gcf-aif-ext 0.7.5 → 0.7.6

package/README.md

@@ -50,6 +50,12 @@ Updating preserves `gcf/`, `cnlp.config.json` and the pre-commit hook. Run `ai-f
 
 On Windows, run `extension add` and `extension update` from PowerShell or cmd, not Git Bash: the installer unpacks with `tar`, and Git Bash's GNU tar reads `C:\…` as a remote host (`Cannot connect to C: resolve failed`). The Windows `tar.exe` handles it.
 
+### 0.7.6
+
+- `ai-factory gcf permissions [--on <group>] [--off <group>] [--deny <rule>] [--undeny <rule>]` — what agent runs may not do: deny groups and the human's own rules in the `agent:` section of `gcf/config.yml`, one `gcf(permissions)` commit; with no change it lists them. On by default: `git-destroy`, `mass-delete`, `publish`, `human-moves`, `guards`; off: `secrets`, `outside`, `processes`. `agent.groups` keeps only the human's choices (`secrets: true`): a group it does not name keeps its default, so one a later version adds comes on. `git push` is in none. `gcf board --json` carries `agent` (`groups`, `deny_extra`, the resolved `deny`, `allow`).
+- New `config.yml` keys for harness runs: `context_handoff_pct` (60; 0 turns the handoff off), `context_window` (0: the model's) and `auto_compact_pct` (0: the agent's default; at least the handoff share + 15). `gcf board --json` carries them as `context`; a kept session that handed over reads `resume: {ended: 'handoff', handoffs}`.
+- The AGENTS.md block tells the agent that the permissions are the human's.
+
 ### 0.7.1
 
 - `gcf board --json`: a ready item's worktree with no run lock and no session mark is a run that stopped (a timeout, a stop, a crash), not a run: the item reads `running: false`, `resumable: true`, and keeps its moves; its next run resumes the worktree. An agent session the harness kept (`.gcf-session/runs/<id>.agent.json`) makes a ready item `resumable` too, in either run mode, and shows as `resume: {ended, resets?}` (null without one).

package/commands/gcf.js

@@ -977,6 +977,31 @@ function registerBoard(gcf) {
         ].join('\n'),
       );
     });
+  const many = (v, prev = []) => [...prev, v];
+  gcf
+    .command('permissions')
+    .description("What agent runs may not do: deny groups and custom rules (the human's; commit)")
+    .option('--on <group>', 'turn a deny group on (repeatable)', many)
+    .option('--off <group>', 'turn a deny group off (repeatable)', many)
+    .option('--deny <rule>', 'add a custom deny rule, like Bash(cmd*) (repeatable)', many)
+    .option('--undeny <rule>', 'remove a custom deny rule (repeatable)', many)
+    .option('--json', 'machine output')
+    .option('--no-commit', 'skip the commit (tests only)')
+    .action(async (o) => {
+      const perms = await lib('agent-permissions');
+      const { gcfRoot, readConfig } = await lib('gcf-paths');
+      const change = [o.on, o.off, o.deny, o.undeny].some(Boolean);
+      const r = change
+        ? await perms.setPermissions(process.cwd(), o, { commit: o.commit })
+        : perms.agentOf(await readConfig(gcfRoot()));
+      out(o.json, r, (x) =>
+        [
+          ...x.groups.map((g) => `${g.on ? '[x]' : '[ ]'} ${g.id}: ${g.label}`),
+          ...x.deny_extra.map((d) => `deny: ${d}`),
+          ...(x.hash ? [`committed${shortHash(x.hash)}`] : []),
+        ].join('\n'),
+      );
+    });
 }
 
 function registerIntegrate(gcf) {

package/extension.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/lee-to/ai-factory/2.x/schemas/extension.schema.json",
   "name": "gcf-aif-ext",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "Game Context Framework for AI Factory",
   "skills": [
     "skills/gcf-init",

