runwork 0.10.3 → 0.11.0

package/dist/agents/cursor.js

@@ -1,10 +1,43 @@
 import { existsSync, mkdirSync, readdirSync, unlinkSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { homedir, platform } from 'os';
-import { execFileSync } from 'child_process';
+import { execFileSync } from '../utils/subprocess.js';
 import { querySqlite, openWritableSqlite } from '../utils/sqlite.js';
 import { whichBinary } from '../utils/which.js';
 import { mergeJsonMcpServers, removeRunworkMcpServers, readJsonConfig, writeJsonConfig } from './utils/json-config.js';
+/**
+ * Merge a new managed list into a markerless on-disk array while preserving
+ * user-added entries.
+ *
+ * existing  = what's currently on disk
+ * baseline  = what we wrote on the previous sync (state.lastInjected). Items
+ *             present here are assumed to be ours; subtracting them from
+ *             existing leaves entries the user added themselves.
+ * incoming  = the new managed set to inject (defaults already filtered for
+ *             opt-outs, merged with team rules)
+ *
+ * If baseline is empty (bootstrap or first run with this CLI version), we
+ * assume nothing currently on disk is ours and preserve all existing entries.
+ */
+export function mergeMarkerless(existing, baseline, incoming) {
+    const baselineSet = new Set(baseline);
+    const userEntries = existing.filter((item) => !baselineSet.has(item));
+    const seen = new Set();
+    const result = [];
+    for (const item of userEntries) {
+        if (!seen.has(item)) {
+            seen.add(item);
+            result.push(item);
+        }
+    }
+    for (const item of incoming) {
+        if (!seen.has(item)) {
+            seen.add(item);
+            result.push(item);
+        }
+    }
+    return result;
+}
 export class CursorAdapter {
     name = 'Cursor';
     slug = 'cursor';
@@ -68,7 +101,7 @@ ${skill.content}`;
         writeFileSync(filePath, mdcContent);
     }
     // ── Agent config (model, permissions via SQLite) ────────────────────
-    async writeAgentConfig(config, scope) {
+    async writeAgentConfig(config, scope, baseline) {
         if (scope !== 'user')
             return;
         // Sandbox network allowlist: merge into ~/.cursor/cli-config.json
@@ -108,10 +141,10 @@ ${skill.content}`;
             }
             if (config.permissionRules && data.composerState) {
                 if (config.permissionRules.allow) {
-                    data.composerState.yoloCommandAllowlist = config.permissionRules.allow;
+                    data.composerState.yoloCommandAllowlist = mergeMarkerless(data.composerState.yoloCommandAllowlist ?? [], baseline?.allow ?? [], config.permissionRules.allow);
                 }
                 if (config.permissionRules.deny) {
-                    data.composerState.yoloCommandDenylist = config.permissionRules.deny;
+                    data.composerState.yoloCommandDenylist = mergeMarkerless(data.composerState.yoloCommandDenylist ?? [], baseline?.deny ?? [], config.permissionRules.deny);
                 }
             }
             try {
@@ -125,6 +158,12 @@ ${skill.content}`;
             db.close();
         }
     }
+    async readManagedBlock(_scope) {
+        // Cursor's yoloCommandAllowlist has no marker — there's no way to read a
+        // managed-subset from disk. The sync loop relies on the `baseline` arg
+        // (state.lastInjected) passed into writeAgentConfig instead.
+        return undefined;
+    }
     /**
      * Merge domains into Cursor's sandbox network policy (~/.cursor/sandbox.json).
      * Schema per https://cursor.com/docs/reference/sandbox:

