runwork 0.10.4 → 0.12.0

package/dist/agents/__tests__/claude-code-managed-block.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/agents/__tests__/claude-code-managed-block.test.js

@@ -0,0 +1,97 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdirSync, writeFileSync, rmSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { ClaudeCodeAdapter } from '../claude-code.js';
+let homeDir;
+let originalHome;
+beforeEach(() => {
+    originalHome = process.env.HOME;
+    homeDir = join(tmpdir(), `runwork-cc-managed-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(join(homeDir, '.claude'), { recursive: true });
+    process.env.HOME = homeDir;
+    // Reset the homedir() cache by mocking it via env (Node's os.homedir reads HOME on macOS/Linux).
+});
+afterEach(() => {
+    if (originalHome)
+        process.env.HOME = originalHome;
+    else
+        delete process.env.HOME;
+    try {
+        rmSync(homeDir, { recursive: true, force: true });
+    }
+    catch { /* ignore */ }
+    vi.restoreAllMocks();
+});
+function writeSettings(settings) {
+    writeFileSync(join(homeDir, '.claude', 'settings.json'), JSON.stringify(settings, null, 2));
+}
+describe('ClaudeCodeAdapter.readManagedBlock (user scope)', () => {
+    it('returns undefined when settings.json is missing', async () => {
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result).toBeUndefined();
+    });
+    it('returns empty arrays when permissions key is absent', async () => {
+        writeSettings({ model: 'claude-sonnet-4-6' });
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result).toEqual({ allow: [], deny: [] });
+    });
+    it('returns empty arrays when marker is absent', async () => {
+        writeSettings({ permissions: { allow: ['Bash(npm test)'], deny: ['Bash(rm)'] } });
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result).toEqual({ allow: [], deny: [] });
+    });
+    it('returns entries after marker in allow', async () => {
+        writeSettings({
+            permissions: {
+                allow: ['Bash(npm test)', '# runwork-managed', 'Bash(runwork *)', 'Bash(git status)'],
+                deny: [],
+            },
+        });
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result?.allow).toEqual(['Bash(runwork *)', 'Bash(git status)']);
+        expect(result?.deny).toEqual([]);
+    });
+    it('returns entries after marker in deny', async () => {
+        writeSettings({
+            permissions: {
+                allow: [],
+                deny: ['Bash(curl evil.com)', '# runwork-managed', 'Bash(rm -rf *)'],
+            },
+        });
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result?.deny).toEqual(['Bash(rm -rf *)']);
+    });
+    it('returns empty when marker exists but nothing follows', async () => {
+        writeSettings({
+            permissions: {
+                allow: ['Bash(npm test)', '# runwork-managed'],
+                deny: [],
+            },
+        });
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result?.allow).toEqual([]);
+    });
+    it('returns undefined on JSON parse error', async () => {
+        writeFileSync(join(homeDir, '.claude', 'settings.json'), '{ not valid json');
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result).toBeUndefined();
+    });
+    it('filters out non-string entries after marker (defensive)', async () => {
+        writeSettings({
+            permissions: {
+                allow: ['# runwork-managed', 'Bash(runwork *)', 42, null, 'Bash(git status)'],
+            },
+        });
+        const adapter = new ClaudeCodeAdapter();
+        const result = await adapter.readManagedBlock('user');
+        expect(result?.allow).toEqual(['Bash(runwork *)', 'Bash(git status)']);
+    });
+});

package/dist/agents/__tests__/codex-minimum-permissions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/agents/__tests__/codex-minimum-permissions.test.js

