runwork 0.10.4 → 0.11.0

package/dist/agents/cursor.js

@@ -5,6 +5,39 @@ import { execFileSync } from '../utils/subprocess.js';
 import { querySqlite, openWritableSqlite } from '../utils/sqlite.js';
 import { whichBinary } from '../utils/which.js';
 import { mergeJsonMcpServers, removeRunworkMcpServers, readJsonConfig, writeJsonConfig } from './utils/json-config.js';
+/**
+ * Merge a new managed list into a markerless on-disk array while preserving
+ * user-added entries.
+ *
+ * existing  = what's currently on disk
+ * baseline  = what we wrote on the previous sync (state.lastInjected). Items
+ *             present here are assumed to be ours; subtracting them from
+ *             existing leaves entries the user added themselves.
+ * incoming  = the new managed set to inject (defaults already filtered for
+ *             opt-outs, merged with team rules)
+ *
+ * If baseline is empty (bootstrap or first run with this CLI version), we
+ * assume nothing currently on disk is ours and preserve all existing entries.
+ */
+export function mergeMarkerless(existing, baseline, incoming) {
+    const baselineSet = new Set(baseline);
+    const userEntries = existing.filter((item) => !baselineSet.has(item));
+    const seen = new Set();
+    const result = [];
+    for (const item of userEntries) {
+        if (!seen.has(item)) {
+            seen.add(item);
+            result.push(item);
+        }
+    }
+    for (const item of incoming) {
+        if (!seen.has(item)) {
+            seen.add(item);
+            result.push(item);
+        }
+    }
+    return result;
+}
 export class CursorAdapter {
     name = 'Cursor';
     slug = 'cursor';
@@ -68,7 +101,7 @@ ${skill.content}`;
         writeFileSync(filePath, mdcContent);
     }
     // ── Agent config (model, permissions via SQLite) ────────────────────
-    async writeAgentConfig(config, scope) {
+    async writeAgentConfig(config, scope, baseline) {
         if (scope !== 'user')
             return;
         // Sandbox network allowlist: merge into ~/.cursor/cli-config.json
@@ -108,10 +141,10 @@ ${skill.content}`;
             }
             if (config.permissionRules && data.composerState) {
                 if (config.permissionRules.allow) {
-                    data.composerState.yoloCommandAllowlist = config.permissionRules.allow;
+                    data.composerState.yoloCommandAllowlist = mergeMarkerless(data.composerState.yoloCommandAllowlist ?? [], baseline?.allow ?? [], config.permissionRules.allow);
                 }
                 if (config.permissionRules.deny) {
-                    data.composerState.yoloCommandDenylist = config.permissionRules.deny;
+                    data.composerState.yoloCommandDenylist = mergeMarkerless(data.composerState.yoloCommandDenylist ?? [], baseline?.deny ?? [], config.permissionRules.deny);
                 }
             }
             try {
@@ -125,6 +158,12 @@ ${skill.content}`;
             db.close();
         }
     }
+    async readManagedBlock(_scope) {
+        // Cursor's yoloCommandAllowlist has no marker — there's no way to read a
+        // managed-subset from disk. The sync loop relies on the `baseline` arg
+        // (state.lastInjected) passed into writeAgentConfig instead.
+        return undefined;
+    }
     /**
      * Merge domains into Cursor's sandbox network policy (~/.cursor/sandbox.json).
      * Schema per https://cursor.com/docs/reference/sandbox:

package/dist/agents/default-config.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Baked-in default permission rules that `runwork sync` injects into each
+ * supported agent's configuration.
+ *
+ * Defaults are user-scope only. They merge with team-managed rules from the
+ * workspace admin and are tracked in `~/.runwork/setup.json` under
+ * `agentDefaults[slug]` so that:
+ *   1. Removals stick: if a user deletes an injected entry, it never returns.
+ *   2. Newly added defaults flow in: CLI upgrades that ship more defaults
+ *      auto-apply on the next sync.
+ *   3. Removed defaults disappear: shrinking the set here also removes the
+ *      entries from users' on-disk config on next sync.
+ *   4. Tool removal resets state: `runwork agents remove <slug>` clears the
+ *      per-agent state, so re-adding the tool starts from a clean bootstrap.
+ *
+ * Only agents whose permission model maps cleanly to command-pattern allow/deny
+ * lists appear here. Codex, Gemini, Cline, and Claude Desktop are intentionally
+ * absent (their config formats are toggle-based or tool-name-based and do not
+ * fit). Network domain allowlisting for those agents is handled separately via
+ * AgentConfigOverride.networkAllowlist in sync.ts.
+ */
+export interface BakedDefaults {
+    allow: string[];
+    deny: string[];
+}
+export declare const RUNWORK_AGENT_DEFAULTS: Record<string, BakedDefaults>;
+/** Schema version recorded in setup.json. Bump when default-injection semantics change. */
+export declare const AGENT_DEFAULTS_SCHEMA_VERSION = 1;
+/** Slugs that have baked-in defaults. */
+export declare function hasBakedDefaults(slug: string): boolean;