package/dist/agents/default-config.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Baked-in default permission rules that `runwork sync` injects into each
+ * supported agent's configuration.
+ *
+ * Defaults are user-scope only. They merge with team-managed rules from the
+ * workspace admin and are tracked in `~/.runwork/setup.json` under
+ * `agentDefaults[slug]` so that:
+ *   1. Removals stick: if a user deletes an injected entry, it never returns.
+ *   2. Newly added defaults flow in: CLI upgrades that ship more defaults
+ *      auto-apply on the next sync.
+ *   3. Removed defaults disappear: shrinking the set here also removes the
+ *      entries from users' on-disk config on next sync.
+ *   4. Tool removal resets state: `runwork agents remove <slug>` clears the
+ *      per-agent state, so re-adding the tool starts from a clean bootstrap.
+ *
+ * Only agents whose permission model maps cleanly to command-pattern allow/deny
+ * lists appear here. Codex, Gemini, Cline, and Claude Desktop are intentionally
+ * absent (their config formats are toggle-based or tool-name-based and do not
+ * fit). Network domain allowlisting for those agents is handled separately via
+ * AgentConfigOverride.networkAllowlist in sync.ts.
+ */
+export interface BakedDefaults {
+    allow: string[];
+    deny: string[];
+}
+export declare const RUNWORK_AGENT_DEFAULTS: Record<string, BakedDefaults>;
+/** Schema version recorded in setup.json. Bump when default-injection semantics change. */
+export declare const AGENT_DEFAULTS_SCHEMA_VERSION = 1;
+/** Slugs that have baked-in defaults. */
+export declare function hasBakedDefaults(slug: string): boolean;

package/dist/agents/default-config.js

@@ -0,0 +1,67 @@
+/**
+ * Baked-in default permission rules that `runwork sync` injects into each
+ * supported agent's configuration.
+ *
+ * Defaults are user-scope only. They merge with team-managed rules from the
+ * workspace admin and are tracked in `~/.runwork/setup.json` under
+ * `agentDefaults[slug]` so that:
+ *   1. Removals stick: if a user deletes an injected entry, it never returns.
+ *   2. Newly added defaults flow in: CLI upgrades that ship more defaults
+ *      auto-apply on the next sync.
+ *   3. Removed defaults disappear: shrinking the set here also removes the
+ *      entries from users' on-disk config on next sync.
+ *   4. Tool removal resets state: `runwork agents remove <slug>` clears the
+ *      per-agent state, so re-adding the tool starts from a clean bootstrap.
+ *
+ * Only agents whose permission model maps cleanly to command-pattern allow/deny
+ * lists appear here. Codex, Gemini, Cline, and Claude Desktop are intentionally
+ * absent (their config formats are toggle-based or tool-name-based and do not
+ * fit). Network domain allowlisting for those agents is handled separately via
+ * AgentConfigOverride.networkAllowlist in sync.ts.
+ */
+export const RUNWORK_AGENT_DEFAULTS = {
+    'claude-code': {
+        allow: [
+            'Bash(runwork *)',
+            'Bash(runwork-cli *)',
+            'Bash(git status)',
+            'Bash(git diff:*)',
+            'Bash(git log:*)',
+            'Bash(git branch:*)',
+            'Bash(git show:*)',
+            'Bash(ls:*)',
+            'Bash(pwd)',
+            'Bash(cat:*)',
+        ],
+        deny: [
+            'Bash(rm -rf *)',
+            'Bash(rm -rf /*)',
+            'Bash(sudo rm *)',
+        ],
+    },
+    'cursor': {
+        allow: [
+            'runwork',
+            'runwork *',
+            'runwork-cli',
+            'runwork-cli *',
+            'git status',
+            'git diff',
+            'git log',
+            'git branch',
+            'ls',
+            'pwd',
+            'cat',
+        ],
+        deny: [
+            'rm -rf *',
+            'sudo *',
+        ],
+    },
+};
+/** Schema version recorded in setup.json. Bump when default-injection semantics change. */
+export const AGENT_DEFAULTS_SCHEMA_VERSION = 1;
+/** Slugs that have baked-in defaults. */
+export function hasBakedDefaults(slug) {
+    return slug in RUNWORK_AGENT_DEFAULTS;
+}