@@ -0,0 +1,82 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+let mockHomeDir = '/tmp/runwork-cli-codex-min-perms-tests';
+vi.mock('os', async () => {
+    const actual = await vi.importActual('os');
+    return {
+        ...actual,
+        homedir: vi.fn(() => mockHomeDir),
+        platform: vi.fn(() => 'darwin'),
+    };
+});
+import { CodexAdapter } from '../codex.js';
+// Matches the orderings used in sync.ts. Keep these in sync with that file —
+// the whole point of these tests is to lock the floor semantics in place.
+const APPROVAL_FLOOR = {
+    field: 'approval_policy',
+    order: ['untrusted', 'on-request', 'on-failure', 'never'],
+    minimum: 'on-request',
+};
+const SANDBOX_FLOOR = {
+    field: 'sandbox_mode',
+    order: ['read-only', 'workspace-write', 'danger-full-access'],
+    minimum: 'workspace-write',
+};
+describe('CodexAdapter minimumPermissions floors', () => {
+    let tempHomeDir;
+    let configPath;
+    beforeEach(() => {
+        tempHomeDir = mkdtempSync(join(tmpdir(), 'runwork-codex-floors-'));
+        mockHomeDir = tempHomeDir;
+        mkdirSync(join(tempHomeDir, '.codex'), { recursive: true });
+        configPath = join(tempHomeDir, '.codex', 'config.toml');
+    });
+    afterEach(() => {
+        rmSync(tempHomeDir, { recursive: true, force: true });
+    });
+    function readConfig() {
+        return existsSync(configPath) ? readFileSync(configPath, 'utf-8') : '';
+    }
+    it('preserves danger-full-access (more permissive than the floor)', async () => {
+        writeFileSync(configPath, `sandbox_mode = "danger-full-access"\n`);
+        const adapter = new CodexAdapter();
+        await adapter.writeAgentConfig({ minimumPermissions: [SANDBOX_FLOOR] }, 'user');
+        expect(readConfig()).toContain('sandbox_mode = "danger-full-access"');
+    });
+    it('preserves "never" approval_policy (more permissive than the floor)', async () => {
+        writeFileSync(configPath, `approval_policy = "never"\n`);
+        const adapter = new CodexAdapter();
+        await adapter.writeAgentConfig({ minimumPermissions: [APPROVAL_FLOOR] }, 'user');
+        expect(readConfig()).toContain('approval_policy = "never"');
+    });
+    it('preserves "on-failure" approval_policy (between floor and "never")', async () => {
+        // Regression for the case where on-failure was missing from the order
+        // array, making it look "unknown" and triggering an unwanted downgrade.
+        writeFileSync(configPath, `approval_policy = "on-failure"\n`);
+        const adapter = new CodexAdapter();
+        await adapter.writeAgentConfig({ minimumPermissions: [APPROVAL_FLOOR] }, 'user');
+        expect(readConfig()).toContain('approval_policy = "on-failure"');
+    });
+    it('upgrades restrictive "read-only" sandbox_mode to the floor', async () => {
+        writeFileSync(configPath, `sandbox_mode = "read-only"\n`);
+        const adapter = new CodexAdapter();
+        await adapter.writeAgentConfig({ minimumPermissions: [SANDBOX_FLOOR] }, 'user');
+        expect(readConfig()).toContain('sandbox_mode = "workspace-write"');
+    });
+    it('upgrades restrictive "untrusted" approval_policy to the floor', async () => {
+        writeFileSync(configPath, `approval_policy = "untrusted"\n`);
+        const adapter = new CodexAdapter();
+        await adapter.writeAgentConfig({ minimumPermissions: [APPROVAL_FLOOR] }, 'user');
+        expect(readConfig()).toContain('approval_policy = "on-request"');
+    });
+    it('sets the floor when the field is absent', async () => {
+        writeFileSync(configPath, `model = "gpt-5"\n`);
+        const adapter = new CodexAdapter();
+        await adapter.writeAgentConfig({ minimumPermissions: [APPROVAL_FLOOR, SANDBOX_FLOOR] }, 'user');
+        const content = readConfig();
+        expect(content).toContain('approval_policy = "on-request"');
+        expect(content).toContain('sandbox_mode = "workspace-write"');
+    });
+});

package/dist/agents/__tests__/cursor-merge.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/agents/__tests__/cursor-merge.test.js

