If generated and manual instructions conflict, follow the manual project instructions unless they would weaken safety, privacy, or permission limits. Safety, privacy, and explicit deny rules always win.
Name: agent-profile
Description: Local AI-agent setup.
- Languages: typescript
- Frameworks: None declared
- Package managers: npm
- Testing: None declared
- Codex
- Claude
- SDD: Required
- TDD: Required
- Final implementation review: Required
| Permission | Mode |
|---|---|
| filesystem read | allow |
| filesystem write | ask |
| shell run | ask |
| dependency install | ask |
| external network | ask |
| secrets access | deny |
| production access | deny |
- No source-code upload.
- No secret upload.
- No literal tokens in generated configs.
- No telemetry by default.
- No hosted execution in the MVP.
Cursor, Aider, Copilot, hosted gateways, enterprise RBAC, SIEM integrations, and custom sandbox runtimes are out of scope unless an approved spec adds them.
- Run tests.
- Run golden tests when generated files change.
- Run doctor/check once available.
- Review the implementation against the relevant spec.
- List remaining risks or TODOs.
This repository implements a local-first AI Agent Profile Compiler.
The tool defines one canonical ai-profile.yaml and compiles it into
agent-specific configuration for Tabnine, Codex, and Claude.
- Local-first by default.
- No source-code upload.
- No secret upload.
- No hosted execution in the MVP.
- Generated files must be deterministic.
- Safety checks are part of the product, not an afterthought.
- Prefer explicit contracts over implicit behavior.
Use SDD/TDD.
Before implementation:
- Read the relevant spec in
docs/specs/. - Confirm the goal, non-goals, contracts, and acceptance criteria.
- Do not expand scope beyond the spec.
During implementation:
- Add or update tests first where practical.
- Keep changes small and focused.
- Preserve public contracts.
- Do not change generated output fixtures unless the spec explicitly requires it.
After implementation:
- Run tests.
- Run golden tests.
- Run doctor/check if available.
- Review the implementation against the spec.
- List any incomplete or risky items.
For final spec reviews:
- Build a spec-to-test matrix for every MUST, acceptance criterion, and error contract.
- For each item, cite either a focused test or explicit static-only evidence.
- Treat static-only evidence as weaker than a regression test and call that out.
- For local-first, no-upload, no-secret, and no-source-read claims, prefer runtime sentinels over import inspection alone.
- For documented error tables, require table-driven CLI or API tests covering code, exit/status, and redaction behavior.
- For parsers and token formats, review canonical decoding, malformed encodings, size limits, and validation order.
- Document or revert any intentional UX divergence from existing behavior.
Never:
- read or print secrets
- write literal tokens into generated configs
- upload repository content
- add telemetry by default
- execute shell commands without explicit user intent
- install dependencies without explicit user intent
TypeScript source files must start with:
// SPDX-License-Identifier: Apache-2.0
// Copyright (c) 2026 Agent Profile Compiler contributorsDo not add this header to JSON, Markdown, YAML fixtures, or tsconfig files unless a later spec requires it.
Use npm.
- Tabnine
- Codex
- Claude
Do not add Cursor, Aider, Copilot, or enterprise features unless a spec explicitly adds them.
End every implementation task with:
- What changed
- Tests run
- Contract impact
- Security impact
- Remaining risks or TODOs
- Whether the spec acceptance criteria are fully met