package/dist/agents/defaults-merge.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Pure functions for the default-rules merge algorithm.
+ *
+ * The sync loop (commands/sync.ts) wires these together with per-adapter I/O.
+ * Keeping the logic side-effect-free here makes it cheap to unit-test the
+ * tricky lifecycle (bootstrap, opt-out detection, set shrinking) without
+ * mocking filesystem layers.
+ */
+import type { AgentDefaultsState } from '../types.js';
+import type { BakedDefaults } from './default-config.js';
+/** Items present in `lastInjected` but not in `onDisk`. These are entries the user removed since the previous sync. */
+export declare function detectRemovals(lastInjected: string[], onDisk: string[]): string[];
+/** Defaults filtered to exclude anything the user has opted out of. */
+export declare function computeApplicable(baked: string[], optOuts: string[]): string[];
+/**
+ * Dedupe-silently merge of defaults and team rules. Team rules appear after
+ * defaults in the output (the marker block's team-managed half), and dedupe
+ * keeps the team-positioned copy when a default and a team rule are identical
+ * strings. Stable ordering is preserved.
+ */
+export declare function mergeAllow(applicableDefaults: string[], teamRules: string[]): string[];
+export declare function unique(items: string[]): string[];
+/** True if no per-agent state has ever been recorded — first sync after upgrade or fresh install. */
+export declare function isBootstrap(state: AgentDefaultsState | undefined): boolean;
+export interface ResolveResult {
+    /**
+     * Final merged list to write into the managed block.
+     * For marker-based agents (Claude Code): goes after the marker.
+     * For markerless agents (Cursor): becomes part of the array,
+     * with `baseline` used by the adapter to identify and preserve user entries.
+     */
+    managedAllow: string[];
+    managedDeny: string[];
+    /** Defaults that we actually injected this sync. Stored as next sync's lastInjected. */
+    applicableAllow: string[];
+    applicableDeny: string[];
+    /** New sticky opt-out set. Stored as next sync's userOptOuts. */
+    newOptOutsAllow: string[];
+    newOptOutsDeny: string[];
+    /** Diagnostic counts for the sync log. */
+    removalsThisSync: {
+        allow: number;
+        deny: number;
+    };
+    /** True when this sync is the bootstrap pass and skipped default injection. */
+    bootstrapped: boolean;
+}
+export interface ResolveInput {
+    baked: BakedDefaults | undefined;
+    state: AgentDefaultsState | undefined;
+    onDisk: {
+        allow?: string[];
+        deny?: string[];
+    } | undefined;
+    team: {
+        allow?: string[];
+        deny?: string[];
+    } | undefined;
+}
+/**
+ * Single-call resolver for one agent. Consumes the full input set and emits
+ * the merged managed lists plus the next-sync state values. Pure: no I/O.
+ *
+ * Cases:
+ *   1. No baked defaults for this agent → emits team rules only (no defaults
+ *      logic kicks in). State stays undefined.
+ *   2. Bootstrap (state undefined) → applies team rules but does NOT inject
+ *      defaults this sync. Caller initializes empty state for next time.
+ *   3. Normal → detects removals against lastInjected, accumulates opt-outs,
+ *      filters baked by opt-outs, merges with team rules.
+ */
+export declare function resolveAgentDefaults(input: ResolveInput): ResolveResult;