@@ -0,0 +1,66 @@
+import { describe, it, expect } from 'vitest';
+import { mergeMarkerless } from '../cursor.js';
+describe('mergeMarkerless (Cursor markerless merge helper)', () => {
+    it('bootstrap: empty baseline preserves all existing user entries', () => {
+        // First sync after upgrade. No baseline yet. The two existing entries
+        // are presumed to be the user's own personal yolo rules.
+        const existing = ['myPersonalRule', 'anotherUserRule'];
+        const baseline = [];
+        const incoming = ['Bash(runwork *)'];
+        expect(mergeMarkerless(existing, baseline, incoming)).toEqual([
+            'myPersonalRule',
+            'anotherUserRule',
+            'Bash(runwork *)',
+        ]);
+    });
+    it('normal: baseline entries are subtracted so they can be re-injected fresh', () => {
+        // Previous sync wrote ['Bash(runwork *)', 'Bash(git status)']. User added
+        // 'myPersonalRule' between syncs. Now we want to inject defaults again.
+        const existing = ['myPersonalRule', 'Bash(runwork *)', 'Bash(git status)'];
+        const baseline = ['Bash(runwork *)', 'Bash(git status)'];
+        const incoming = ['Bash(runwork *)', 'Bash(git status)', 'Bash(ls)'];
+        // User entry stays; baseline entries are removed first then re-added via incoming.
+        expect(mergeMarkerless(existing, baseline, incoming)).toEqual([
+            'myPersonalRule',
+            'Bash(runwork *)',
+            'Bash(git status)',
+            'Bash(ls)',
+        ]);
+    });
+    it('handles user removing a baseline entry: not re-added unless in incoming', () => {
+        // We wrote [a, b]. User removed 'a'. Sync passes baseline=[a,b] and incoming=[b]
+        // (because the sync layer detected the removal and stripped 'a' from defaults).
+        const existing = ['userRule', 'b'];
+        const baseline = ['a', 'b'];
+        const incoming = ['b'];
+        expect(mergeMarkerless(existing, baseline, incoming)).toEqual(['userRule', 'b']);
+    });
+    it('dedupes when a user entry happens to equal an incoming entry', () => {
+        const existing = ['Bash(runwork *)'];
+        const baseline = [];
+        const incoming = ['Bash(runwork *)', 'Bash(ls)'];
+        // The user already has 'Bash(runwork *)' (looks like their personal rule).
+        // We don't add a duplicate; the incoming one is skipped.
+        expect(mergeMarkerless(existing, baseline, incoming)).toEqual([
+            'Bash(runwork *)',
+            'Bash(ls)',
+        ]);
+    });
+    it('empty incoming leaves user entries intact', () => {
+        expect(mergeMarkerless(['a', 'b'], [], [])).toEqual(['a', 'b']);
+    });
+    it('empty existing returns incoming as-is', () => {
+        expect(mergeMarkerless([], [], ['Bash(runwork *)'])).toEqual(['Bash(runwork *)']);
+    });
+    it('preserves order of user entries before incoming entries', () => {
+        expect(mergeMarkerless(['user1', 'user2'], [], ['inc1', 'inc2'])).toEqual([
+            'user1',
+            'user2',
+            'inc1',
+            'inc2',
+        ]);
+    });
+    it('dedupes within existing (defensive)', () => {
+        expect(mergeMarkerless(['a', 'a', 'b'], [], ['c'])).toEqual(['a', 'b', 'c']);
+    });
+});

package/dist/agents/__tests__/defaults-merge.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/agents/__tests__/defaults-merge.test.js