package/lib/agent-permissions.js

@@ -0,0 +1,243 @@
+// What a headless agent run may not do (Harness-PRD §7). The run allows everything else
+// (`--permission-mode bypassPermissions`): a deny rule holds in every mode. The groups guard
+// the edge cases only — what git cannot undo, what leaves the machine, the human's own moves
+// and the guards themselves. `git push` is not one of them: a feature ends tested and pushed.
+// Deny rules match the command as written, so they catch accidents, not a determined
+// rewording; the gcf-run skill makes a refusal a stop.
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import YAML from 'yaml';
+import { commitMove } from './unit-ops.js';
+import { atomicWrite } from './safe-path.js';
+import { gcfRoot } from './gcf-paths.js';
+
+// A shell command pattern turns into a rule for both shell tools: on Windows the agent runs
+// commands through PowerShell, which Bash rules do not cover.
+const shell = (...patterns) => patterns.flatMap((p) => [`Bash(${p})`, `PowerShell(${p})`]);
+const files = (tools, ...globs) => globs.flatMap((g) => tools.map((t) => `${t}(${g})`));
+
+/** @type {{ id: string, label: string, on: boolean, rules: string[] }[]} */
+export const DENY_GROUPS = [
+  {
+    id: 'git-destroy',
+    label: 'git history and uncommitted work: reset --hard, clean, stash, force push',
+    on: true,
+    rules: shell(
+      'git reset --hard*',
+      'git clean*',
+      'git stash*',
+      'git branch -D*',
+      'git filter-branch*',
+      'git update-ref -d*',
+      'git push*--force*',
+      'git push -f*',
+      'git push -uf*',
+      'git push * -f',
+      'git push * -f *',
+      'git push *+*',
+      'git push*--mirror*',
+      'git push*--delete*',
+      'git checkout .',
+      'git checkout -- .',
+      'git restore .',
+      'git restore -- .',
+    ),
+  },
+  {
+    id: 'mass-delete',
+    label: 'recursive delete: rm -r, Remove-Item -Recurse, rd /s',
+    on: true,
+    rules: shell(
+      'rm -r*',
+      'rm -R*',
+      'rm -fr*',
+      'rm -fR*',
+      'rm -f -r*',
+      'rm --recursive*',
+      'Remove-Item*-Recurse*',
+      'Remove-Item* -r',
+      'Remove-Item* -r *',
+      'rmdir /s*',
+      'rd /s*',
+      'del /s*',
+      'cmd /c rd /s*',
+      'cmd /c rmdir /s*',
+      'cmd /c del /s*',
+    ),
+  },
+  {
+    id: 'publish',
+    label: 'publishing: npm publish, stage, unpublish, deprecate; docker push',
+    on: true,
+    rules: shell('npm publish*', 'npm stage*', 'npm unpublish*', 'npm deprecate*', 'docker push*'),
+  },
+  {
+    id: 'human-moves',
+    label:
+      "the human's GCF moves: verdict, decide, answer, unblock, phase, pillars, permissions, setup",
+    on: true,
+    rules: shell(
+      'ai-factory gcf verdict*',
+      'ai-factory gcf decide*',
+      'ai-factory gcf question answer*',
+      'ai-factory gcf unblock*',
+      'ai-factory gcf phase next*',
+      'ai-factory gcf pillar*',
+      'ai-factory gcf permissions*',
+      'ai-factory gcf hooks-install*',
+      'ai-factory gcf-harness init*',