package/dist/agents/defaults-merge.js

@@ -0,0 +1,131 @@
+/**
+ * Pure functions for the default-rules merge algorithm.
+ *
+ * The sync loop (commands/sync.ts) wires these together with per-adapter I/O.
+ * Keeping the logic side-effect-free here makes it cheap to unit-test the
+ * tricky lifecycle (bootstrap, opt-out detection, set shrinking) without
+ * mocking filesystem layers.
+ */
+/** Items present in `lastInjected` but not in `onDisk`. These are entries the user removed since the previous sync. */
+export function detectRemovals(lastInjected, onDisk) {
+    const onDiskSet = new Set(onDisk);
+    return lastInjected.filter((item) => !onDiskSet.has(item));
+}
+/** Defaults filtered to exclude anything the user has opted out of. */
+export function computeApplicable(baked, optOuts) {
+    const optOutSet = new Set(optOuts);
+    return baked.filter((item) => !optOutSet.has(item));
+}
+/**
+ * Dedupe-silently merge of defaults and team rules. Team rules appear after
+ * defaults in the output (the marker block's team-managed half), and dedupe
+ * keeps the team-positioned copy when a default and a team rule are identical
+ * strings. Stable ordering is preserved.
+ */
+export function mergeAllow(applicableDefaults, teamRules) {
+    const teamSet = new Set(teamRules);
+    const result = [];
+    for (const item of applicableDefaults) {
+        if (!teamSet.has(item))
+            result.push(item);
+    }
+    for (const item of teamRules) {
+        result.push(item);
+    }
+    return result;
+}
+export function unique(items) {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        if (!seen.has(item)) {
+            seen.add(item);
+            out.push(item);
+        }
+    }
+    return out;
+}
+/** True if no per-agent state has ever been recorded — first sync after upgrade or fresh install. */
+export function isBootstrap(state) {
+    return state === undefined;
+}
+/**
+ * Single-call resolver for one agent. Consumes the full input set and emits
+ * the merged managed lists plus the next-sync state values. Pure: no I/O.
+ *
+ * Cases:
+ *   1. No baked defaults for this agent → emits team rules only (no defaults
+ *      logic kicks in). State stays undefined.
+ *   2. Bootstrap (state undefined) → applies team rules but does NOT inject
+ *      defaults this sync. Caller initializes empty state for next time.
+ *   3. Normal → detects removals against lastInjected, accumulates opt-outs,
+ *      filters baked by opt-outs, merges with team rules.
+ */
+export function resolveAgentDefaults(input) {
+    const team = input.team ?? {};
+    const teamAllow = team.allow ?? [];
+    const teamDeny = team.deny ?? [];
+    // Case 1: no baked defaults — emit team rules unchanged, no state to track.
+    if (!input.baked) {
+        return {
+            managedAllow: unique(teamAllow),
+            managedDeny: unique(teamDeny),
+            applicableAllow: [],
+            applicableDeny: [],
+            newOptOutsAllow: [],
+            newOptOutsDeny: [],
+            removalsThisSync: { allow: 0, deny: 0 },
+            bootstrapped: false,
+        };
+    }
+    // Case 2: bootstrap — do not inject defaults this pass.
+    if (isBootstrap(input.state)) {
+        return {
+            managedAllow: unique(teamAllow),
+            managedDeny: unique(teamDeny),
+            applicableAllow: [],
+            applicableDeny: [],
+            newOptOutsAllow: [],
+            newOptOutsDeny: [],
+            removalsThisSync: { allow: 0, deny: 0 },
+            bootstrapped: true,
+        };
+    }
+    // Case 3: normal merge.
+    const state = input.state;
+    const lastInjectedAllow = state.lastInjected.allow ?? [];
+    const lastInjectedDeny = state.lastInjected.deny ?? [];
+    const existingOptOutsAllow = state.userOptOuts.allow ?? [];
+    const existingOptOutsDeny = state.userOptOuts.deny ?? [];
+    // Removal detection requires a reliable on-disk read. Markerless adapters
+    // (Cursor) cannot distinguish injected entries from user entries on disk, so
+    // they return `undefined` from readManagedBlock. Treating `undefined` as an
+    // empty array would fabricate a "user removed everything" signal on every
+    // subsequent sync and incorrectly convert every default into a sticky opt-out.
+    // When we cannot read managed state, we trust the baseline mechanism in the
+    // adapter and skip removal detection for this sync.
+    const canDetectRemovals = input.onDisk !== undefined;
+    const newRemovalsAllow = canDetectRemovals
+        ? detectRemovals(lastInjectedAllow, input.onDisk?.allow ?? [])
+        : [];
+    const newRemovalsDeny = canDetectRemovals
+        ? detectRemovals(lastInjectedDeny, input.onDisk?.deny ?? [])
+        : [];
+    const newOptOutsAllow = unique([...existingOptOutsAllow, ...newRemovalsAllow]);
+    const newOptOutsDeny = unique([...existingOptOutsDeny, ...newRemovalsDeny]);
+    const applicableAllow = computeApplicable(input.baked.allow, newOptOutsAllow);
+    const applicableDeny = computeApplicable(input.baked.deny, newOptOutsDeny);
+    return {
+        managedAllow: mergeAllow(applicableAllow, teamAllow),
+        managedDeny: mergeAllow(applicableDeny, teamDeny),
+        applicableAllow,
+        applicableDeny,
+        newOptOutsAllow,
+        newOptOutsDeny,
+        removalsThisSync: {
+            allow: newRemovalsAllow.length,
+            deny: newRemovalsDeny.length,
+        },
+        bootstrapped: false,
+    };
+}