package/dist/agents/default-config.js

@@ -0,0 +1,67 @@
+/**
+ * Baked-in default permission rules that `runwork sync` injects into each
+ * supported agent's configuration.
+ *
+ * Defaults are user-scope only. They merge with team-managed rules from the
+ * workspace admin and are tracked in `~/.runwork/setup.json` under
+ * `agentDefaults[slug]` so that:
+ *   1. Removals stick: if a user deletes an injected entry, it never returns.
+ *   2. Newly added defaults flow in: CLI upgrades that ship more defaults
+ *      auto-apply on the next sync.
+ *   3. Removed defaults disappear: shrinking the set here also removes the
+ *      entries from users' on-disk config on next sync.
+ *   4. Tool removal resets state: `runwork agents remove <slug>` clears the
+ *      per-agent state, so re-adding the tool starts from a clean bootstrap.
+ *
+ * Only agents whose permission model maps cleanly to command-pattern allow/deny
+ * lists appear here. Codex, Gemini, Cline, and Claude Desktop are intentionally
+ * absent (their config formats are toggle-based or tool-name-based and do not
+ * fit). Network domain allowlisting for those agents is handled separately via
+ * AgentConfigOverride.networkAllowlist in sync.ts.
+ */
+export const RUNWORK_AGENT_DEFAULTS = {
+    'claude-code': {
+        allow: [
+            'Bash(runwork *)',
+            'Bash(runwork-cli *)',
+            'Bash(git status)',
+            'Bash(git diff:*)',
+            'Bash(git log:*)',
+            'Bash(git branch:*)',
+            'Bash(git show:*)',
+            'Bash(ls:*)',
+            'Bash(pwd)',
+            'Bash(cat:*)',
+        ],
+        deny: [
+            'Bash(rm -rf *)',
+            'Bash(rm -rf /*)',
+            'Bash(sudo rm *)',
+        ],
+    },
+    'cursor': {
+        allow: [
+            'runwork',
+            'runwork *',
+            'runwork-cli',
+            'runwork-cli *',
+            'git status',
+            'git diff',
+            'git log',
+            'git branch',
+            'ls',
+            'pwd',
+            'cat',
+        ],
+        deny: [
+            'rm -rf *',
+            'sudo *',
+        ],
+    },
+};
+/** Schema version recorded in setup.json. Bump when default-injection semantics change. */
+export const AGENT_DEFAULTS_SCHEMA_VERSION = 1;
+/** Slugs that have baked-in defaults. */
+export function hasBakedDefaults(slug) {
+    return slug in RUNWORK_AGENT_DEFAULTS;
+}

