singleton-pipeline 0.4.0-beta.5 → 0.4.0-beta.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,4 +1,4 @@
1
- # Singleton Pipeline Builder (v0.4.0-beta.5)
1
+ # Singleton Pipeline Builder (v0.4.0-beta.7)
2
2
 
3
3
  [![npm version](https://img.shields.io/npm/v/singleton-pipeline/beta.svg)](https://www.npmjs.com/package/singleton-pipeline)
4
4
  [![npm downloads](https://img.shields.io/npm/dm/singleton-pipeline.svg)](https://www.npmjs.com/package/singleton-pipeline)
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "singleton-pipeline",
3
- "version": "0.4.0-beta.5",
3
+ "version": "0.4.0-beta.7",
4
4
  "description": "Visual pipeline builder for multi-agent AI workflows. Orchestrates Claude Code, Codex, Copilot, and OpenCode under a unified security policy.",
5
5
  "keywords": [
6
6
  "ai",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@singleton/cli",
3
- "version": "0.4.0-beta.5",
3
+ "version": "0.4.0-beta.7",
4
4
  "type": "module",
5
5
  "bin": {
6
6
  "singleton": "./src/index.js"
@@ -202,7 +202,7 @@ const SINGLETON_RAW = [
202
202
  ];
203
203
 
204
204
  const ART_WIDTH = Math.max(...SINGLETON_RAW.map((l) => l.length));
205
- const APP_VERSION = 'v0.4.0-beta.5';
205
+ const APP_VERSION = 'v0.4.0-beta.7';
206
206
 
207
207
  async function showWelcome(root, shell) {
208
208
  const now = new Date();
@@ -22,7 +22,7 @@ function groupAgentsByProvider(agents) {
22
22
  program
23
23
  .name('singleton')
24
24
  .description('Singleton Pipeline Builder — scan agents and build pipelines')
25
- .version('0.4.0-beta.5');
25
+ .version('0.4.0-beta.7');
26
26
 
27
27
  program
28
28
  .command('scan')
@@ -56,10 +56,15 @@ export function buildCopilotPermissionArgs(securityPolicy = {}) {
56
56
  args.push('--allow-tool=write');
57
57
  }
58
58
 
59
+ // Copilot CLI runs in deny-by-default mode as soon as any --allow-tool is
60
+ // present. Agents need shell access to list/grep the codebase even when their
61
+ // write surface is restricted — otherwise the scout can't discover anything.
62
+ // read-only stays shell-less; dangerous is already covered by --allow-all-tools.
59
63
  if (profile === 'read-only') {
60
64
  args.push('--deny-tool=write');
61
65
  args.push('--deny-tool=shell');
62
66
  } else {
67
+ if (profile !== 'dangerous') args.push('--allow-tool=shell');
63
68
  args.push('--deny-tool=shell(git push)');
64
69
  }
65
70
 
@@ -141,7 +146,12 @@ export const copilotRunner = {
141
146
  securityPolicy,
142
147
  timeoutMs = DEFAULT_TIMEOUT_MS,
143
148
  }) {
144
- const prompt = buildPrompt(systemPrompt, userPrompt);
149
+ // When --agent is used, Copilot loads the system prompt from .github/agents/<name>.md.
150
+ // Sending Singleton's combined <system>...<user>...</user> stdin in that case
151
+ // duplicates the system instructions and buries the user inputs in noise. So we
152
+ // pipe ONLY the user prompt when runnerAgent is set — this matches the pattern
153
+ // `copilot -p "<user_message>" --agent <name>` used in standalone bash scripts.
154
+ const prompt = runnerAgent ? userPrompt : buildPrompt(systemPrompt, userPrompt);
145
155
  const args = buildCopilotArgs({ model, runnerAgent, securityPolicy });
146
156
 
147
157
  const { events, stderr } = await new Promise((resolve, reject) => {
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@singleton/server",
3
- "version": "0.4.0-beta.5",
3
+ "version": "0.4.0-beta.7",
4
4
  "type": "module",
5
5
  "main": "./src/index.js",
6
6
  "dependencies": {
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@singleton/web",
3
- "version": "0.4.0-beta.5",
3
+ "version": "0.4.0-beta.7",
4
4
  "private": true,
5
5
  "type": "module",
6
6
  "scripts": {