@brainervirus/workit-opencode 0.9.2 → 0.11.0

package/assets/skills/wk-init/SKILL.md

@@ -19,7 +19,7 @@ Never ask for or accept tokens in chat. For missing YouTrack configuration, prev
 
 When the user wants to personalize the toolkit (locale, timezone, branch policy), ask native questions one at a time:
 
-1. **Locale** — present a combobox of `localeOptions` (en, es-CL, es-MX, es-AR, pt-BR) + custom answer; validate the answer against BCP-47 (`^[a-z]{2,3}(-[A-Z]{2})?$`) before passing it.
+1. **Locale** — present a combobox of `localeOptions` (en, es-CL, es-MX, es-AR, pt-BR) + custom answer; validate the answer against BCP-47 (`^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$`, so `es-419` is valid) before passing it.
 2. **Timezone** — e.g. `America/Santiago`, custom allowed.
 3. **Branch policy preset** — gitflow / github-flow / trunk-based / custom.
 4. **Custom branch lists** (only when preset = custom): allowed patterns (`feature/*`, `codex/*`, …) and protected names (`main`, …).

package/assets/templates/execution-contract.md

@@ -24,10 +24,10 @@ This session is a handoff destination for a continued plan. The originating sess
 - Working state, briefs, ledgers, and review diffs live only under gitignored `<SDD_DIR>` in `docs/<slug>/sdd/` and use `workit_sdd_*` tools.
 - Use native `todowrite` for visible task state as well as the gitignored ledger.
 - Use native `question` for branch/stash choices and guarded external mutations; call mutation tools only after approval with `confirmed: true` (grounded in the recorded NativeChoiceEvidence).
-- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`) and subagent-driven execution is rejected as unsupported.
+- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`), Subagent-driven execution is supported through the one-time `coordinator_lease` and per-task `delegation_token` minted by `workit_delegate` (fail-closed validation; no `parentID` identity exists on Cursor), and Inline runs single-agent in the current session.
 - Delegated authority is direct-child-only: a worker is the session whose host `parentID` exactly equals the activating coordinator's recorded `coordinator_session_id`; missing, mismatched, or multi-owner lineage fails closed with `delegation_lineage_denied`, and nested `opencode` launches are denied during active delegated work. An authorized child receives only the compact worker contract (execute the supplied brief, follow TDD, land one contiguous non-empty commit range, report results) — never coordinator guidance, `wk-implement`, or ledger management; coordinator bookkeeping via `workit_sdd_*` stays with the coordinator session.
 - On Cursor, for every repository-scoped `workit_*` call, pass the active Cursor workspace as `workspace_root`; never rely on the MCP process default.
-- Use native `task` with only the built-in `explore` and `general` agents.
+- Use native `task` with only the built-in `explore` and `general` agents (OpenCode); on Cursor, Subagent-driven dispatches Cursor-native subagents with a task `delegation_token`, Inline runs single-agent in the current session.
 
 ## Flow gates (HARD)
 
@@ -51,7 +51,7 @@ For each top-level task absent from `completed_task_ids`:
 
 1. Mark it `in_progress` with `todowrite`.
 2. Create a working-state brief with `workit_sdd_task_brief` and `confirmed: true`.
-3. Delegate read-only discovery, when needed, to an `explore` agent. Delegate implementation to a fresh `general` agent. Product changes follow TDD.
+3. Route by the approved execution mode: **Subagent-driven** delegates read-only discovery to an `explore` (OpenCode) agent, delegates implementation to a fresh `general` (OpenCode) agent (on Cursor, the coordinator mints a `delegation_token` with `workit_delegate` and the subagent prompt carries the raw token — the worker passes it as `delegation_token` on its mutation calls, and appending progress revokes it), and the coordinator never edits product code; **Inline** executes every task in the current agent with no dispatch and no token minting. Product changes follow TDD.
 4. Create a working-state diff with `workit_sdd_review_package` and `confirmed: true`.
 5. Delegate spec-compliance review and code-quality review to separate `general` agents.
 6. **Blocking** findings (Critical, Important, or spec-compliance) may trigger at most **two** fix+re-review rounds per task. **Advisory** findings (Minor, style, YAGNI, taste) never pause the loop — append them with `workit_sdd_append_advisory` (`--task <id> --text <text>`, `confirmed: true`) instead of an unrestricted file edit.

package/assets/templates/plan-template.md

@@ -1,6 +1,6 @@
 # <Feature> Implementation Plan
 
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. On Cursor the two paths are: **Subagent-driven** — Cursor-native subagents dispatched by the coordinator, each carrying a task-scoped `delegation_token` minted with `workit_delegate` from the one-time `coordinator_lease`; **Inline** — `executing-plans` in the current session, single-agent, no dispatch, no token minting. Steps use checkbox (`- [ ]`) syntax for tracking.
 