package/dist/agents/defaults-merge.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Pure functions for the default-rules merge algorithm.
+ *
+ * The sync loop (commands/sync.ts) wires these together with per-adapter I/O.
+ * Keeping the logic side-effect-free here makes it cheap to unit-test the
+ * tricky lifecycle (bootstrap, opt-out detection, set shrinking) without
+ * mocking filesystem layers.
+ */
+import type { AgentDefaultsState } from '../types.js';
+import type { BakedDefaults } from './default-config.js';
+/** Items present in `lastInjected` but not in `onDisk`. These are entries the user removed since the previous sync. */
+export declare function detectRemovals(lastInjected: string[], onDisk: string[]): string[];
+/** Defaults filtered to exclude anything the user has opted out of. */
+export declare function computeApplicable(baked: string[], optOuts: string[]): string[];
+/**
+ * Dedupe-silently merge of defaults and team rules. Team rules appear after
+ * defaults in the output (the marker block's team-managed half), and dedupe
+ * keeps the team-positioned copy when a default and a team rule are identical
+ * strings. Stable ordering is preserved.
+ */
+export declare function mergeAllow(applicableDefaults: string[], teamRules: string[]): string[];
+export declare function unique(items: string[]): string[];
+/** True if no per-agent state has ever been recorded — first sync after upgrade or fresh install. */
+export declare function isBootstrap(state: AgentDefaultsState | undefined): boolean;
+export interface ResolveResult {
+    /**
+     * Final merged list to write into the managed block.
+     * For marker-based agents (Claude Code): goes after the marker.
+     * For markerless agents (Cursor): becomes part of the array,
+     * with `baseline` used by the adapter to identify and preserve user entries.
+     */
+    managedAllow: string[];
+    managedDeny: string[];
+    /** Defaults that we actually injected this sync. Stored as next sync's lastInjected. */
+    applicableAllow: string[];
+    applicableDeny: string[];
+    /** New sticky opt-out set. Stored as next sync's userOptOuts. */
+    newOptOutsAllow: string[];
+    newOptOutsDeny: string[];
+    /** Diagnostic counts for the sync log. */
+    removalsThisSync: {
+        allow: number;
+        deny: number;
+    };
+    /** True when this sync is the bootstrap pass and skipped default injection. */
+    bootstrapped: boolean;
+}
+export interface ResolveInput {
+    baked: BakedDefaults | undefined;
+    state: AgentDefaultsState | undefined;
+    onDisk: {
+        allow?: string[];
+        deny?: string[];
+    } | undefined;
+    team: {
+        allow?: string[];
+        deny?: string[];
+    } | undefined;
+}
+/**
+ * Single-call resolver for one agent. Consumes the full input set and emits
+ * the merged managed lists plus the next-sync state values. Pure: no I/O.
+ *
+ * Cases:
+ *   1. No baked defaults for this agent → emits team rules only (no defaults
+ *      logic kicks in). State stays undefined.
+ *   2. Bootstrap (state undefined) → applies team rules but does NOT inject
+ *      defaults this sync. Caller initializes empty state for next time.
+ *   3. Normal → detects removals against lastInjected, accumulates opt-outs,
+ *      filters baked by opt-outs, merges with team rules.
+ */
+export declare function resolveAgentDefaults(input: ResolveInput): ResolveResult;