package/dist/agents/types.d.ts

@@ -33,8 +33,37 @@ export interface AgentAdapter {
     mcpProvidesSkills?: boolean;
     /** Write team-managed instructions (separate marker block from auto-generated hint) */
     writeTeamInstructions?(instructions: string, scope: 'project' | 'user'): Promise<void>;
-    /** Write agent-specific config overrides from workspace admin (model, permissions) */
-    writeAgentConfig?(config: AgentConfigOverride, scope: 'project' | 'user'): Promise<void>;
+    /**
+     * Write agent-specific config overrides from workspace admin (model, permissions).
+     *
+     * @param config - The full resolved config to apply this sync (already merged
+     *   with baked defaults and network/minimum settings by the sync loop).
+     * @param scope - Project- or user-scope configuration target.
+     * @param baseline - Optional. The set of managed entries the previous sync
+     *   wrote (lastInjected from setup.json). Adapters that lack on-disk markers
+     *   to distinguish runwork-managed entries from user-added entries (e.g.
+     *   Cursor's yoloCommandAllowlist) use this to subtract our previous
+     *   contribution before re-injecting, preserving user edits. Marker-based
+     *   adapters (Claude Code) can ignore this parameter.
+     */
+    writeAgentConfig?(config: AgentConfigOverride, scope: 'project' | 'user', baseline?: {
+        allow?: string[];
+        deny?: string[];
+    }): Promise<void>;
+    /**
+     * Read the currently-injected managed-block entries for this scope.
+     * Used by sync to detect when the user has removed an entry that we
+     * previously injected (so we can record it as a sticky opt-out).
+     *
+     * For marker-based adapters (Claude Code): returns items after the marker.
+     * For markerless adapters (Cursor): may return undefined; the sync loop
+     * falls back to the `baseline` mechanism (state.lastInjected) for those.
+     * Optional — adapters without a permission file at all (Cline) skip this.
+     */
+    readManagedBlock?(scope: 'project' | 'user'): Promise<{
+        allow?: string[];
+        deny?: string[];
+    } | undefined>;
     /** Remove all Runwork-managed config, skills, MCP entries, and instruction hints.
      *  The manifest lists exactly which resources were synced so only those are removed. */
     cleanup?(scope: 'project' | 'user', manifest?: CleanupManifest): Promise<void>;

package/dist/commands/clone.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { execFileSync } from 'child_process';
+import { execFileSync } from '../utils/subprocess.js';
 import { writeFileSync, mkdirSync, existsSync } from 'fs';
 import { join, resolve } from 'path';
 import { requireAuth } from '../auth/store.js';

package/dist/commands/deploy.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { execFileSync } from 'child_process';
+import { execFileSync } from '../utils/subprocess.js';
 import { readFileSync, existsSync } from 'fs';
 import { requireAuth } from '../auth/store.js';
 import { ApiClient } from '../api/client.js';