+      'ai-factory gcf-harness run*',
+      'ai-factory gcf-harness stop*',
+      'ai-factory extension*',
+    ),
+  },
+  {
+    id: 'guards',
+    label: 'the guards: .claude/, extension code, gcf/LIVE.md, gcf/.metrics/, the run files',
+    on: true,
+    rules: files(
+      ['Edit', 'Write'],
+      '.claude/**',
+      '.ai-factory/extensions/**',
+      'gcf/LIVE.md',
+      'gcf/.metrics/**',
+      '.gcf-session/runs/**',
+      '.gcf-session/handoff.json',
+    ),
+  },
+  {
+    id: 'secrets',
+    label: 'reading secrets: ~/.npmrc, ~/.ssh, ~/.claude.json, .env',
+    on: false,
+    rules: files(['Read'], '~/.npmrc', '~/.ssh/**', '~/.claude.json', '**/.env'),
+  },
+  {
+    id: 'outside',
+    label:
+      'changes outside the project: global installs, git config --global, setx, registry, shutdown',
+    on: false,
+    rules: shell(
+      'npm i -g*',
+      'npm install -g*',
+      'npm install --global*',
+      'git config --global*',
+      'setx*',
+      'reg add*',
+      'reg delete*',
+      'shutdown*',
+      'Restart-Computer*',
+      'Stop-Computer*',
+    ),
+  },
+  {
+    id: 'processes',
+    label: 'killing processes: taskkill, Stop-Process, kill',
+    on: false,
+    rules: shell('taskkill*', 'Stop-Process*', 'kill *', 'pkill*'),
+  },
+];
+
+const GROUP_IDS = DENY_GROUPS.map((g) => g.id);
+// A permission rule: a tool name, optionally with a specifier — `Bash(npm test*)`, `Read`.
+const RULE_RE = /^[A-Za-z_][\w-]*(\(.+\))?$/;
+const known = (x) => GROUP_IDS.includes(x);
+const rule = (x) => typeof x === 'string' && RULE_RE.test(x);
+
+function rules(agent, key) {
+  const v = agent[key] ?? [];
+  if (!Array.isArray(v) || !v.every(rule))
+    throw new Error(`gcf/config.yml: agent.${key} must be a list of rules like Bash(cmd*) or Read`);
+
+  return v;
+}
+
+/**
+ * The groups the human chose: `agent.groups` maps a group id to true or false. A group it does
+ * not name keeps its default, so a group a later version adds on comes on in every project.
+ */
+function choices(agent) {
+  const g = agent.groups ?? {};
+  if (typeof g !== 'object' || Array.isArray(g))
+    throw new Error('gcf/config.yml: agent.groups must map a group id to true or false');
+  for (const [id, on] of Object.entries(g))
+    if (!known(id) || typeof on !== 'boolean')
+      throw new Error(
+        `gcf/config.yml: agent.groups.${id} must be true or false, for one of ${GROUP_IDS.join(' | ')}`,
+      );
+
+  return g;
+}
+
+/**
+ * The `agent:` section resolved: each group on or off, the deny rules the run gets, the extra
+ * allow rules (for an agent run without bypass). No section: the default groups.
+ */
+export function agentOf(config) {
+  const agent = config.agent ?? {};
+  if (typeof agent !== 'object' || Array.isArray(agent))
+    throw new Error('gcf/config.yml: agent must be a mapping');
+  const chosen = choices(agent);
+  const extra = rules(agent, 'deny');
+  const allow = rules(agent, 'allow');
+  const groups = DENY_GROUPS.map((g) => ({ id: g.id, label: g.label, on: chosen[g.id] ?? g.on }));
+  const deny = [