package/dist/agents/defaults-merge.js

@@ -0,0 +1,131 @@
+/**
+ * Pure functions for the default-rules merge algorithm.
+ *
+ * The sync loop (commands/sync.ts) wires these together with per-adapter I/O.
+ * Keeping the logic side-effect-free here makes it cheap to unit-test the
+ * tricky lifecycle (bootstrap, opt-out detection, set shrinking) without
+ * mocking filesystem layers.
+ */
+/** Items present in `lastInjected` but not in `onDisk`. These are entries the user removed since the previous sync. */
+export function detectRemovals(lastInjected, onDisk) {
+    const onDiskSet = new Set(onDisk);
+    return lastInjected.filter((item) => !onDiskSet.has(item));
+}
+/** Defaults filtered to exclude anything the user has opted out of. */
+export function computeApplicable(baked, optOuts) {
+    const optOutSet = new Set(optOuts);
+    return baked.filter((item) => !optOutSet.has(item));
+}
+/**
+ * Dedupe-silently merge of defaults and team rules. Team rules appear after
+ * defaults in the output (the marker block's team-managed half), and dedupe
+ * keeps the team-positioned copy when a default and a team rule are identical
+ * strings. Stable ordering is preserved.
+ */
+export function mergeAllow(applicableDefaults, teamRules) {
+    const teamSet = new Set(teamRules);
+    const result = [];
+    for (const item of applicableDefaults) {
+        if (!teamSet.has(item))
+            result.push(item);
+    }
+    for (const item of teamRules) {
+        result.push(item);
+    }
+    return result;
+}
+export function unique(items) {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        if (!seen.has(item)) {
+            seen.add(item);
+            out.push(item);
+        }
+    }
+    return out;
+}
+/** True if no per-agent state has ever been recorded — first sync after upgrade or fresh install. */
+export function isBootstrap(state) {
+    return state === undefined;
+}
+/**
+ * Single-call resolver for one agent. Consumes the full input set and emits
+ * the merged managed lists plus the next-sync state values. Pure: no I/O.
+ *
+ * Cases:
+ *   1. No baked defaults for this agent → emits team rules only (no defaults
+ *      logic kicks in). State stays undefined.
+ *   2. Bootstrap (state undefined) → applies team rules but does NOT inject
+ *      defaults this sync. Caller initializes empty state for next time.
+ *   3. Normal → detects removals against lastInjected, accumulates opt-outs,
+ *      filters baked by opt-outs, merges with team rules.
+ */
+export function resolveAgentDefaults(input) {
+    const team = input.team ?? {};
+    const teamAllow = team.allow ?? [];
+    const teamDeny = team.deny ?? [];
+    // Case 1: no baked defaults — emit team rules unchanged, no state to track.
+    if (!input.baked) {
+        return {
+            managedAllow: unique(teamAllow),
+            managedDeny: unique(teamDeny),
+            applicableAllow: [],
+            applicableDeny: [],
+            newOptOutsAllow: [],
+            newOptOutsDeny: [],
+            removalsThisSync: { allow: 0, deny: 0 },
+            bootstrapped: false,
+        };
+    }
+    // Case 2: bootstrap — do not inject defaults this pass.
+    if (isBootstrap(input.state)) {
+        return {
+            managedAllow: unique(teamAllow),
+            managedDeny: unique(teamDeny),
+            applicableAllow: [],
+            applicableDeny: [],
+            newOptOutsAllow: [],
+            newOptOutsDeny: [],
+            removalsThisSync: { allow: 0, deny: 0 },
+            bootstrapped: true,
+        };
+    }
+    // Case 3: normal merge.
+    const state = input.state;
+    const lastInjectedAllow = state.lastInjected.allow ?? [];
+    const lastInjectedDeny = state.lastInjected.deny ?? [];
+    const existingOptOutsAllow = state.userOptOuts.allow ?? [];
+    const existingOptOutsDeny = state.userOptOuts.deny ?? [];
+    // Removal detection requires a reliable on-disk read. Markerless adapters
+    // (Cursor) cannot distinguish injected entries from user entries on disk, so
+    // they return `undefined` from readManagedBlock. Treating `undefined` as an
+    // empty array would fabricate a "user removed everything" signal on every
+    // subsequent sync and incorrectly convert every default into a sticky opt-out.
+    // When we cannot read managed state, we trust the baseline mechanism in the
+    // adapter and skip removal detection for this sync.
+    const canDetectRemovals = input.onDisk !== undefined;
+    const newRemovalsAllow = canDetectRemovals
+        ? detectRemovals(lastInjectedAllow, input.onDisk?.allow ?? [])
+        : [];
+    const newRemovalsDeny = canDetectRemovals
+        ? detectRemovals(lastInjectedDeny, input.onDisk?.deny ?? [])
+        : [];
+    const newOptOutsAllow = unique([...existingOptOutsAllow, ...newRemovalsAllow]);
+    const newOptOutsDeny = unique([...existingOptOutsDeny, ...newRemovalsDeny]);
+    const applicableAllow = computeApplicable(input.baked.allow, newOptOutsAllow);
+    const applicableDeny = computeApplicable(input.baked.deny, newOptOutsDeny);
+    return {
+        managedAllow: mergeAllow(applicableAllow, teamAllow),
+        managedDeny: mergeAllow(applicableDeny, teamDeny),
+        applicableAllow,
+        applicableDeny,
+        newOptOutsAllow,
+        newOptOutsDeny,
+        removalsThisSync: {
+            allow: newRemovalsAllow.length,
+            deny: newRemovalsDeny.length,
+        },
+        bootstrapped: false,
+    };
+}

