singleton-pipeline 0.4.0-beta.4 → 0.4.0-beta.6

package/README.md

@@ -1,4 +1,4 @@
-# Singleton Pipeline Builder (v0.4.0-beta.4)
+# Singleton Pipeline Builder (v0.4.0-beta.6)
 
 [![npm version](https://img.shields.io/npm/v/singleton-pipeline/beta.svg)](https://www.npmjs.com/package/singleton-pipeline)
 [![npm downloads](https://img.shields.io/npm/dm/singleton-pipeline.svg)](https://www.npmjs.com/package/singleton-pipeline)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "singleton-pipeline",
-  "version": "0.4.0-beta.4",
+  "version": "0.4.0-beta.6",
   "description": "Visual pipeline builder for multi-agent AI workflows. Orchestrates Claude Code, Codex, Copilot, and OpenCode under a unified security policy.",
   "keywords": [
     "ai",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@singleton/cli",
-  "version": "0.4.0-beta.4",
+  "version": "0.4.0-beta.6",
   "type": "module",
   "bin": {
     "singleton": "./src/index.js"

package/packages/cli/src/commands/repl.js

@@ -202,7 +202,7 @@ const SINGLETON_RAW = [
 ];
 
 const ART_WIDTH = Math.max(...SINGLETON_RAW.map((l) => l.length));
-const APP_VERSION = 'v0.4.0-beta.4';
+const APP_VERSION = 'v0.4.0-beta.6';
 
 async function showWelcome(root, shell) {
   const now     = new Date();

package/packages/cli/src/index.js

@@ -22,7 +22,7 @@ function groupAgentsByProvider(agents) {
 program
   .name('singleton')
   .description('Singleton Pipeline Builder — scan agents and build pipelines')
-  .version('0.4.0-beta.4');
+  .version('0.4.0-beta.6');
 
 program
   .command('scan')

package/packages/cli/src/runners/copilot.js

@@ -56,10 +56,15 @@ export function buildCopilotPermissionArgs(securityPolicy = {}) {
     args.push('--allow-tool=write');
   }
 
+  // Copilot CLI runs in deny-by-default mode as soon as any --allow-tool is
+  // present. Agents need shell access to list/grep the codebase even when their
+  // write surface is restricted — otherwise the scout can't discover anything.
+  // read-only stays shell-less; dangerous is already covered by --allow-all-tools.
   if (profile === 'read-only') {
     args.push('--deny-tool=write');
     args.push('--deny-tool=shell');
   } else {
+    if (profile !== 'dangerous') args.push('--allow-tool=shell');
     args.push('--deny-tool=shell(git push)');
   }
 
@@ -76,10 +81,14 @@ export function buildCopilotPermissionArgs(securityPolicy = {}) {
   return args;
 }
 
-export function buildCopilotArgs({ prompt, model, runnerAgent, securityPolicy = {} } = {}) {
+export function buildCopilotArgs({ model, runnerAgent, securityPolicy = {} } = {}) {
+  // Prompt is written to stdin (see copilotRunner.run) instead of being passed
+  // as `-p <prompt>`. This avoids the Windows command-line length limit (~32KB)
+  // that hits as soon as the scout's context.md is injected into downstream
+  // prompts.
   const args = [
     '-p',
-    prompt,
+    '-',
     '--output-format',
     'json',
     ...buildCopilotPermissionArgs(securityPolicy),
@@ -138,10 +147,10 @@ export const copilotRunner = {
     timeoutMs = DEFAULT_TIMEOUT_MS,
   }) {
     const prompt = buildPrompt(systemPrompt, userPrompt);
-    const args = buildCopilotArgs({ prompt, model, runnerAgent, securityPolicy });
+    const args = buildCopilotArgs({ model, runnerAgent, securityPolicy });
 
     const { events, stderr } = await new Promise((resolve, reject) => {
-      const child = spawn('copilot', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+      const child = spawn('copilot', args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
       const stdoutChunks = [];
       let stderrText = '';
       let timedOut = false;
@@ -152,6 +161,9 @@ export const copilotRunner = {
         setTimeout(() => child.kill('SIGKILL'), 5000).unref();
       }, timeoutMs);
 
+      child.stdin.write(prompt);
+      child.stdin.end();
+
       child.stdout.on('data', (d) => stdoutChunks.push(d.toString()));
       child.stderr.on('data', (d) => (stderrText += d.toString()));
       child.on('error', (err) => {

package/packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@singleton/server",
-  "version": "0.4.0-beta.4",
+  "version": "0.4.0-beta.6",
   "type": "module",
   "main": "./src/index.js",
   "dependencies": {

package/packages/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@singleton/web",
-  "version": "0.4.0-beta.4",
+  "version": "0.4.0-beta.6",
   "private": true,
   "type": "module",
   "scripts": {