 **Spec:** `docs/<slug>/spec.md`
 **Branch:** `feature/<slug>`

package/assets/templates/superpowers-doc-contract.md

@@ -1,6 +1,6 @@
 # Superpowers document contract
 
-Use OpenCode's native `question` for every bounded user choice. Give concise choices and allow a custom answer; if the tool is unavailable, ask one concise plain-text question. Use `skill` to load workflow and Superpowers skills, `todowrite` for task state, and `task` for delegated work.
+Use OpenCode's native `question` for every bounded user choice. Give concise choices and allow a custom answer; if the tool is unavailable, ask one concise plain-text question. Use `skill` to load workflow and Superpowers skills, `todowrite` for task state, and `task` for delegated work (OpenCode) or the host-native equivalent — on Cursor, Subagent-driven dispatches Cursor-native subagents with a task `delegation_token`, Inline runs single-agent in the current session.
 
 ## Tracked document layout
 
@@ -35,7 +35,7 @@ Before writing **Branch:** into a new spec or plan, call `workit_docs_branch` an
 - Commits use `wk-commit` after its native `question` confirmation.
 - Continuation uses `wk-handoff`, whose `workit_handoff_session` creates and seeds the OpenCode session automatically.
 - Never use worktrees. Resolve the declared branch with `workit_resolve_branch`, preview dirty-tree stash choices with `question`, and apply an approved in-place checkout through `workit_branch_setup` with `confirmed: true` (grounded in the recorded NativeChoiceEvidence).
-- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`) and subagent-driven execution is rejected as unsupported.
+- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`), Subagent-driven execution is supported through the one-time `coordinator_lease` and per-task `delegation_token` minted by `workit_delegate` (fail-closed validation; no `parentID` identity exists on Cursor), and Inline runs single-agent in the current session.
 - Keep all SDD state under the gitignored `docs/<slug>/sdd/`; use `workit_sdd_context` and the registered `workit_sdd_*` tools.
 - After implementation, use `question` before an approved stash reapply through `workit_branch_setup` with `confirmed: true`.
 

package/assets/vendor/superpowers/skills/executing-plans/SKILL.md

@@ -7,11 +7,11 @@ description: Use when you have a written implementation plan to execute in a sep
 
 ## Overview
 
-Load plan, review critically, execute all tasks, report when complete.
+Load plan, review critically, execute all tasks in the current session, report when complete. This is the single-agent Inline execution path.
 
 **Announce at start:** "I'm using the executing-plans skill to implement this plan."
 
-**Note:** Tell your human partner that Superpowers works much better with access to subagents. The quality of its work will be significantly higher if run on a platform with subagent support (Claude Code, Codex CLI, Codex App, and Copilot CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
+**Note:** This skill is the single-agent Inline execution path: every task runs in the current session — no token minting, no subagent dispatching. Tell your human partner that Superpowers works much better with access to subagents. The quality of its work will be significantly higher if run on a platform with subagent support (Claude Code, Codex CLI, Codex App, and Copilot CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available and the plan's approved execution mode is Subagent-driven, use superpowers:subagent-driven-development instead of this skill.
 