package/dist/agents/types.d.ts

@@ -33,8 +33,37 @@ export interface AgentAdapter {
     mcpProvidesSkills?: boolean;
     /** Write team-managed instructions (separate marker block from auto-generated hint) */
     writeTeamInstructions?(instructions: string, scope: 'project' | 'user'): Promise<void>;
-    /** Write agent-specific config overrides from workspace admin (model, permissions) */
-    writeAgentConfig?(config: AgentConfigOverride, scope: 'project' | 'user'): Promise<void>;
+    /**
+     * Write agent-specific config overrides from workspace admin (model, permissions).
+     *
+     * @param config - The full resolved config to apply this sync (already merged
+     *   with baked defaults and network/minimum settings by the sync loop).
+     * @param scope - Project- or user-scope configuration target.
+     * @param baseline - Optional. The set of managed entries the previous sync
+     *   wrote (lastInjected from setup.json). Adapters that lack on-disk markers
+     *   to distinguish runwork-managed entries from user-added entries (e.g.
+     *   Cursor's yoloCommandAllowlist) use this to subtract our previous
+     *   contribution before re-injecting, preserving user edits. Marker-based
+     *   adapters (Claude Code) can ignore this parameter.
+     */
+    writeAgentConfig?(config: AgentConfigOverride, scope: 'project' | 'user', baseline?: {
+        allow?: string[];
+        deny?: string[];
+    }): Promise<void>;
+    /**
+     * Read the currently-injected managed-block entries for this scope.
+     * Used by sync to detect when the user has removed an entry that we
+     * previously injected (so we can record it as a sticky opt-out).
+     *
+     * For marker-based adapters (Claude Code): returns items after the marker.
+     * For markerless adapters (Cursor): may return undefined; the sync loop
+     * falls back to the `baseline` mechanism (state.lastInjected) for those.
+     * Optional — adapters without a permission file at all (Cline) skip this.
+     */
+    readManagedBlock?(scope: 'project' | 'user'): Promise<{
+        allow?: string[];
+        deny?: string[];
+    } | undefined>;
     /** Remove all Runwork-managed config, skills, MCP entries, and instruction hints.
      *  The manifest lists exactly which resources were synced so only those are removed. */
     cleanup?(scope: 'project' | 'user', manifest?: CleanupManifest): Promise<void>;

