Skip to content

feat(cli): Phase 3 onboarding and guided flows #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
christopherkarani wants to merge 5 commits into
base: main
Choose a base branch
from
Open

feat(cli): Phase 3 onboarding and guided flows #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d2a142e
feat(cli): Phase 3 onboarding with shared pipeline and guided flows
christopherkarani Jun 1, 2026
d1695dd
feat(policy): sync generic-agent preset for agent DX handoff
christopherkarani Jun 2, 2026
1d72ea2
chore(verify): handoff quick-install DX matrix (strict allow/deny/ask)
christopherkarani Jun 2, 2026
23a5372
feat(policy): sync codex preset with generic-agent handoff
christopherkarani Jun 2, 2026
c3298aa
chore(verify): add test-fast.sh local gate
christopherkarani Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build.zig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ pub fn build(b: *std.Build) void {
const version_override = b.option([]const u8, "version", "Orca version metadata");
const version = blk: {
if (version_override) |v| break :blk v;
const version_file = std.fs.cwd().readFileAlloc(b.allocator, "VERSION", 32) catch break :blk "1.1.0";
const version_file = std.Io.Dir.cwd().readFileAlloc(b.graph.io, "VERSION", b.allocator, .limited(32)) catch break :blk "1.1.0";
const trimmed = std.mem.trim(u8, version_file, " \n\r\t");
const result = b.allocator.dupe(u8, trimmed) catch break :blk "1.1.0";
b.allocator.free(version_file);
Expand Down
96 changes: 87 additions & 9 deletions policies/presets/codex.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,6 @@ files:
allow:
- "./**"
deny:
# Dual patterns (see generic-agent.yaml for rationale).
- "./.git/**"
- ".git/**"
- "./.orca/**"
Expand All @@ -60,7 +59,23 @@ files:
commands:
default: ask
allow:
- "git status"
- "mkdir *"
- "touch *"
- "cp *"
- "mv *"
- "rmdir *"
- "cat *"
- "grep *"
- "find *"
- "head *"
- "tail *"
- "file *"
- "stat *"
- "which *"
- "whoami"
- "id"
- "uname *"
- "git status*"
- "git diff"
- "git diff *"
- "git log"
Expand All @@ -69,6 +84,18 @@ commands:
- "git branch *"
- "git ls-files"
- "git ls-files *"
- "git add *"
- "git commit *"
- "git show *"
- "git stash *"
- "git fetch *"
- "git pull *"
- "git merge *"
- "git remote *"
- "git tag *"
- "git cherry-pick *"
- "git init"
- "git clone *"
- "ls"
- "ls *"
- "pwd"
Expand All @@ -81,22 +108,65 @@ commands:
- "sort *"
- "uniq *"
- "sed -n *"
- "curl *"
- "wget *"
- "tar *"
- "zip *"
- "unzip *"
- "gzip *"
- "gunzip *"
- "xargs *"
- "zig version"
- "zig build"
- "zig build *"
# Narrow, high-value, zero-risk build entrypoints (Phase 2 quick-install DX).
- "make test*"
- "make build*"
- "make check*"
- "zig fmt"
- "npm test*"
- "npm run *"
- "pnpm test*"
- "pnpm run *"
- "yarn test*"
- "yarn run *"
- "go test"
- "go test *"
- "go build"
- "go build *"
- "go run"
- "go run *"
- "go fmt"
- "go fmt *"
- "cargo test"
- "cargo test *"
- "cargo build"
- "cargo build *"
- "cargo run"
- "cargo run *"
- "cargo fmt"
- "cargo check"
- "cargo clippy"
- "swift test*"
- "swift build"
- "swift build *"
- "tsc"
- "tsc *"
- "cmake *"
- "ninja *"
- "make"
- "make all"
- "make clean"
- "make test*"
- "make build*"
- "make check*"
- "prettier *"
- "eslint *"
- "black *"
- "isort *"
- "gofmt *"
- "rustfmt *"
- "clang-format *"
- "python -m pytest*"
- "python -m venv *"
- "python -m pip list*"
- "python -m pip show*"
- "pytest"
- "pytest *"
deny:
Expand All @@ -113,6 +183,12 @@ commands:
- "cat .env"
- "cat ~/.ssh/*"
ask:
- "rm *"
- "go mod *"
- "make install*"
- "git checkout *"
- "git reset *"
- "git rebase *"
- "git push*"
- "npm install*"
- "pnpm install*"
Expand All @@ -121,9 +197,7 @@ commands:

network:
mode: allowlist
# default: deny for the conservative quick-install experience
# (see generic-agent.yaml and src/policy/presets.zig for details).
default: deny
default: ask
allow:
- "api.github.com"
- "*.github.com"
Expand All @@ -133,9 +207,13 @@ network:
- "*.githubusercontent.com"
- "objects.githubusercontent.com"
- "codeload.github.com"
- "api.openai.com"
- "api.anthropic.com"
- "generativelanguage.googleapis.com"
deny:
- "pastebin.com"
- "*.ngrok.io"
- "*.requestbin.net"
detect_exfiltration:
dns: true
long_query_strings: true
Expand Down
104 changes: 86 additions & 18 deletions policies/presets/generic-agent.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,6 @@ files:
allow:
- "./**"
deny:
# Expanded secret protections (kept in sync with the authoritative
# embedded common_strict_rules used by quick-install presets).
- "./.env"
- "./.env.*"
- "~/.ssh/**"
Expand Down Expand Up @@ -77,9 +75,6 @@ files:
allow:
- "./**"
deny:
# Dual patterns for robustness across hook/plugin callers (Hermes,
# OpenClaw, raw CLI) that may normalize paths without leading "./".
# See matchesPath + stripLeadingDotSlash in src/policy/matchers.zig.
- "./.git/**"
- ".git/**"
- "./.orca/**"
Expand All @@ -89,7 +84,23 @@ files:
commands:
default: ask
allow:
- "git status"
- "mkdir *"
- "touch *"
- "cp *"
- "mv *"
- "rmdir *"
- "cat *"
- "grep *"
- "find *"
- "head *"
- "tail *"
- "file *"
- "stat *"
- "which *"
- "whoami"
- "id"
- "uname *"
- "git status*"
- "git diff"
- "git diff *"
- "git log"
Expand All @@ -98,6 +109,18 @@ commands:
- "git branch *"
- "git ls-files"
- "git ls-files *"
- "git add *"
- "git commit *"
- "git show *"
- "git stash *"
- "git fetch *"
- "git pull *"
- "git merge *"
- "git remote *"
- "git tag *"
- "git cherry-pick *"
- "git init"
- "git clone *"
- "ls"
- "ls *"
- "pwd"
Expand All @@ -110,22 +133,65 @@ commands:
- "sort *"
- "uniq *"
- "sed -n *"
- "curl *"
- "wget *"
- "tar *"
- "zip *"
- "unzip *"
- "gzip *"
- "gunzip *"
- "xargs *"
- "zig version"
- "zig build"
- "zig build *"
# Narrow, high-value, zero-risk build entrypoints (Phase 2 quick-install DX).
- "make test*"
- "make build*"
- "make check*"
- "zig fmt"
- "npm test*"
- "npm run *"
- "pnpm test*"
- "pnpm run *"
- "yarn test*"
- "yarn run *"
- "go test"
- "go test *"
- "go build"
- "go build *"
- "go run"
- "go run *"
- "go fmt"
- "go fmt *"
- "cargo test"
- "cargo test *"
- "cargo build"
- "cargo build *"
- "cargo run"
- "cargo run *"
- "cargo fmt"
- "cargo check"
- "cargo clippy"
- "swift test*"
- "swift build"
- "swift build *"
- "tsc"
- "tsc *"
- "cmake *"
- "ninja *"
- "make"
- "make all"
- "make clean"
- "make test*"
- "make build*"
- "make check*"
- "prettier *"
- "eslint *"
- "black *"
- "isort *"
- "gofmt *"
- "rustfmt *"
- "clang-format *"
- "python -m pytest*"
- "python -m venv *"
- "python -m pip list*"
- "python -m pip show*"
- "pytest"
- "pytest *"
deny:
Expand All @@ -142,6 +208,12 @@ commands:
- "cat .env"
- "cat ~/.ssh/*"
ask:
- "rm *"
- "go mod *"
- "make install*"
- "git checkout *"
- "git reset *"
- "git rebase *"
- "git push*"
- "npm install*"
- "pnpm install*"
Expand All @@ -150,23 +222,19 @@ commands:

network:
mode: allowlist
# default: deny is the deliberate conservative choice for the quick-install
# experience (used by `orca init --preset generic-agent` and `setup --auto`).
# Most egress remains reviewable. See embedded common_strict_rules in
# src/policy/presets.zig for the authoritative version shipped in the binary.
default: deny
default: ask
allow:
- "api.github.com"
- "*.github.com"
- "registry.npmjs.org"
- "pypi.org"
ask:
- "*.githubusercontent.com"
# Curated low-risk GitHub CDNs (release artifacts + source tarballs) added
# to reduce unnecessary friction for common legitimate agent fetches
# while keeping the conservative default: deny posture.
- "objects.githubusercontent.com"
- "codeload.github.com"
- "api.openai.com"
- "api.anthropic.com"
- "generativelanguage.googleapis.com"
deny:
- "pastebin.com"
- "*.ngrok.io"
Expand Down
Loading
Loading