+    ...new Set([...DENY_GROUPS.filter((g, i) => groups[i].on).flatMap((g) => g.rules), ...extra]),
+  ];
+
+  return { groups, deny_extra: extra, deny, allow };
+}
+
+/** Refuse a change that names no group, a group twice, a bad rule, or a rule it cannot remove. */
+function checkChange(change, current) {
+  const on = change.on ?? [];
+  const off = change.off ?? [];
+  for (const id of [...on, ...off])
+    if (!known(id)) throw new Error(`no permission group ${id}: ${GROUP_IDS.join(' | ')}`);
+  const both = on.find((id) => off.includes(id));
+  if (both) throw new Error(`${both} is turned on and off at once`);
+  for (const r of [...(change.deny ?? []), ...(change.undeny ?? [])])
+    if (!rule(r)) throw new Error(`not a permission rule: ${r}`);
+  const missing = (change.undeny ?? []).find((r) => !current.deny_extra.includes(r));
+  if (missing) throw new Error(`${missing} is not one of your own deny rules: turn its group off`);
+}
+
+/**
+ * Turn groups on or off, add or remove a custom rule; commit gcf(permissions). Only the
+ * `agent:` section changes: the rest of config.yml keeps its keys and comments. The file is
+ * read under the move's lock, so two changes at once both land.
+ */
+export async function setPermissions(projectDir, change, { commit = true } = {}) {
+  const file = path.join(gcfRoot(projectDir), 'config.yml');
+  let result;
+  const hash = await commitMove(projectDir, 'gcf(permissions): agent deny rules', {
+    files: [file],
+    mutate: async () => {
+      const doc = YAML.parseDocument(existsSync(file) ? await readFile(file, 'utf8') : '');
+      if (doc.errors.length) throw new Error(`gcf/config.yml: ${doc.errors[0].message}`);
+      if (!YAML.isMap(doc.contents)) doc.contents = doc.createNode({});
+      // A blank `agent:` (or one holding only comments) is no map yet.
+      const agent = doc.get('agent', true);
+      if (agent != null && !YAML.isMap(agent) && !(YAML.isScalar(agent) && agent.value == null))
+        throw new Error('gcf/config.yml: agent must be a mapping');
+      if (!YAML.isMap(agent)) doc.set('agent', doc.createNode({}));
+      const groups = doc.getIn(['agent', 'groups'], true);
+      if (groups != null && !YAML.isMap(groups) && !(YAML.isScalar(groups) && groups.value == null))
+        throw new Error('gcf/config.yml: agent.groups must map a group id to true or false');
+      if (!YAML.isMap(groups)) doc.setIn(['agent', 'groups'], doc.createNode({}));
+      const current = agentOf({ agent: doc.toJS().agent });
+      checkChange(change, current);
+      for (const id of change.on ?? []) doc.setIn(['agent', 'groups', id], true);
+      for (const id of change.off ?? []) doc.setIn(['agent', 'groups', id], false);
+      const deny = [...new Set([...current.deny_extra, ...(change.deny ?? [])])].filter(
+        (r) => !change.undeny?.includes(r),
+      );
+      doc.setIn(['agent', 'deny'], doc.createNode(deny, { flow: true }));
+      result = agentOf({ agent: doc.toJS().agent });
+      await atomicWrite(file, doc.toString());
+    },
+    commit,
+  });
+
+  return { ...result, hash };
+}

