+      compact_pct: config.auto_compact_pct,
+    },
     phase: await phaseOf(projectDir),
     // A malformed block reads with fields missing (live check names it): null, not absent.
     release: releaseOf(live.release),

package/lib/gcf-paths.js

@@ -16,8 +16,16 @@ const DEFAULT_CONFIG = {
   unplayed_warn_after: 5,
   plan_passes: 5,
   dod_attempts: 2,
+  // A run hands its item to a fresh session at this share of the context window (0: never);
+  // the window comes from the model unless context_window sets it (Harness-PRD §7).
+  context_handoff_pct: 60,
+  context_window: 0,
+  // CLAUDE_AUTOCOMPACT_PCT_OVERRIDE for the run (0: the agent's own default).
+  auto_compact_pct: 0,
 };
 
+const PCT_KEYS = ['context_handoff_pct', 'auto_compact_pct'];
+
 /** `gcf/` lives at the repository root (GCF-PRD §5.1). Throws when absent. */
 export function gcfRoot(projectDir = process.cwd()) {
   const root = path.join(path.resolve(projectDir), 'gcf');
@@ -41,6 +49,16 @@ function runModeOf(v = 'worktree') {
 /** @returns {Promise<Record<string, any>>} */
 export async function readConfig(root) {
   const config = await readNumbers(root);
+  for (const key of PCT_KEYS)
+    if (config[key] > 100)
+      throw new Error(`gcf/config.yml: ${key} is a share of the window, 0-100, got ${config[key]}`);
+  // A compaction before the handoff threshold shrinks the context the handoff waits for.
+  const { auto_compact_pct: compact, context_handoff_pct: handoff } = config;
+  if (compact && handoff && compact < handoff + 15)
+    throw new Error(
+      `gcf/config.yml: auto_compact_pct ${compact} must be at least context_handoff_pct + 15 ` +
+        `(${handoff + 15}), or the compaction comes before the handoff`,
+    );
 
   return { ...config, run_mode: runModeOf(config.run_mode) };
 }

package/lib/session-mark.js

@@ -40,6 +40,14 @@ export function releaseSession(projectDir, id) {
   rmSync(markOf(projectDir, id), { force: true });
 }
 
+/**
+ * Forget the agent session the harness kept for a rerun of `id` (`<id>.agent.json`): a move,
+ * by hand or by an agent, ends the work it would resume.
+ */
+export function dropAgentSession(projectDir, id) {
+  rmSync(path.join(path.dirname(markOf(projectDir, id)), `${id}.agent.json`), { force: true });
+}
+
 /** Whether a session works the item now: a mark refreshed within SESSION_TTL_MS. */
 export function sessionActive(projectDir, id) {
   const file = markOf(projectDir, id);

package/lib/work-ops.js

@@ -38,7 +38,7 @@ import {
 import { dropInbox } from './inbox.js';
 import { refuseByPhase } from './phase.js';
 import { runHolder, withMainLock } from './main-lock.js';
-import { releaseSession, sessionActive } from './session-mark.js';
+import { dropAgentSession, releaseSession, sessionActive } from './session-mark.js';
 
 /**
  * Options of a committed move; each move reads the ones it needs.
@@ -228,8 +228,10 @@ async function finish(m, move, tail, commit) {
     commit,
     inputs: [m.item.file],
   });
-  // A move on the item ends the session that worked it: the board stops showing it running.
+  // A move on the item ends the session that worked it: the board stops showing it running,
+  // and no rerun resumes it.
   releaseSession(m.projectDir, String(m.item.data.id));
+  dropAgentSession(m.projectDir, String(m.item.data.id));
 
   return hash;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gcf-aif-ext",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Game Context Framework for AI Factory",
   "type": "module",
   "license": "MIT",

package/templates/agents-block.md

@@ -28,6 +28,7 @@ gcf_forbidden:
 - do not give a verdict or a decision: `verdict` and `decide` belong to the human, through the gcf-verdict skill
 - do not answer a `TBD` of a design unit yourself: ask the human and offer your draft as the proposed answer
 - do not run `ai-factory gcf phase next`: the phase moves on the human's word only
+- do not change what agent runs may do: `ai-factory gcf permissions` and its deny groups belong to the human
 - do not reuse an ended id: rework gets a new id with `reopens: <old id>`
 - do not commit past the gate with `--no-verify`: a refused commit names what to fix
 

package/templates/config.yml

@@ -9,6 +9,14 @@ envelope_default_spread: 0.3
 unplayed_warn_after: 5
 plan_passes: 5
 dod_attempts: 2
+# Agent runs (Harness-PRD §7): the share of the context window at which a run hands its item
+# to a fresh session (0: never), the window when the model's is unknown (0: the model's), and
+# the agent's auto-compaction share (0: its default; at least the handoff share + 15).
+context_handoff_pct: 60
+context_window: 0
+auto_compact_pct: 0
+# What agent runs may not do lives in an `agent:` section that `ai-factory gcf permissions`
+# and the board write; without it the default deny groups hold.
 # The project's own commands for the auto DoD (Methodology §6); the engine does not matter.
 # gcf verify fails on an empty one; `none` says the project has no such step.
 # Phases (Methodology §10) come from code; a `phases:` list here replaces the whole set.