package/dist/commands/dev.js

@@ -1,5 +1,5 @@
 import { Command, Option } from 'commander';
-import { execFileSync } from 'child_process';
+import { execFileSync } from '../utils/subprocess.js';
 import { readFileSync, writeFileSync, existsSync } from 'fs';
 import { join } from 'path';
 import { requireAuth } from '../auth/store.js';
@@ -11,7 +11,7 @@ import { requireGit } from '../git/preflight.js';
 import { startLogTailer } from '../logs/tailer.js';
 import { startPreviewUrlPoller } from '../dev/preview-url-poller.js';
 import { buildSessionFile, getSessionState, readSessionFile, removeSessionFile, removeSessionFileIfOwned, writeSessionFile, } from '../dev/session.js';
-import { INTERNAL_DETACHED_CHILD_FLAG, isInternalDetachedChild, runAsDetachedParent, stripInternalChildFlag, } from '../dev/detach.js';
+import { INTERNAL_DETACHED_CHILD_FLAG, buildChildArgs, isInternalDetachedChild, runAsDetachedParent, } from '../dev/detach.js';
 import { stopSession } from '../dev/stop.js';
 import { formatStartedAgo, getAttachLogPaths, getCurrentPreviewUrl, renderLogLine, resolveAttachTarget, startLogTail, startSessionFileWatch, } from '../dev/attach.js';
 import { populateTypes } from '../types-manager.js';
@@ -164,19 +164,31 @@ export async function execDev(options) {
     // fresh machine where `git config --global user.email/.name` has never
     // been set (extremely common on Windows after a clean install).
     ensureGitIdentity(cwd, creds);
-    // Detect user edits made outside of `runwork dev`
+    // Detect user edits made outside of `runwork dev`. When this fires
+    // for an AI agent, it almost always means the agent edited code
+    // before starting dev -- the wrong order. We surface this loudly so
+    // the agent's tool-result-handling can correct course on the next
+    // task. The recommendation is canonical: start `runwork dev --detach`
+    // first, then edit. See DEV_FIRST_RULE.
     const oldManifest = await loadManifest(cwd);
     if (oldManifest) {
         const userEdits = await detectUserEdits(cwd, oldManifest);
         if (userEdits.length > 0) {
             if (useJson) {
-                jsonLine({ event: 'startup', phase: 'user_edits_detected', files: userEdits, timestamp: ts() });
+                jsonLine({
+                    event: 'startup',
+                    phase: 'user_edits_detected',
+                    files: userEdits,
+                    timestamp: ts(),
+                    warning: `Detected ${userEdits.length} file(s) edited before \`runwork dev\` was running. These will be batch-synced now. Next time, start \`runwork dev --detach\` BEFORE editing so changes flow incrementally and you can verify each edit against the preview.`,
+                });
             }
             else {
                 console.log(`Detected ${userEdits.length} file(s) edited outside dev session:`);
                 for (const file of userEdits) {
                     console.log(`  ${file}`);
                 }
+                console.log(yellow(`  Next time, start \`runwork dev --detach\` BEFORE editing -- changes will sync incrementally and the preview will validate each one.`));
             }
             try {
                 execFileSync('git', ['add', '--', ...userEdits], { stdio: 'pipe' });
@@ -552,20 +564,12 @@ async function runDevDetachParent(opts) {
     else {
         console.log(dim('Starting dev session in background...'));
     }
-    // Construct the child's args from our own process.argv. We strip the
-    // marker (so the parent can't accidentally fall into the child path
-    // itself if invoked through a wrapper) and then add it back exactly
-    // once.
-    //
-    // process.argv[0] is the executable, which we replace with
-    // `process.execPath` at spawn time. We forward everything from argv[1]
-    // onwards. This works for both Node (`node script.js dev --detach` ->
-    // ["script.js", "dev", "--detach"]) and Bun-standalone binaries
-    // (`runwork dev --detach` -> ["dev", "--detach"]) because in both cases
-    // re-spawning with execPath + argv.slice(1) reproduces the same
-    // invocation.
-    const userArgs = stripInternalChildFlag(process.argv.slice(1));
-    const childArgs = [...userArgs, INTERNAL_DETACHED_CHILD_FLAG];
+    // `buildChildArgs` reproduces our invocation as args for the child
+    // (which is spawned with the same `process.execPath`), with two
+    // platform-aware tweaks: it skips Bun's auto-injected virtual-FS path
+    // on Windows (which the child runtime re-injects on its own), and it
+    // ensures exactly one copy of the internal-child marker.
+    const childArgs = buildChildArgs(process.argv);
     const outcome = await runAsDetachedParent({
         appDir: cwd,
         expectedAppId: config.appId,

package/dist/commands/init.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { execFileSync } from 'child_process';
+import { execFileSync } from '../utils/subprocess.js';
 import { writeFileSync, existsSync, mkdirSync } from 'fs';
 import { join, resolve } from 'path';
 import { homedir } from 'os';