@@ -0,0 +1,268 @@
+import { describe, it, expect } from 'vitest';
+import { detectRemovals, computeApplicable, mergeAllow, isBootstrap, resolveAgentDefaults, unique, } from '../defaults-merge.js';
+describe('detectRemovals', () => {
+    it('returns lastInjected items missing from onDisk', () => {
+        expect(detectRemovals(['a', 'b', 'c'], ['a', 'c'])).toEqual(['b']);
+    });
+    it('returns empty when nothing was removed', () => {
+        expect(detectRemovals(['a', 'b'], ['a', 'b', 'c'])).toEqual([]);
+    });
+    it('returns all when onDisk is empty', () => {
+        expect(detectRemovals(['a', 'b'], [])).toEqual(['a', 'b']);
+    });
+    it('returns empty when lastInjected is empty', () => {
+        expect(detectRemovals([], ['a', 'b'])).toEqual([]);
+    });
+});
+describe('computeApplicable', () => {
+    it('filters out opted-out items', () => {
+        expect(computeApplicable(['a', 'b', 'c'], ['b'])).toEqual(['a', 'c']);
+    });
+    it('returns full set when no opt-outs', () => {
+        expect(computeApplicable(['a', 'b'], [])).toEqual(['a', 'b']);
+    });
+    it('returns empty when everything is opted out', () => {
+        expect(computeApplicable(['a', 'b'], ['a', 'b'])).toEqual([]);
+    });
+});
+describe('mergeAllow', () => {
+    it('places defaults before team rules', () => {
+        expect(mergeAllow(['default1', 'default2'], ['team1'])).toEqual([
+            'default1',
+            'default2',
+            'team1',
+        ]);
+    });
+    it('dedupes silently when team rule equals default', () => {
+        expect(mergeAllow(['Bash(runwork *)', 'Bash(git status)'], ['Bash(runwork *)'])).toEqual([
+            'Bash(git status)',
+            'Bash(runwork *)',
+        ]);
+    });
+    it('preserves order within each segment', () => {
+        expect(mergeAllow(['a', 'b', 'c'], ['x', 'y'])).toEqual(['a', 'b', 'c', 'x', 'y']);
+    });
+    it('handles empty team rules', () => {
+        expect(mergeAllow(['a', 'b'], [])).toEqual(['a', 'b']);
+    });
+    it('handles empty defaults', () => {
+        expect(mergeAllow([], ['x', 'y'])).toEqual(['x', 'y']);
+    });
+});
+describe('unique', () => {
+    it('removes duplicates preserving first-seen order', () => {
+        expect(unique(['a', 'b', 'a', 'c', 'b'])).toEqual(['a', 'b', 'c']);
+    });
+});
+describe('isBootstrap', () => {
+    it('true when state is undefined', () => {
+        expect(isBootstrap(undefined)).toBe(true);
+    });
+    it('false when state is defined (even if empty)', () => {
+        const state = {
+            lastInjected: {},
+            userOptOuts: {},
+        };
+        expect(isBootstrap(state)).toBe(false);
+    });
+});
+describe('resolveAgentDefaults', () => {
+    const baked = {
+        allow: ['Bash(runwork *)', 'Bash(git status)', 'Bash(ls:*)'],
+        deny: ['Bash(rm -rf *)'],
+    };
+    it('case 1: no baked defaults emits team rules unchanged', () => {
+        const result = resolveAgentDefaults({
+            baked: undefined,
+            state: undefined,
+            onDisk: undefined,
+            team: { allow: ['custom'], deny: [] },
+        });
+        expect(result.managedAllow).toEqual(['custom']);
+        expect(result.managedDeny).toEqual([]);
+        expect(result.applicableAllow).toEqual([]);
+        expect(result.bootstrapped).toBe(false);
+    });
+    it('case 2: bootstrap does NOT inject defaults but applies team rules', () => {
+        const result = resolveAgentDefaults({
+            baked,
+            state: undefined,
+            onDisk: { allow: ['userPersonalRule'] },
+            team: { allow: ['teamRule'] },
+        });
+        expect(result.managedAllow).toEqual(['teamRule']);
+        expect(result.applicableAllow).toEqual([]);
+        expect(result.bootstrapped).toBe(true);
+        expect(result.newOptOutsAllow).toEqual([]);
+    });
+    it('case 3 normal: injects baked defaults when state has empty injection', () => {
+        const state = {
+            lastInjected: { allow: [], deny: [] },
+            userOptOuts: { allow: [], deny: [] },
+        };
+        const result = resolveAgentDefaults({
+            baked,
+            state,
+            onDisk: { allow: [], deny: [] },
+            team: undefined,
+        });
+        expect(result.managedAllow).toEqual(baked.allow);
+        expect(result.managedDeny).toEqual(baked.deny);
+        expect(result.applicableAllow).toEqual(baked.allow);
+        expect(result.bootstrapped).toBe(false);
+    });
+    it('case 3 normal: sticky opt-out — removed entry stays out next sync', () => {
+        // Previous sync injected the 3 defaults. User removed 'Bash(ls:*)' from
+        // settings.json. On the next sync we should detect that and never
+        // re-inject it.
+        const state = {
+            lastInjected: { allow: baked.allow, deny: baked.deny },
+            userOptOuts: { allow: [], deny: [] },
+        };
+        const result = resolveAgentDefaults({
+            baked,
+            state,
+            onDisk: { allow: ['Bash(runwork *)', 'Bash(git status)'], deny: baked.deny },
+            team: undefined,
+        });
+        expect(result.newOptOutsAllow).toEqual(['Bash(ls:*)']);
+        expect(result.applicableAllow).toEqual(['Bash(runwork *)', 'Bash(git status)']);
+        expect(result.managedAllow).toEqual(['Bash(runwork *)', 'Bash(git status)']);
+        expect(result.removalsThisSync.allow).toBe(1);
+    });
+    it('case 3 normal: opt-out persists even when on-disk equals lastInjected', () => {
+        // User opted out 'Bash(ls:*)' two syncs ago. Sync after that ran with
+        // applicable = [runwork *, git status]. Now another sync: on-disk has
+        // exactly that. We should NOT re-inject 'Bash(ls:*)'.