package/dist/commands/sync.js

@@ -7,6 +7,8 @@ import { ApiClient } from '../api/client.js';
 import { getAdapterBySlug, detectAgents } from '../agents/detect.js';
 import { CodexAdapter } from '../agents/codex.js';
 import { RUNWORK_MCP_PREFIX, RUNWORK_WORKSPACE_MCP_NAME } from '../agents/types.js';
+import { RUNWORK_AGENT_DEFAULTS, AGENT_DEFAULTS_SCHEMA_VERSION } from '../agents/default-config.js';
+import { resolveAgentDefaults } from '../agents/defaults-merge.js';
 import { collectTelemetryEvents, printTelemetryVerbose, summarizeTelemetryForDryRun, } from './sync-telemetry.js';
 import { generateIntroSkill, generateInstructionHint, buildAppSkillDescription } from '../agents/intro-skill.js';
 import { computeSyncPlan } from '../sync/change-detect.js';
@@ -346,85 +348,170 @@ export async function syncFromState(state, statePath, credentials, opts) {
             }
         }
     }
-    // Pull and apply team instructions from onboarding config (non-fatal)
+    // Pull team config from server. A failure here must not stop the
+    // unified user-scope write below, which applies network and minimum-permission
+    // floors regardless of whether team config was fetched.
     let teamInstructionsApplied = false;
     let agentConfigsApplied = 0;
+    let teamInstructions;
+    let agentConfigs;
     try {
         const onboardingConfig = await client.getOnboardingConfig(state.workspaceId);
-        const teamInstructions = onboardingConfig?.config?.teamInstructions;
-        const agentConfigs = onboardingConfig?.config?.agentConfigs;
-        // Write team instructions and/or per-agent extra instructions.
-        // Either or both may be present independently.
+        teamInstructions = onboardingConfig?.config?.teamInstructions ?? undefined;
+        agentConfigs = onboardingConfig?.config?.agentConfigs ?? undefined;
+    }
+    catch {
+        // Team config pull is non-fatal — proceed with no team-managed overrides.
+    }
+    // Write team instructions and/or per-agent extra instructions.
+    for (const adapter of adapters) {
+        if (!adapter.writeTeamInstructions)
+            continue;
+        const agentExtra = agentConfigs?.[adapter.slug]?.extraInstructions;
+        const parts = [teamInstructions, agentExtra].filter(Boolean);
+        if (parts.length === 0)
+            continue;
+        const fullInstructions = parts.join('\n\n');
+        for (const scope of scopes) {
+            try {
+                await adapter.writeTeamInstructions(fullInstructions, scope);
+                teamInstructionsApplied = true;
+                console.log(`  [${adapter.name}] Updated team instructions (${scope})`);
+            }
+            catch {
+                // Best-effort per adapter/scope
+            }
+        }
+    }
+    // Apply per-agent project-scope config (team overrides only).
+    // User scope is handled below in the unified defaults+network+minimum block.
+    if (agentConfigs) {
         for (const adapter of adapters) {
-            if (!adapter.writeTeamInstructions)
+            const agentConfig = agentConfigs[adapter.slug];
+            if (!agentConfig || !adapter.writeAgentConfig)
                 continue;
-            const agentExtra = agentConfigs?.[adapter.slug]?.extraInstructions;
-            const parts = [teamInstructions, agentExtra].filter(Boolean);
-            if (parts.length === 0)
+            const { extraInstructions: _, ...configWithoutInstructions } = agentConfig;
+            if (Object.keys(configWithoutInstructions).length === 0)
                 continue;
-            const fullInstructions = parts.join('\n\n');
             for (const scope of scopes) {
+                if (scope === 'user')
+                    continue; // handled in unified block below
                 try {
-                    await adapter.writeTeamInstructions(fullInstructions, scope);
-                    teamInstructionsApplied = true;
-                    console.log(`  [${adapter.name}] Updated team instructions (${scope})`);
+                    await adapter.writeAgentConfig(configWithoutInstructions, scope);
+                    agentConfigsApplied++;
+                    const configKeys = Object.keys(configWithoutInstructions).join(', ');
+                    console.log(`  [${adapter.name}] Updated agent config: ${configKeys} (${scope})`);
                 }
                 catch {
                     // Best-effort per adapter/scope
                 }
             }
         }
-        // Apply per-agent config overrides (model preferences, permissions)
-        if (agentConfigs) {
-            for (const adapter of adapters) {
-                const agentConfig = agentConfigs[adapter.slug];
-                if (!agentConfig || !adapter.writeAgentConfig)
-                    continue;
-                // Only apply model/permission config (extraInstructions already handled above)
-                const { extraInstructions: _, ...configWithoutInstructions } = agentConfig;
-                if (Object.keys(configWithoutInstructions).length === 0)
-                    continue;
-                for (const scope of scopes) {
-                    try {
-                        await adapter.writeAgentConfig(configWithoutInstructions, scope);
-                        agentConfigsApplied++;
-                        const configKeys = Object.keys(configWithoutInstructions).join(', ');
-                        console.log(`  [${adapter.name}] Updated agent config: ${configKeys} (${scope})`);
+    }
+    // Unified user-scope write: merge baked defaults with team config, network
+    // allowlist, and minimum permissions into a single writeAgentConfig call
+    // per adapter. The merge layer tracks injected defaults in state.agentDefaults
+    // so user-removed entries become sticky opt-outs.
+    if (scopes.includes('user')) {
+        const networkDomains = ['runwork.ai', '*.runwork.ai'];
+        try {
+            const baseHost = new URL(baseUrl).hostname;
+            if (baseHost !== 'runwork.ai' && !baseHost.endsWith('.runwork.ai')) {
+                networkDomains.push(baseHost, `*.${baseHost}`);
+            }
+        }
+        catch { /* use defaults */ }
+        // Order arrays list each agent's valid values from most restrictive to most
+        // permissive. The floor logic upgrades anything strictly below `minimum`,
+        // including unknown values (-1 < minimumIdx). That makes it critical to