 ## The Process
 

package/assets/vendor/superpowers/skills/subagent-driven-development/SKILL.md

@@ -11,6 +11,8 @@ Execute plan by dispatching a fresh implementer subagent per task, a task review
 
 **Core principle:** Fresh subagent per task + task review (spec + quality) + broad final review = high quality, fast iteration
 
+On Cursor, the coordinator mints a task-scoped delegation token via `workit_delegate` (from the `workit_plan_menu` coordinator lease) and the subagent prompt must carry it as `delegation_token` for mutation calls.
+
 **Narration:** between tool calls, narrate at most one short line — the
 ledger and the tool results carry the record.
 

package/dist/plugin.js

@@ -125,7 +125,7 @@ var ensureConfigDir = (dir = resolveConfigDir()) => {
   return dir;
 };
 var configDir = () => ensureConfigDir();
-var LOCALE_RE = /^[a-z]{2,3}(-[A-Z]{2})?$/;
+var LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
 var DEFAULTS = {
   locale: "en",
   localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
@@ -4117,7 +4117,7 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 import path22 from "node:path";
 
 // packages/workit-core/src/core/docs-validate.ts
@@ -5488,7 +5488,6 @@ root: ${cwd}
 
 // packages/workit-core/src/core/flow-state.ts
 var COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations to an authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
-var CURSOR_SUBAGENT_UNSUPPORTED_TEXT = "Cursor cannot execute subagent-driven plans: the MCP has no child-session " + "support. Choose Inline, Handoff, or a review option in this session, or " + "run the plan in OpenCode with `wk-implement`.";
 var MENU_CHOICES = [
   "subagent-driven",
   "inline",
@@ -5548,19 +5547,42 @@ var normalizeState = (parsed, slug) => {
       status: execution.status ?? "pending",
       mode: execution.mode ?? null,
       evidence: execution.evidence ?? null,
-      coordinator_session_id: execution.coordinator_session_id ?? null
+      coordinator_session_id: execution.coordinator_session_id ?? null,
+      ...execution.delegation !== undefined ? { delegation: normalizeDelegation(execution.delegation) } : {}
     },
     handoff_destination: p.handoff_destination ?? false,
     updated_at: p.updated_at ?? Date.now()
   };
 };
+var normalizeDelegation = (v) => {
+  if (v === null || v === undefined)
+    return null;
+  if (!isRecord(v))
+    return null;
+  const hash = (x) => typeof x === "string" && HEX64_RE.test(x) ? x : null;
+  return {
+    coordinator_lease_hash: hash(v.coordinator_lease_hash),
+    active_task_id: typeof v.active_task_id === "number" && Number.isSafeInteger(v.active_task_id) ? v.active_task_id : null,
+    token_hash: hash(v.token_hash),
+    token_workspace: typeof v.token_workspace === "string" ? v.token_workspace : null,
+    token_slug: typeof v.token_slug === "string" ? v.token_slug : null,
+    status: v.status === "active" ? "active" : "revoked"
+  };
+};
+var delegationHash = (raw) => createHash2("sha256").update(raw).digest("hex");
 var emptyState = (slug) => ({
   slug,
   activated: false,
   spec: { path: "", status: "draft", evidence: null, approved_digest: null },
   plan: { path: "", status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
+  execution: {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null,
+    delegation: null
+  },
   handoff_destination: false,
   updated_at: Date.now()
 });
@@ -5698,7 +5720,8 @@ var validateState = (parsed, slug) => {
         status: execRaw?.status ?? "pending",
         mode: execRaw?.mode ?? null,
         evidence: execRaw?.evidence ?? null,
-        coordinator_session_id: execRaw?.coordinator_session_id ?? null
+        coordinator_session_id: execRaw?.coordinator_session_id ?? null,
+        ...execRaw?.delegation !== undefined ? { delegation: normalizeDelegation(execRaw.delegation) } : {}
       },
       handoff_destination: parsed.handoff_destination ?? false,
       updated_at: parsed.updated_at ?? Date.now()
@@ -5835,7 +5858,13 @@ var resetForSpecDrift = (state) => ({
   spec: { ...state.spec, status: "draft", evidence: null, approved_digest: null },
   plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
+  execution: {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null,
+    ...state.execution.delegation !== undefined ? { delegation: null } : {}
+  },
   handoff_destination: false,
   updated_at: Date.now()
 });
@@ -5885,7 +5914,12 @@ var deriveLegacyExecution = (root2, slug, state) => {
       coordinator_session_id: null
     };
   }
-  return { status: "pending", mode: null, evidence: null, coordinator_session_id: null };