+        const state = {
+            lastInjected: { allow: ['Bash(runwork *)', 'Bash(git status)'] },
+            userOptOuts: { allow: ['Bash(ls:*)'] },
+        };
+        const result = resolveAgentDefaults({
+            baked,
+            state,
+            onDisk: { allow: ['Bash(runwork *)', 'Bash(git status)'] },
+            team: undefined,
+        });
+        expect(result.applicableAllow).toEqual(['Bash(runwork *)', 'Bash(git status)']);
+        expect(result.newOptOutsAllow).toEqual(['Bash(ls:*)']);
+        expect(result.removalsThisSync.allow).toBe(0);
+    });
+    it('case 3 normal: baked-default shrink auto-removes from managed block', () => {
+        // CLI used to inject ['a','b','c']. New CLI version only has ['a','b'].
+        // Previous sync recorded ['a','b','c'] as lastInjected. User did not
+        // touch settings.json — onDisk still has ['a','b','c']. Next sync:
+        // 'c' is no longer in baked → applicable = ['a','b'] → managed = ['a','b'].
+        // No opt-out should be created for 'c' (it was a baked-default removal,
+        // not a user removal).
+        const oldBaked = {
+            allow: ['a', 'b', 'c'],
+            deny: [],
+        };
+        const newBaked = {
+            allow: ['a', 'b'],
+            deny: [],
+        };
+        const state = {
+            lastInjected: { allow: oldBaked.allow },
+            userOptOuts: { allow: [] },
+        };
+        const result = resolveAgentDefaults({
+            baked: newBaked,
+            state,
+            onDisk: { allow: ['a', 'b', 'c'] },
+            team: undefined,
+        });
+        expect(result.applicableAllow).toEqual(['a', 'b']);
+        expect(result.managedAllow).toEqual(['a', 'b']);
+        // 'c' was on-disk so detectRemovals doesn't flag it; opt-outs stay empty.
+        expect(result.newOptOutsAllow).toEqual([]);
+    });
+    it('case 3 normal: team rules dedupe silently with defaults', () => {
+        const state = {
+            lastInjected: { allow: [] },
+            userOptOuts: { allow: [] },
+        };
+        const result = resolveAgentDefaults({
+            baked: { allow: ['Bash(runwork *)', 'Bash(ls:*)'], deny: [] },
+            state,
+            onDisk: { allow: [] },
+            team: { allow: ['Bash(runwork *)', 'Bash(npm test)'] },
+        });
+        // Default 'Bash(runwork *)' overlaps with team; team copy wins on position.
+        expect(result.managedAllow).toEqual([
+            'Bash(ls:*)',
+            'Bash(runwork *)',
+            'Bash(npm test)',
+        ]);
+    });
+    it('case 3 normal: simultaneous removal + new baked addition', () => {
+        // Previous sync injected ['a','b']. User removed 'a'. CLI added 'c'.
+        // Result: applicable = ['b','c'] (a opted out, c is new).
+        const state = {
+            lastInjected: { allow: ['a', 'b'] },
+            userOptOuts: { allow: [] },
+        };
+        const result = resolveAgentDefaults({
+            baked: { allow: ['a', 'b', 'c'], deny: [] },
+            state,
+            onDisk: { allow: ['b'] },
+            team: undefined,
+        });
+        expect(result.newOptOutsAllow).toEqual(['a']);
+        expect(result.applicableAllow).toEqual(['b', 'c']);
+    });
+    it('case 3 markerless: undefined onDisk does NOT fabricate opt-outs (Cursor)', () => {
+        // Cursor's readManagedBlock returns undefined because there's no marker
+        // on disk to identify our entries. The resolver must NOT treat that as
+        // "everything was removed" — otherwise every default becomes a sticky
+        // opt-out after the first injection, corrupting setup.json forever.
+        const state = {
+            lastInjected: { allow: ['runwork', 'git status', 'ls'] },
+            userOptOuts: { allow: [] },
+        };
+        const result = resolveAgentDefaults({
+            baked,
+            state,
+            onDisk: undefined,
+            team: undefined,
+        });
+        // No new opt-outs created from the missing read.
+        expect(result.newOptOutsAllow).toEqual([]);
+        expect(result.removalsThisSync.allow).toBe(0);
+        // Defaults are still applied (filtered by any existing opt-outs).
+        expect(result.applicableAllow).toEqual(baked.allow);
+    });
+    it('case 3 markerless: existing opt-outs are preserved when onDisk is undefined', () => {
+        // User had previously opted out of 'Bash(ls:*)' (recorded in state).
+        // This sync's onDisk read came back undefined. We must keep the existing
+        // opt-out, not silently re-inject the default.
+        const state = {
+            lastInjected: { allow: ['Bash(runwork *)', 'Bash(git status)'] },
+            userOptOuts: { allow: ['Bash(ls:*)'] },
+        };
+        const result = resolveAgentDefaults({
+            baked,
+            state,
+            onDisk: undefined,
+            team: undefined,
+        });
+        expect(result.newOptOutsAllow).toEqual(['Bash(ls:*)']);
+        expect(result.applicableAllow).not.toContain('Bash(ls:*)');
+    });
+    it('case 3 normal: deny side mirrors allow side', () => {
+        const state = {
+            lastInjected: { deny: ['Bash(rm -rf *)', 'Bash(sudo rm *)'] },
+            userOptOuts: { deny: [] },
+        };
+        const result = resolveAgentDefaults({
+            baked: { allow: [], deny: ['Bash(rm -rf *)', 'Bash(sudo rm *)'] },
+            state,
+            onDisk: { deny: ['Bash(rm -rf *)'] },
+            team: undefined,
+        });
+        expect(result.newOptOutsDeny).toEqual(['Bash(sudo rm *)']);
+        expect(result.applicableDeny).toEqual(['Bash(rm -rf *)']);
+        expect(result.managedDeny).toEqual(['Bash(rm -rf *)']);
+    });
+});