+        // include the agent's most-permissive option in `order` — otherwise a user
+        // who explicitly set, say, `sandbox_mode = "danger-full-access"` gets
+        // silently downgraded to `workspace-write`.
+        const minimumPermissions = [
+            { field: 'approval_policy', order: ['untrusted', 'on-request', 'on-failure', 'never'], minimum: 'on-request' },
+            { field: 'sandbox_mode', order: ['read-only', 'workspace-write', 'danger-full-access'], minimum: 'workspace-write' },
+        ];
+        // agentDefaults lifecycle: full `runwork uninstall` deletes ~/.runwork
+        // (state and all per-agent defaults state with it). Re-running `runwork
+        // setup` overwrites setup.json without agentDefaults so every remaining
+        // tool bootstraps fresh on the next sync. refreshConfiguredAgents only
+        // adds slugs (never removes), so we don't need orphan-entry pruning here.
+        if (!state.agentDefaults)
+            state.agentDefaults = {};
+        for (const adapter of adapters) {
+            if (!adapter.writeAgentConfig)
+                continue;
+            const slug = adapter.slug;
+            const baked = RUNWORK_AGENT_DEFAULTS[slug];
+            const agentState = state.agentDefaults[slug];
+            const team = agentConfigs?.[slug];
+            // onDisk = undefined signals "removal detection is not possible" — used for
+            // markerless adapters (Cursor) and for any adapter without readManagedBlock.
+            // The resolver treats undefined differently from an empty array: it skips
+            // opt-out fabrication entirely and trusts the baseline mechanism in the
+            // adapter to preserve user edits via subtraction.
+            let onDisk;
+            if (baked && adapter.readManagedBlock) {
+                try {
+                    onDisk = await adapter.readManagedBlock('user');
+                }
+                catch {
+                    onDisk = undefined;
+                }
+            }
+            const resolved = resolveAgentDefaults({
+                baked,
+                state: agentState,
+                onDisk,
+                team: team?.permissionRules,
+            });
+            const mergedConfig = {
+                modelPreference: team?.modelPreference,
+                permissionRules: (resolved.managedAllow.length || resolved.managedDeny.length || team?.permissionRules?.defaultMode)
+                    ? {
+                        ...(resolved.managedAllow.length ? { allow: resolved.managedAllow } : {}),
+                        ...(resolved.managedDeny.length ? { deny: resolved.managedDeny } : {}),
+                        ...(team?.permissionRules?.defaultMode ? { defaultMode: team.permissionRules.defaultMode } : {}),
                     }
-                    catch {
-                        // Best-effort per adapter/scope
+                    : undefined,
+                networkAllowlist: networkDomains,
+                minimumPermissions,
+            };
+            try {
+                const baseline = agentState?.lastInjected;
+                await adapter.writeAgentConfig(mergedConfig, 'user', baseline);
+                if (baked) {
+                    const nextState = {
+                        lastInjected: {
+                            allow: resolved.applicableAllow,
+                            deny: resolved.applicableDeny,
+                        },
+                        userOptOuts: {
+                            allow: resolved.newOptOutsAllow,
+                            deny: resolved.newOptOutsDeny,
+                        },
+                    };
+                    state.agentDefaults[slug] = nextState;
+                    // Diagnostic log line (per "invisible / sync log only" policy)
+                    if (resolved.bootstrapped) {
+                        console.log(`  [${adapter.name}] Bootstrapped default-rule tracking (defaults apply on next sync)`);
+                    }
+                    else if (resolved.applicableAllow.length || resolved.applicableDeny.length || resolved.removalsThisSync.allow || resolved.removalsThisSync.deny) {
+                        const totalRemovals = resolved.removalsThisSync.allow + resolved.removalsThisSync.deny;
+                        const removalNote = totalRemovals > 0
+                            ? ` (${totalRemovals} new opt-out${totalRemovals > 1 ? 's' : ''} honored)`
+                            : '';
+                        console.log(`  [${adapter.name}] Applied defaults: ${resolved.applicableAllow.length} allow, ${resolved.applicableDeny.length} deny${removalNote}`);
                     }
                 }
+                if (team)
+                    agentConfigsApplied++;
+            }
+            catch {
+                // Best-effort per adapter
             }
         }
-    }
-    catch {
-        // Team config pull is non-fatal
-    }
-    // Ensure sandbox network access for agents that run in sandboxed environments (e.g. Cursor)
-    const networkDomains = ['runwork.ai', '*.runwork.ai'];
-    try {
-        const baseHost = new URL(baseUrl).hostname;
-        if (baseHost !== 'runwork.ai' && !baseHost.endsWith('.runwork.ai')) {
-            networkDomains.push(baseHost, `*.${baseHost}`);
-        }
-    }
-    catch { /* use defaults */ }
-    for (const adapter of adapters) {
-        if (!adapter.writeAgentConfig)
-            continue;
-        try {
-            await adapter.writeAgentConfig({
-                networkAllowlist: networkDomains,
-                minimumPermissions: [
-                    { field: 'approval_policy', order: ['always', 'untrusted', 'on-request', 'never'], minimum: 'on-request' },
-                    { field: 'sandbox_mode', order: ['full', 'read-only', 'workspace-write', 'off'], minimum: 'workspace-write' },
-                ],
-            }, 'user');
-        }
-        catch {
-            // Best-effort
-        }
+        state.agentDefaultsVersion = AGENT_DEFAULTS_SCHEMA_VERSION;
     }
     // Register ~/.runwork as a project in the Codex desktop app (best-effort).
     // Only attempts when Codex adapter is configured and the desktop app is closed.

package/dist/generated/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.10.4";
+export declare const VERSION = "0.11.0";

package/dist/generated/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/embed-types.ts -- do not edit
-export const VERSION = "0.10.4";
+export const VERSION = "0.11.0";