palmier 0.9.13 → 0.9.14

package/dist/agents/agent.d.ts

@@ -6,6 +6,11 @@ export interface CommandLine {
     stdin?: string;
     /** Additional environment variables to set for the spawned process. */
     env?: Record<string, string>;
+    /** Files to write into the spawned process's cwd before invocation. Path is relative to cwd. */
+    files?: Array<{
+        path: string;
+        content: string;
+    }>;
 }
 export interface AgentTool {
     /** Return the command and args for a short, non-interactive prompt (e.g. generating a task name). */

package/dist/agents/gemini.d.ts

@@ -1,5 +1,6 @@
 import type { ParsedTask, RequiredPermission } from "../types.js";
 import type { AgentTool, CommandLine } from "./agent.js";
+export declare function renderPolicyToml(allowedTools: string[]): string;
 export declare class GeminiAgent implements AgentTool {
     supportsPermissions: boolean;
     supportsYolo: boolean;

package/dist/agents/gemini.js

@@ -1,6 +1,22 @@
 import { execSync } from "child_process";
 import { getAgentInstructions } from "./shared-prompt.js";
 import { SHELL } from "../platform/index.js";
+export function renderPolicyToml(allowedTools) {
+    const list = allowedTools.map((t) => JSON.stringify(t)).join(", ");
+    return [
+        "# Generated by Palmier — do not edit.",
+        "[[rule]]",
+        `toolName = [${list}]`,
+        `decision = "allow"`,
+        "priority = 100",
+        "",
+        "[[rule]]",
+        `toolName = "*"`,
+        `decision = "deny"`,
+        "priority = 1",
+        "",
+    ].join("\n");
+}
 export class GeminiAgent {
     supportsPermissions = true;
     supportsYolo = true;
@@ -11,20 +27,23 @@ export class GeminiAgent {
         const yolo = extraPermissions === "yolo";
         const prompt = followupPrompt ?? getAgentInstructions(task, yolo || !this.supportsPermissions);
         const args = ["--approval-mode", yolo ? "yolo" : "auto_edit"];
+        const files = [];
         if (!yolo) {
             const tools = ["run_shell_command", "web_fetch"];
             const allPerms = [...(task.frontmatter.permissions ?? []), ...(extraPermissions ?? [])];
             for (const p of allPerms) {
                 tools.push(p.name);
             }
-            args.push("--allowed-tools", tools.join(","));
+            const policyPath = "gemini-policy.toml";
+            files.push({ path: policyPath, content: renderPolicyToml(tools) });
+            args.push("--admin-policy", policyPath);
         }
         if (followupPrompt) {
             args.push("--resume");
         }
         // Read prompt from stdin to avoid command-line length limits.
         args.push("--prompt", "-");
-        return { command: "gemini", args, stdin: prompt };
+        return { command: "gemini", args, stdin: prompt, ...(files.length > 0 ? { files } : {}) };
     }
     async init() {
         try {

package/dist/commands/run.js

@@ -63,10 +63,15 @@ async function invokeAgentWithRetries(ctx, invokeTask) {
             ensureWriter(stream).write(filtered.join("\n") + "\n");
             throttledNotify();
         }
-        const { command, args, stdin, env: agentEnv } = ctx.agent.getTaskRunCommandLine(invokeTask, undefined, ctx.task.frontmatter.yolo_mode ? "yolo" : ctx.transientPermissions);
+        const { command, args, stdin, env: agentEnv, files } = ctx.agent.getTaskRunCommandLine(invokeTask, undefined, ctx.task.frontmatter.yolo_mode ? "yolo" : ctx.transientPermissions);
+        const runDir = getRunDir(ctx.taskDir, ctx.runId);
+        if (files) {
+            for (const f of files)
+                fs.writeFileSync(path.join(runDir, f.path), f.content, "utf-8");
+        }
         const result = await spawnCommand(command, args, {
-            cwd: getRunDir(ctx.taskDir, ctx.runId),
-            env: { ...ctx.guiEnv, ...agentEnv, PALMIER_RUN_DIR: getRunDir(ctx.taskDir, ctx.runId), PALMIER_HTTP_PORT: String(ctx.config.httpPort ?? 7256) },
+            cwd: runDir,
+            env: { ...ctx.guiEnv, ...agentEnv, PALMIER_RUN_DIR: runDir, PALMIER_HTTP_PORT: String(ctx.config.httpPort ?? 7256) },
             echoStdout: true,
             resolveOnFailure: true,
             stdin,