+  return {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null
+  };
 };
 var normalizeCompatibility = (root2, slug, parsed, state) => {
   if (!isRecord(parsed) || !("execution" in parsed)) {
@@ -6287,7 +6321,12 @@ var prepareFlowState = (root2, slug, opts = {}, ctx) => {
         spec: { path: specPath, status: "draft", evidence: null, approved_digest: null },
         plan: { path: planPath, status: "draft", evidence: null, approved_digest: null },
         menu: { presented: false, chosen: "", evidence: null },
-        execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
+        execution: {
+          status: "pending",
+          mode: null,
+          evidence: null,
+          coordinator_session_id: null
+        },
         handoff_destination: false,
         updated_at: Date.now()
       });
@@ -6415,16 +6454,16 @@ var recordMenuChoice = (root2, slug, planPath, choice, evidence, ctx) => {
   if (typeof choice !== "string" || !MENU_CHOICES.includes(choice)) {
     return err2("menu_choice_invalid", `invalid menu choice: ${JSON.stringify(choice)}`);
   }
-  if (recorded.evidence.host === "cursor" && choice === "subagent-driven") {
-    return err2("unsupported_mode", CURSOR_SUBAGENT_UNSUPPORTED_TEXT);
-  }
   if (recorded.evidence.host === "opencode" && !sameChoiceLabel(recorded.evidence.selectedLabel, choice)) {
     return err2("evidence_mismatch", `evidence selectedLabel ${JSON.stringify(recorded.evidence.selectedLabel)} does not match choice ${JSON.stringify(choice)}`);
   }
   const doc = resolveDoc(root2, slug, planPath, "plan");
   if (!doc.ok)
     return err2("path_invalid", doc.error);
-  return readModifyWrite(root2, slug, (state) => {
+  const cursorSubagent = recorded.evidence.host === "cursor" && choice === "subagent-driven";
+  const lease = cursorSubagent ? randomBytes(32).toString("hex") : null;
+  const leaseHash = lease === null ? null : delegationHash(lease);
+  const result = readModifyWrite(root2, slug, (state) => {
     if (state.spec.status !== "approved")
       return err2("spec_not_approved", "spec must be approved before the execution menu");
     if (state.plan.status !== "approved")
@@ -6434,6 +6473,14 @@ var recordMenuChoice = (root2, slug, planPath, choice, evidence, ctx) => {
     }
     const executing = choice === "subagent-driven" || choice === "inline";
     const coordinatorSessionId = choice === "subagent-driven" && recorded.evidence.host === "opencode" ? ctx?.sessionId ?? null : null;
+    const delegation = cursorSubagent ? {
+      coordinator_lease_hash: leaseHash,
+      active_task_id: null,
+      token_hash: null,
+      token_workspace: null,
+      token_slug: null,
+      status: "active"
+    } : state.execution.delegation;
     return {
       ok: true,
       next: {
@@ -6444,17 +6491,22 @@ var recordMenuChoice = (root2, slug, planPath, choice, evidence, ctx) => {
           status: "active",
           mode: choice,
           evidence: recorded.evidence,
-          coordinator_session_id: coordinatorSessionId
+          coordinator_session_id: coordinatorSessionId,
+          delegation
         } : {
           status: "pending",
           mode: null,
           evidence: recorded.evidence,
-          coordinator_session_id: null
+          coordinator_session_id: null,
+          delegation
         },
         updated_at: Date.now()
       }
     };
   });
+  if (!result.ok)
+    return result;
+  return cursorSubagent && lease !== null ? { ok: true, coordinator_lease: lease } : { ok: true };
 };
 var markHandoffDestination = (root2, slug, planPath) => {
   const doc = resolveDoc(root2, slug, planPath, "plan");
@@ -20294,7 +20346,7 @@ function createRepoTools(runtime = defaultRuntime) {
           return output(result.ok ? ok(result) : fail(result.error));
         }
         if (action === "config") {
-          const LOCALE_RE2 = /^[a-z]{2,3}(-[A-Z]{2})?$/;
+          const LOCALE_RE2 = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
           if (locale !== undefined && !LOCALE_RE2.test(locale)) {
             return output(fail(`invalid locale: ${JSON.stringify(locale)} — expected BCP-47 like en or es-CL`));
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-opencode",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "private": false,
   "description": "Workit OpenCode plugin (thin wrapper over @brainervirus/workit-core)",
   "keywords": [
@@ -34,7 +34,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^0.9.2"
+    "@brainervirus/workit-core": "^0.11.0"
   },
   "devDependencies": {
     "@opencode-ai/plugin": "1.17.7"