package/dist/agents/__tests__/intro-skill.test.js

@@ -158,4 +158,36 @@ describe('generateInstructionHint', () => {
         expect(hint).toContain('2 apps');
         expect(hint).toContain('3 skills');
     });
+    it('omits the persona block when no persona is provided', () => {
+        const hint = generateInstructionHint(baseCtx);
+        expect(hint).not.toContain('Communicating with this user');
+    });
+    it('omits the persona block for engineers (level 3)', () => {
+        const hint = generateInstructionHint({ ...baseCtx, persona: { level: 3, label: 'engineer' } });
+        expect(hint).not.toContain('Communicating with this user');
+    });
+    it('adds a novice persona block (level 1) telling agents to avoid dev tooling', () => {
+        const hint = generateInstructionHint({ ...baseCtx, persona: { level: 1, label: 'novice' } });
+        expect(hint).toContain('Communicating with this user');
+        expect(hint).toContain('not a software developer');
+        expect(hint).toContain('npm, bun, node');
+        // The persona block must stay inside the replaceable runwork markers.
+        const start = hint.indexOf('<!-- runwork:start -->');
+        const end = hint.indexOf('<!-- runwork:end -->');
+        expect(hint.indexOf('Communicating with this user')).toBeGreaterThan(start);
+        expect(hint.indexOf('Communicating with this user')).toBeLessThan(end);
+    });
+    it('adds a curious persona block (level 2)', () => {
+        const hint = generateInstructionHint({ ...baseCtx, persona: { level: 2, label: 'curious' } });
+        expect(hint).toContain('Communicating with this user');
+        expect(hint).toContain('some familiarity with AI tools');
+    });
+});
+describe('generateIntroSkill — environment variables', () => {
+    it('documents that apps have no custom env var system', () => {
+        const skill = generateIntroSkill(makeContext());
+        expect(skill.content).toContain('Environment variables and secrets');
+        expect(skill.content).toContain('do NOT have a custom environment variable');
+        expect(skill.content).toContain('.env');
+    });
 });