package/lib/board.js

@@ -16,6 +16,7 @@ import { ITEM_TYPES } from './validate-item.js';
 import { movesOf } from './transitions.js';
 import { listQuestions } from './questions.js';
 import { sessionActive } from './session-mark.js';
+import { agentOf } from './agent-permissions.js';
 
 // The version of the JSON below (Methodology §11): a board refuses one it does not know. Bump it
 // when a field changes meaning or goes away; a new field does not bump it.
@@ -128,11 +129,13 @@ async function resumeOf(projectDir, id) {
   try {
     const file = path.join(projectDir, '.gcf-session', 'runs', `${id}.agent.json`);
     const rec = JSON.parse(await readFile(file, 'utf8'));
-    if (typeof rec?.session_id !== 'string') return null;
+    // A handoff needs no session: the next run starts a fresh one from the plan.
+    if (typeof rec?.session_id !== 'string' && rec?.ended !== 'handoff') return null;
 
     return {
       ended: String(rec.ended ?? ''),
       ...(rec.resets ? { resets: String(rec.resets) } : {}),
+      ...(rec.handoffs ? { handoffs: Number(rec.handoffs) } : {}),
     };
   } catch {
     return null;
@@ -227,6 +230,13 @@ export async function board(projectDir) {
   return {
     schema: BOARD_SCHEMA,
     run_mode: config.run_mode,
+    // What the harness hands its agent runs (Harness-PRD §7): the deny rules and the context limits.
+    agent: agentOf(config),
+    context: {
+      handoff_pct: config.context_handoff_pct,
+      window: config.context_window,
+      compact_pct: config.auto_compact_pct,
+    },
     phase: await phaseOf(projectDir),
     // A malformed block reads with fields missing (live check names it): null, not absent.
     release: releaseOf(live.release),

package/lib/gcf-paths.js

@@ -16,8 +16,16 @@ const DEFAULT_CONFIG = {
   unplayed_warn_after: 5,
   plan_passes: 5,
   dod_attempts: 2,
+  // A run hands its item to a fresh session at this share of the context window (0: never);
+  // the window comes from the model unless context_window sets it (Harness-PRD §7).
+  context_handoff_pct: 60,
+  context_window: 0,
+  // CLAUDE_AUTOCOMPACT_PCT_OVERRIDE for the run (0: the agent's own default).
+  auto_compact_pct: 0,
 };
 
+const PCT_KEYS = ['context_handoff_pct', 'auto_compact_pct'];
+
 /** `gcf/` lives at the repository root (GCF-PRD §5.1). Throws when absent. */
 export function gcfRoot(projectDir = process.cwd()) {
   const root = path.join(path.resolve(projectDir), 'gcf');
@@ -41,6 +49,16 @@ function runModeOf(v = 'worktree') {
 /** @returns {Promise<Record<string, any>>} */
 export async function readConfig(root) {
   const config = await readNumbers(root);
+  for (const key of PCT_KEYS)
+    if (config[key] > 100)
+      throw new Error(`gcf/config.yml: ${key} is a share of the window, 0-100, got ${config[key]}`);
+  // A compaction before the handoff threshold shrinks the context the handoff waits for.
+  const { auto_compact_pct: compact, context_handoff_pct: handoff } = config;
+  if (compact && handoff && compact < handoff + 15)
+    throw new Error(
+      `gcf/config.yml: auto_compact_pct ${compact} must be at least context_handoff_pct + 15 ` +
+        `(${handoff + 15}), or the compaction comes before the handoff`,
+    );
 
   return { ...config, run_mode: runModeOf(config.run_mode) };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gcf-aif-ext",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "Game Context Framework for AI Factory",
   "type": "module",
   "license": "MIT",

package/templates/agents-block.md

@@ -28,6 +28,7 @@ gcf_forbidden:
 - do not give a verdict or a decision: `verdict` and `decide` belong to the human, through the gcf-verdict skill
 - do not answer a `TBD` of a design unit yourself: ask the human and offer your draft as the proposed answer
 - do not run `ai-factory gcf phase next`: the phase moves on the human's word only
+- do not change what agent runs may do: `ai-factory gcf permissions` and its deny groups belong to the human
 - do not reuse an ended id: rework gets a new id with `reopens: <old id>`
 - do not commit past the gate with `--no-verify`: a refused commit names what to fix
 

package/templates/config.yml

@@ -9,6 +9,14 @@ envelope_default_spread: 0.3
 unplayed_warn_after: 5
 plan_passes: 5
 dod_attempts: 2
+# Agent runs (Harness-PRD §7): the share of the context window at which a run hands its item
+# to a fresh session (0: never), the window when the model's is unknown (0: the model's), and
+# the agent's auto-compaction share (0: its default; at least the handoff share + 15).
+context_handoff_pct: 60
+context_window: 0
+auto_compact_pct: 0
+# What agent runs may not do lives in an `agent:` section that `ai-factory gcf permissions`
+# and the board write; without it the default deny groups hold.
 # The project's own commands for the auto DoD (Methodology §6); the engine does not matter.
 # gcf verify fails on an empty one; `none` says the project has no such step.
 # Phases (Methodology §10) come from code; a `phases:` list here replaces the whole set.