package/dist/agents/claude-code.d.ts

@@ -13,6 +13,11 @@ export declare class ClaudeCodeAdapter implements AgentAdapter {
     writeAgentConfig(config: AgentConfigOverride, scope: 'project' | 'user'): Promise<void>;
     /** Remove the managed marker and all entries after it from a permissions array */
     private removeAfterMarker;
+    /** Return entries after the managed marker for both allow and deny lists. */
+    readManagedBlock(scope: 'project' | 'user'): Promise<{
+        allow?: string[];
+        deny?: string[];
+    } | undefined>;
     cleanup(scope: 'project' | 'user', manifest?: CleanupManifest): Promise<void>;
     readUsageStats(lastSyncAt: string | null): Promise<AgentUsageStats | null>;
     readSkillUsage(lastSyncAt: string | null): Promise<SkillUsageEntry[] | null>;

package/dist/agents/claude-code.js

@@ -203,6 +203,35 @@ export class ClaudeCodeAdapter {
         const idx = arr.indexOf(marker);
         return idx >= 0 ? arr.slice(0, idx) : [...arr];
     }
+    /** Return entries after the managed marker for both allow and deny lists. */
+    async readManagedBlock(scope) {
+        const settingsPath = scope === 'project'
+            ? join(process.cwd(), '.claude', 'settings.json')
+            : join(homedir(), '.claude', 'settings.json');
+        if (!existsSync(settingsPath))
+            return undefined;
+        const MANAGED_MARKER = '# runwork-managed';
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+            const perms = settings?.permissions;
+            if (!perms || typeof perms !== 'object')
+                return { allow: [], deny: [] };
+            const extractAfter = (arr) => {
+                if (!Array.isArray(arr))
+                    return [];
+                const idx = arr.indexOf(MANAGED_MARKER);
+                return idx >= 0 ? arr.slice(idx + 1).filter((x) => typeof x === 'string') : [];
+            };
+            return {
+                allow: extractAfter(perms.allow),
+                deny: extractAfter(perms.deny),
+            };
+        }
+        catch {
+            return undefined;
+        }
+    }
     // ── Cleanup (uninstall) ────────────────────────────────────────────
     async cleanup(scope, manifest) {
         // 1. Remove MCP server entries

package/dist/agents/cursor.d.ts

@@ -1,4 +1,19 @@
 import type { AgentAdapter, AgentConfigOverride, AgentUsageStats, CleanupManifest, McpServerEntry, SkillFile } from './types.js';
+/**
+ * Merge a new managed list into a markerless on-disk array while preserving
+ * user-added entries.
+ *
+ * existing  = what's currently on disk
+ * baseline  = what we wrote on the previous sync (state.lastInjected). Items
+ *             present here are assumed to be ours; subtracting them from
+ *             existing leaves entries the user added themselves.
+ * incoming  = the new managed set to inject (defaults already filtered for
+ *             opt-outs, merged with team rules)
+ *
+ * If baseline is empty (bootstrap or first run with this CLI version), we
+ * assume nothing currently on disk is ours and preserve all existing entries.
+ */
+export declare function mergeMarkerless(existing: string[], baseline: string[], incoming: string[]): string[];
 export declare class CursorAdapter implements AgentAdapter {
     name: string;
     slug: string;
@@ -10,7 +25,14 @@ export declare class CursorAdapter implements AgentAdapter {
     writeSkills(skills: SkillFile[], scope: 'project' | 'user'): Promise<void>;
     writeInstructionHint(hint: string, scope: 'project' | 'user'): Promise<void>;
     writeTeamInstructions(instructions: string, scope: 'project' | 'user'): Promise<void>;
-    writeAgentConfig(config: AgentConfigOverride, scope: 'project' | 'user'): Promise<void>;
+    writeAgentConfig(config: AgentConfigOverride, scope: 'project' | 'user', baseline?: {
+        allow?: string[];
+        deny?: string[];
+    }): Promise<void>;
+    readManagedBlock(_scope: 'project' | 'user'): Promise<{
+        allow?: string[];
+        deny?: string[];
+    } | undefined>;
     /**
      * Merge domains into Cursor's sandbox network policy (~/.cursor/sandbox.json).
      * Schema per https://cursor.com/docs/reference/sandbox: