@chorus-aidlc/chorus 0.6.8 → 0.7.1

package/.next/standalone/public/install-opencode.sh

@@ -0,0 +1,284 @@
+#!/usr/bin/env bash
+# Chorus + OpenCode one-shot plugin installer
+#
+# Usage:
+#   curl -fsSL https://<your-chorus>/install-opencode.sh | bash
+#
+# What this does (idempotent, safe to re-run):
+#   1. Verifies `opencode` CLI is installed.
+#   2. Adds "opencode-chorus" to the `plugin` array in
+#      ~/.config/opencode/opencode.json. Creates the file if missing.
+#      Preserves any existing plugins.
+#   3. Sets file permissions to 600.
+#
+# What this does NOT do:
+#   - Write to ~/.bashrc / ~/.zshrc. You must export CHORUS_URL and
+#     CHORUS_API_KEY yourself before launching opencode (the plugin reads
+#     process.env on startup).
+#   - Invoke jq / node / python. Pure POSIX awk/sed/grep only.
+
+set -euo pipefail
+
+# ---------- cosmetics ----------
+BOLD=$'\033[1m'; DIM=$'\033[2m'; GREEN=$'\033[32m'; YELLOW=$'\033[33m'; RED=$'\033[31m'; RESET=$'\033[0m'
+ok()   { printf "${GREEN}\xe2\x9c\x93${RESET} %s\n" "$*"; }
+warn() { printf "${YELLOW}!${RESET} %s\n" "$*" >&2; }
+die()  { printf "${RED}\xe2\x9c\x97${RESET} %s\n" "$*" >&2; exit 1; }
+hdr()  { printf "\n${BOLD}%s${RESET}\n" "$*"; }
+
+# ---------- config ----------
+PLUGIN_NAME="opencode-chorus"
+CONFIG_DIR="${OPENCODE_CONFIG_DIR:-$HOME/.config/opencode}"
+CONFIG_FILE="$CONFIG_DIR/opencode.json"
+BACKUP_FILE="$CONFIG_FILE.chorus-bak"
+
+# ---------- step 1: check opencode ----------
+hdr "1/3  Checking OpenCode CLI"
+if command -v opencode >/dev/null 2>&1; then
+  ok "Found $(opencode --version 2>/dev/null | head -1)"
+else
+  warn "opencode not found in PATH — install it first: https://opencode.ai/docs/"
+  warn "Proceeding to write the config anyway. OpenCode will pick it up on install."
+fi
+
+# ---------- step 2: ensure config dir ----------
+hdr "2/3  Updating $CONFIG_FILE"
+mkdir -p "$CONFIG_DIR"
+
+# Helper: print the manual instructions and exit 0 (non-fatal).
+print_manual_hint() {
+  warn "Could not automatically update $CONFIG_FILE."
+  warn "Please add \"$PLUGIN_NAME\" to the \"plugin\" array manually:"
+  cat >&2 <<HINT
+
+  {
+    "\$schema": "https://opencode.ai/config.json",
+    "plugin": ["$PLUGIN_NAME"${EXISTING_PLUGIN_HINT:-}]
+    ...
+  }
+
+HINT
+  exit 0
+}
+
+# ---------- Case A: file does not exist ----------
+if [ ! -f "$CONFIG_FILE" ]; then
+  cat > "$CONFIG_FILE" <<JSON
+{
+  "\$schema": "https://opencode.ai/config.json",
+  "plugin": ["$PLUGIN_NAME"]
+}
+JSON
+  chmod 600 "$CONFIG_FILE"
+  ok "Created $CONFIG_FILE with $PLUGIN_NAME"
+else
+  # File exists — back it up once.
+  if [ ! -f "$BACKUP_FILE" ]; then
+    cp "$CONFIG_FILE" "$BACKUP_FILE"
+    chmod 600 "$BACKUP_FILE"
+    ok "Backed up original config to $BACKUP_FILE"
+  fi
+
+  # Reject JSONC (comments). Presence of // or /* strongly suggests the file
+  # is hand-edited JSONC; our line-based awk would mangle it. Bail cleanly.
+  if grep -qE '^[[:space:]]*//|/\*' "$CONFIG_FILE"; then
+    warn "Detected // or /* in $CONFIG_FILE — looks like JSONC with comments."
+    print_manual_hint
+  fi
+
+  # Case C1: plugin array already contains opencode-chorus → no-op.
+  # Scope the check to the "plugin" array itself: a top-level occurrence of
+  # "opencode-chorus" outside that array (e.g. in a "lastInstalled" field)
+  # must not trigger the no-op shortcut.
+  plugin_contains_self() {
+    awk -v plugin="$PLUGIN_NAME" '
+      # Track whether we are currently inside the first "plugin" array.
+      # State machine:
+      #   0 = before the plugin key
+      #   1 = inside the plugin array (between its [ and matching ])
+      BEGIN { state = 0 }
+      state == 0 {
+        # Is the "plugin" key on this line?
+        if (match($0, /"plugin"[[:space:]]*:[[:space:]]*\[/)) {
+          # Consume the rest of the line starting at the [
+          rest = substr($0, RSTART + RLENGTH - 1)
+          state = 1
+          # Fall through to state == 1 handling for this rest.
+          $0 = rest
+        } else {
+          next
+        }
+      }
+      state == 1 {
+        # Look for the closing ] on this line (naive — good enough for
+        # standard JSON because plugin entries are plain strings).
+        close_pos = index($0, "]")
+        if (close_pos > 0) {
+          chunk = substr($0, 1, close_pos - 1)
+        } else {
+          chunk = $0
+        }
+        # Check for the quoted token inside the array chunk only.
+        if (index(chunk, "\"" plugin "\"") > 0) {
+          print "yes"
+          exit 0
+        }
+        if (close_pos > 0) exit 0
+      }
+    ' "$CONFIG_FILE"
+  }
+
+  if [ "$(plugin_contains_self)" = "yes" ]; then
+    ok "$PLUGIN_NAME already present in $CONFIG_FILE — nothing to do"
+  else
+    # Decide: Case B (no plugin key) vs Case C2 (plugin key exists without this plugin).
+    if grep -qE '"plugin"[[:space:]]*:' "$CONFIG_FILE"; then
+      # Case C2: insert into existing plugin array.
+      # Strategy: find the first "plugin" key, locate its array bracket pair,
+      # insert "opencode-chorus" before the closing ].
+      #
+      # Only handle the common cases where the array is on a single line or
+      # a multi-line array that has one entry per line. Otherwise bail to hint.
+      tmp="$(mktemp "${TMPDIR:-/tmp}/chorus-opencode.XXXXXX")"
+      if awk -v plugin="$PLUGIN_NAME" '
+        BEGIN { done = 0 }
+        # Single-line empty array: "plugin": []
+        !done && /"plugin"[[:space:]]*:[[:space:]]*\[[[:space:]]*\]/ {
+          sub(/\[[[:space:]]*\]/, "[\"" plugin "\"]")
+          done = 1
+          print
+          next
+        }
+        # Single-line non-empty array: "plugin": [ "foo", "bar" ]
+        !done && match($0, /"plugin"[[:space:]]*:[[:space:]]*\[[^\]]*\]/) {
+          line = $0
+          pre  = substr(line, 1, RSTART - 1)
+          match_text = substr(line, RSTART, RLENGTH)
+          post = substr(line, RSTART + RLENGTH)
+          # Insert before the closing ]
+          sub(/\][[:space:]]*$/, ", \"" plugin "\"]", match_text)
+          # If the match still ends in ] (no trailing whitespace stripped), fall through
+          print pre match_text post
+          done = 1
+          next
+        }
+        # Multi-line array opener: "plugin": [ (and not on same line closer)
+        !done && /"plugin"[[:space:]]*:[[:space:]]*\[[[:space:]]*$/ {
+          print
+          getline nextline
+          # Empty multi-line array: next line is just ]
+          if (nextline ~ /^[[:space:]]*\][[:space:]]*,?[[:space:]]*$/) {
+            print "    \"" plugin "\""
+            print nextline
+            done = 1
+            next
+          }
+          # Non-empty multi-line: emit entries verbatim until we hit the ]
+          buffer[++bn] = nextline
+          while ((getline nextline) > 0) {
+            if (nextline ~ /^[[:space:]]*\][[:space:]]*,?[[:space:]]*$/) {
+              # Last existing entry may not have trailing comma; add one.
+              last = buffer[bn]
+              if (last !~ /,[[:space:]]*$/) {
+                sub(/[[:space:]]*$/, ",", buffer[bn])
+              }
+              for (i = 1; i <= bn; i++) print buffer[i]
+              # Insert new entry before the closing ]
+              # Determine indentation from first buffered entry.
+              match(buffer[1], /^[[:space:]]*/)
+              indent = substr(buffer[1], 1, RLENGTH)
+              print indent "\"" plugin "\""
+              print nextline
+              done = 1
+              bn = 0
+              break
+            }
+            buffer[++bn] = nextline
+          }
+          next
+        }
+        { print }
+        END {
+          if (!done) exit 2
+        }
+      ' "$CONFIG_FILE" > "$tmp"; then
+        mv "$tmp" "$CONFIG_FILE"
+        chmod 600 "$CONFIG_FILE"
+        ok "Added $PLUGIN_NAME to existing \"plugin\" array"
+      else
+        rm -f "$tmp"
+        warn "The \"plugin\" key exists but I could not safely determine where to insert the new entry."
+        EXISTING_PLUGIN_HINT=", ...your existing entries..."
+        print_manual_hint
+      fi
+    else
+      # Case B: no plugin key in file → inject it.
+      # We look for the first top-level "{" then insert `"plugin": [...]` on the next line.
+      # Safer: look for the first line containing just "{" optionally with whitespace.
+      tmp="$(mktemp "${TMPDIR:-/tmp}/chorus-opencode.XXXXXX")"
+      if awk -v plugin="$PLUGIN_NAME" '
+        BEGIN { inserted = 0 }
+        !inserted && /^[[:space:]]*\{[[:space:]]*$/ {
+          print
+          print "  \"plugin\": [\"" plugin "\"],"
+          inserted = 1
+          next
+        }
+        { print }
+        END { if (!inserted) exit 2 }
+      ' "$CONFIG_FILE" > "$tmp"; then
+        mv "$tmp" "$CONFIG_FILE"
+        chmod 600 "$CONFIG_FILE"
+        ok "Added \"plugin\" field with $PLUGIN_NAME to $CONFIG_FILE"
+      else
+        rm -f "$tmp"
+        warn "Could not find a line with just \"{\" to inject the plugin array."
+        print_manual_hint
+      fi
+    fi
+  fi
+fi
+
+# ---------- step 3: reminders ----------
+hdr "3/3  Final reminders"
+
+# Environment check — read-only warning, don't export.
+missing_env=""
+if [ -z "${CHORUS_URL:-}" ]; then
+  missing_env="$missing_env CHORUS_URL"
+fi
+if [ -z "${CHORUS_API_KEY:-}" ]; then
+  missing_env="$missing_env CHORUS_API_KEY"
+fi
+
+if [ -n "$missing_env" ]; then
+  warn "The following environment variables are not set in this shell:$missing_env"
+  warn "The plugin reads them on OpenCode startup. Please export them in your shell rc:"
+  cat >&2 <<'HINT'
+
+  export CHORUS_URL="https://<your-chorus-instance>"
+  export CHORUS_API_KEY="cho_..."
+
+HINT
+  warn "Then re-source your shell rc, or launch opencode from a shell where they are exported."
+else
+  ok "CHORUS_URL and CHORUS_API_KEY are set in this shell"
+fi
+
+hdr "Done."
+cat <<'NEXT'
+Start OpenCode — Bun will fetch opencode-chorus on first launch:
+
+  opencode
+
+Then in OpenCode, ask the agent:
+
+  check in to chorus
+
+If the plugin fails to load, clear the package cache and retry:
+
+  rm -rf ~/.cache/opencode/packages/opencode-chorus@latest
+
+To roll back this change:
+NEXT
+printf "  mv %s %s\n\n" "$BACKUP_FILE" "$CONFIG_FILE"

package/.next/standalone/public/skill/chorus/SKILL.md

@@ -86,10 +86,26 @@ creates  analyzes     drafts PRD         codes &      reviews   closes
 
 | Role | Responsibility | MCP Tools |
 |------|---------------|-----------|
-| **PM Agent** | Analyze Ideas, create Proposals (PRD + Task drafts), manage documents | Public + `chorus_pm_*` + `chorus_*_idea` |
+| **PM Agent** | Analyze Ideas, create Proposals (PRD + Task drafts), manage documents | Public + `chorus_pm_*` + `chorus_*_idea` + `task:write` tools (claim/release/submit/report) |
 | **Developer Agent** | Claim Tasks, write code, report work, submit for verification | Public + `chorus_*_task` + `chorus_report_work` |
 | **Admin Agent** | Create projects/ideas, approve/reject proposals, verify tasks, manage lifecycle | Public + `chorus_admin_*` + PM + Developer tools |
 
+### Permissions
+
+Each agent's tool visibility is driven by a **permission set**, not by the role label alone. Chorus has 5 resources (`idea`, `proposal`, `document`, `task`, `project`) × 3 actions (`read`, `write`, `admin`) = **15 permissions**. Each permission-gated MCP tool declares a single required permission (see `<BASE_URL>/docs/MCP_TOOLS.md` for the full table).
+
+**Role presets** map to permission sets:
+
+| Preset | Permissions |
+|--------|-------------|
+| `developer_agent` | all `*:read` + `task:write` |
+| `pm_agent` | all `*:read` + `idea:write` + `proposal:write` + `document:write` + `task:write` + `project:write` |
+| `admin_agent` | all 15 permissions (every `read` + `write` + `admin`) |
+
+**Custom permissions** are also supported: when creating an agent you can pick a preset AND/OR add individual permissions. The effective permission set is the union. Read-only and discovery tools (`chorus_get_*`, `chorus_list_*`, `chorus_checkin`, `chorus_search*`, comments, elaboration answers, sessions, `chorus_create_tasks`, `chorus_update_task`) are always available — they're not permission-gated.
+
+> **Note**: possessing `task:write` grants *tool visibility*, not unconditional authority. Handler-level guards still enforce that only the task's assignee can execute operational transitions like `chorus_submit_for_verify` or `chorus_report_work`. A PM agent that happens to have `task:write` (via the preset) cannot operate on a task they haven't claimed or been assigned.
+
 ---
 
 ## Common Tools (All Roles)
@@ -125,9 +141,9 @@ Results can be filtered by project(s) using optional HTTP headers in your MCP co
 
 ### MCP Connection
 
-- MCP sessions expire after 30 minutes of **inactivity** (sliding window)
-- Each MCP request automatically renews the session
-- If you receive a "Session not found" error, reinitialize the MCP connection
+- The Chorus MCP endpoint is **stateless** — each HTTP request creates a fresh server instance, so there is no client-side session to keep alive
+- Supply your API Key in the `Authorization: Bearer cho_...` header on every request (your MCP client handles this automatically)
+- Horizontal scaling works out of the box; no sticky sessions required
 
 ### Project Groups
 
@@ -257,11 +273,14 @@ API Keys are created by the user in the Chorus Web UI.
 **Ask the user to:**
 1. Open the Chorus settings page (e.g., `http://localhost:8637/settings`)
 2. Click **Create API Key**
-3. Enter Agent name, select role (Developer / PM / Admin)
+3. Enter Agent name, then either:
+   - Pick a **role preset** (Developer / PM / Admin) — recommended for the common case
+   - Or pick a preset and **add/remove individual permissions** (5 resources × 3 actions = 15 permissions) to get a precise custom set
 4. Click create and **immediately copy the key** (shown only once)
 
 **Security notes:**
-- Each Agent should have its own API Key with the minimum required role
+- Each Agent should have its own API Key with the minimum required permissions
+- Presets are the fastest path; custom permissions let you grant narrowly (e.g. a dev agent that also needs `idea:write` to file bugs)
 - API Keys should not be committed to version control
 
 ### 2. MCP Server Configuration
@@ -297,19 +316,25 @@ chorus_checkin()
 
 If it fails, check: API Key correct (`cho_` prefix)? URL reachable? IDE restarted?
 
-### 4. Role-Specific Tool Access
-
-| Tool Prefix | Developer | PM | Admin |
-|-------------|-----------|------|-------|
-| `chorus_get_*` / `chorus_list_*` | Yes | Yes | Yes |
-| `chorus_checkin` | Yes | Yes | Yes |
-| `chorus_add_comment` / `chorus_get_comments` | Yes | Yes | Yes |
-| `chorus_claim_task` / `chorus_release_task` | Yes | No | Yes |
-| `chorus_update_task` / `chorus_submit_for_verify` | Yes | No | Yes |
-| `chorus_report_work` | Yes | No | Yes |
-| `chorus_claim_idea` / `chorus_release_idea` | No | Yes | Yes |
-| `chorus_pm_*` | No | Yes | Yes |
-| `chorus_admin_*` | No | No | Yes |
+### 4. Tool Access by Preset
+
+The table below shows default tool availability for each preset (no custom permissions). Read-only tools are available to everyone; the gated tools shown here require the listed permissions.
+
+| Tool Group | Required Permission | Developer | PM | Admin |
+|------------|--------------------|-----------|------|-------|
+| `chorus_get_*` / `chorus_list_*` / `chorus_search*` | (public, read) | Yes | Yes | Yes |
+| `chorus_checkin` | (public) | Yes | Yes | Yes |
+| `chorus_add_comment` / `chorus_get_comments` | (public) | Yes | Yes | Yes |
+| `chorus_update_task` (field edits + status) | (public; assignee required for status) | Yes | Yes | Yes |
+| `chorus_claim_task` / `chorus_release_task` / `chorus_submit_for_verify` / `chorus_report_work` / `chorus_report_criteria_self_check` | `task:write` | Yes | **Yes** (0.7.0+) | Yes |
+| `chorus_claim_idea` / `chorus_release_idea` / `chorus_move_idea` / `chorus_pm_create_idea` / `chorus_pm_*_elaboration` | `idea:write` | No | Yes | Yes |
+| `chorus_pm_create_proposal` / `chorus_pm_*_proposal` / `chorus_pm_*_draft` / `chorus_pm_create_tasks` / `chorus_pm_assign_task` / `chorus_*_task_dependency` | `proposal:write` | No | Yes | Yes |
+| `chorus_pm_create_document` / `chorus_pm_update_document` | `document:write` | No | Yes | Yes |
+| `chorus_admin_create_project` / `chorus_admin_*_project_group` / `chorus_admin_move_project_to_group` | `project:write` | No | **Yes** (0.7.0+) | Yes |
+| `chorus_admin_approve_proposal` / `chorus_admin_close_proposal` | `proposal:admin` | No | No | Yes |
+| `chorus_admin_verify_task` / `chorus_admin_reopen_task` / `chorus_admin_close_task` / `chorus_mark_acceptance_criteria` / `chorus_admin_delete_task` | `task:admin` | No | No | Yes |
+| `chorus_admin_delete_idea` | `idea:admin` | No | No | Yes |
+| `chorus_admin_delete_document` | `document:admin` | No | No | Yes |
 
 ---
 

package/.next/standalone/public/skill/proposal-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Proposal workflow — create proposals with document and tas
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.2.0"
+  version: "0.2.1"
   category: project-management
   mcp_server: chorus
 ---
@@ -244,7 +244,7 @@ chorus_pm_assign_task({ taskUuid: "<task-uuid>", agentUuid: "<developer-agent-uu
 ```
 
 - Task should be `open` or `assigned`
-- Target agent should have `developer` or `developer_agent` role
+- Target agent must have `task: ["write"]` permission
 
 ---
 

package/.next/standalone/public/skill/quick-dev-chorus/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: quick-dev-chorus
-version: 0.1.0
+version: 0.1.1
 description: Quick Task workflow — skip Idea→Proposal, create tasks directly, execute, and verify.
 ---
 
@@ -37,7 +37,7 @@ For complex work, consider using the idea and proposal skills instead.
 
 ## Pre-Flight: Admin Self-Verify Check
 
-**Before creating tasks**, if you have the `admin_agent` role, ask the user:
+**Before creating tasks**, if `chorus_checkin().agent.permissions.task` includes `"admin"`, ask the user:
 
 > "I have admin privileges. After development, should I verify the task myself, or leave it for another admin to verify?"
 
@@ -143,7 +143,7 @@ chorus_submit_for_verify({
 })
 ```
 
-**Admin self-verification:** If you have the `admin_agent` role and the user approved self-verification in the Pre-Flight check, you can verify the task yourself immediately after submitting:
+**Admin self-verification:** If you have `task: ["admin"]` in `permissions` and the user approved self-verification in the Pre-Flight check, you can verify the task yourself immediately after submitting:
 
 ```
 chorus_admin_verify_task({ taskUuid: "<task-uuid>" })

package/README.md

@@ -15,7 +15,7 @@
 
 <p align="center"><a href="README.zh.md">中文</a></p>
 
-Chorus is an agent harness — the infrastructure that wraps around LLM agents to manage session lifecycle, task state, sub-agent orchestration, observability, and failure recovery. It lets multiple AI Agents (PM, Developer, Admin) and humans collaborate through the full workflow from requirements to delivery.
+Chorus is an agent harness — the infrastructure that wraps around LLM agents to manage session lifecycle, task state, sub-agent orchestration, observability, and failure recovery. It lets multiple AI Agents (with fine-grained, configurable permissions) and humans collaborate through the full workflow from requirements to delivery.
 
 Inspired by the **[AI-DLC (AI-Driven Development Lifecycle)](https://aws.amazon.com/blogs/devops/ai-driven-development-life-cycle/)** methodology. Core philosophy: **Reversed Conversation** — AI proposes, humans verify.
 
@@ -35,6 +35,8 @@ creates   analyzes       drafts PRD            codes &      reviews   closes
 
 ## What's New
 
+**[v0.7.0](https://chorus-ai.dev/blog/chorus-v0.7.0-release/)** — Fine-grained agent permissions: 5 resources × 3 actions grid replaces the PM/Developer/Admin three-way choice, with presets + a Custom option for free combination.
+
 **[v0.6.7](https://chorus-ai.dev/blog/chorus-v0.6.7-release/)** — Chorus plugin for Codex CLI (one-command installer), workspace picker when one email belongs to multiple Companies, per-client connect guides.
 
 **[v0.6.6](https://chorus-ai.dev/blog/chorus-v0.6.6-release/)** — npm one-click install (`npx @chorus-aidlc/chorus`), document export (MD/PDF/Word), proposal revoke, faster agent checkin with work status at a glance.
@@ -153,6 +155,7 @@ A Cmd+K command palette for searching across all 6 entity types (Tasks, Ideas, P
 - **Task DAG** — Dependency modeling, cycle detection, and interactive visualization
 - **Kanban** — Real-time task flow with Worker badges and agent presence
 - **Multi-Agent Collaboration** — Claude Code Agent Teams (Swarm Mode) for parallel execution
+- **Fine-Grained Agent Permissions** — 5 resources × 3 actions grid with preset + custom combinations ([details](docs/PERMISSIONS.md))
 - **Chorus Plugin** — Lifecycle hooks automate session create/close, heartbeats, and context injection
 - **Requirements Elaboration** — Structured Q&A rounds before proposal creation
 - **Proposal Approval Flow** — PM drafts, Admin approves, drafts materialize into real entities
@@ -178,7 +181,7 @@ A Cmd+K command palette for searching across all 6 entity types (Tasks, Ideas, P
 │  └───────────────────────────────────────────────────────────┘   │
 │                                                                  │
 │  ┌── API Layer ──────────────────────────────────────────────┐   │
-│  │  /api/mcp  — MCP HTTP Streamable (50+ tools, role-based)  │   │
+│  │  /api/mcp  — MCP Streaming (50+ tools, permission-gated)  │   │
 │  │  /api/*    — REST API (Web UI + SSE push)                 │   │
 │  └───────────────────────────────────────────────────────────┘   │
 │                                                                  │
@@ -191,8 +194,9 @@ A Cmd+K command palette for searching across all 6 entity types (Tasks, Ideas, P
 │  └───────────────────────────────────────────────────────────┘   │
 └──────────────────────────────────────────────────────────────────┘
      ↑              ↑              ↑              ↑
-  PM Agent    Developer Agent  Admin Agent      Human
-   (LLM)         (LLM)          (LLM)        (Browser)
+  Agent w/      Agent w/       Agent w/         Human
+  PM perms   Developer perms  Admin perms     (Browser)
+   (LLM)         (LLM)          (LLM)
                      │
           ┌──────────▼──────────┐   ┌─────────────────────┐
           │  PostgreSQL + Prisma │   │  Redis (optional)   │
@@ -290,7 +294,7 @@ The interactive installer provisions VPC, Aurora Serverless v2, ElastiCache Serv
 
 ### Connect AI Agents
 
-The fastest path is the in-app setup wizard: open the Web UI, go to **Settings → Setup Guide → Open setup guide**, and follow the step-by-step instructions for your client (Claude Code, Codex, OpenClaw, or other agents). The wizard creates the API key for you, shows the exact commands, and walks through verifying the connection.
+The fastest path is the in-app setup wizard: open the Web UI, go to **Settings → Setup Guide → Open setup guide**, and follow the step-by-step instructions for your client (Claude Code, Codex, OpenCode, OpenClaw, or other agents). The wizard creates the API key for you, shows the exact commands, and walks through verifying the connection.
 
 If you'd rather read the full docs:
 
@@ -298,8 +302,11 @@ If you'd rather read the full docs:
 |--------|-------|
 | Claude Code | [CONNECT_CLAUDE_CODE.md](docs/CONNECT_CLAUDE_CODE.md) |
 | Codex CLI | [CONNECT_CODEX.md](docs/CONNECT_CODEX.md) |
+| OpenCode † | [CONNECT_OPENCODE.md](docs/CONNECT_OPENCODE.md) |
 | Other MCP agents (Cursor, Continue, custom, …) | [CONNECT_OTHER_AGENTS.md](docs/CONNECT_OTHER_AGENTS.md) |
 
+† OpenCode support is provided by the community-maintained [`opencode-chorus`](https://github.com/etnperlong/opencode-chorus) plugin (npm: [`opencode-chorus`](https://www.npmjs.com/package/opencode-chorus)), authored by [@etnperlong](https://github.com/etnperlong). Thanks!
+
 Create API Keys in the Web UI under **Settings → Agents → Create API Key**. Keys start with `cho_` and are shown only once.
 
 ![Create API Key](docs/images/create-key.png)

package/README.zh.md

@@ -6,7 +6,7 @@
 
 <p align="center"><a href="README.md">English</a></p>
 
-Chorus 是一个 Agent Harness——包裹在 LLM 外面的基础设施层，负责管理会话生命周期、任务状态、子 Agent 编排、可观测性和故障恢复。它让多个 AI Agent（PM、Developer、Admin）和人类在同一平台上协作，完成从需求到交付的全流程。
+Chorus 是一个 Agent Harness——包裹在 LLM 外面的基础设施层，负责管理会话生命周期、任务状态、子 Agent 编排、可观测性和故障恢复。它让多个具备细粒度权限配置的 AI Agent 和人类在同一平台上协作，完成从需求到交付的全流程。
 
 受 **[AI-DLC（AI-Driven Development Lifecycle）](https://aws.amazon.com/blogs/devops/ai-driven-development-life-cycle/)** 方法论启发。核心理念：**Reversed Conversation**——AI 提议，人类验证。
 
@@ -26,6 +26,8 @@ creates   analyzes       drafts PRD            codes &      reviews   closes
 
 ## 最近更新
 
+**[v0.7.0](https://chorus-ai.dev/zh/blog/chorus-v0.7.0-release/)** — 细粒度 Agent 权限：5 类资源 × 3 个动作组成的网格，取代 PM / Developer / Admin 三选一。保留原有预设，新增 Custom 选项自由组合。
+
 **[v0.6.7](https://chorus-ai.dev/zh/blog/chorus-v0.6.7-release/)** — Codex CLI 版 Chorus 插件（一条命令装完）、同一邮箱属于多个 Company 时的工作区选择器、每种客户端的接入文档。
 
 **[v0.6.6](https://chorus-ai.dev/zh/blog/chorus-v0.6.6-release/)** — npm 一键安装（`npx @chorus-aidlc/chorus`）、文档导出（MD/PDF/Word）、Proposal 撤回、优化 Agent Checkin 快速获取工作状态。
@@ -144,6 +146,7 @@ Cmd+K 命令面板，支持跨 6 种实体类型搜索。支持范围筛选（
 - **任务 DAG** — 依赖建模、环检测、交互式可视化
 - **Kanban** — 实时任务流转，Worker 徽标与 Agent Presence
 - **Multi-Agent 协作** — Claude Code Agent Teams (Swarm Mode) 并行执行
+- **细粒度 Agent 权限** — 5 类资源 × 3 个动作组成的权限网格，支持预设 + 自定义组合（[详细说明](docs/PERMISSIONS.md) · 英文）
 - **Chorus Plugin** — 生命周期钩子自动管理 Session 创建/关闭、心跳、上下文注入
 - **需求澄清** — Proposal 创建前的结构化问答轮次
 - **Proposal 审批流** — PM 起草，Admin 审批，草稿物化为正式实体
@@ -169,7 +172,7 @@ Cmd+K 命令面板，支持跨 6 种实体类型搜索。支持范围筛选（
 │  └───────────────────────────────────────────────────────────┘   │
 │                                                                  │
 │  ┌── API Layer ──────────────────────────────────────────────┐   │
-│  │  /api/mcp  — MCP HTTP Streamable (50+ tools, role-based)  │   │
+│  │  /api/mcp  — MCP Streaming (50+ tools, permission-gated)  │   │
 │  │  /api/*    — REST API (Web UI + SSE push)                 │   │
 │  └───────────────────────────────────────────────────────────┘   │
 │                                                                  │
@@ -182,8 +185,9 @@ Cmd+K 命令面板，支持跨 6 种实体类型搜索。支持范围筛选（
 │  └───────────────────────────────────────────────────────────┘   │
 └──────────────────────────────────────────────────────────────────┘
      ↑              ↑              ↑              ↑
-  PM Agent    Developer Agent  Admin Agent      Human
-   (LLM)         (LLM)          (LLM)        (Browser)
+  Agent w/      Agent w/       Agent w/         Human
+  PM perms   Developer perms  Admin perms     (Browser)
+   (LLM)         (LLM)          (LLM)
                      │
           ┌──────────▼──────────┐   ┌─────────────────────┐
           │  PostgreSQL + Prisma │   │  Redis（可选）       │
@@ -281,7 +285,7 @@ PGlite 在端口 5433 运行嵌入式 PostgreSQL。数据存储在 `.pglite/`，
 
 ### 连接 AI Agent
 
-最快的方式是用应用内的 setup 向导：打开 Web UI，进入 **Settings → Setup Guide → 打开设置向导**，按照向导给出的分步指引接入自己的客户端（Claude Code、Codex、OpenClaw 或其他 agent）。向导会帮你创建 API Key、展示完整命令，并引导你验证连接。
+最快的方式是用应用内的 setup 向导：打开 Web UI，进入 **Settings → Setup Guide → 打开设置向导**，按照向导给出的分步指引接入自己的客户端（Claude Code、Codex、OpenCode、OpenClaw 或其他 agent）。向导会帮你创建 API Key、展示完整命令，并引导你验证连接。
 
 如果偏好文档：
 
@@ -289,8 +293,11 @@ PGlite 在端口 5433 运行嵌入式 PostgreSQL。数据存储在 `.pglite/`，
 |--------|---------|
 | Claude Code | [CONNECT_CLAUDE_CODE.zh.md](docs/CONNECT_CLAUDE_CODE.zh.md) |
 | Codex CLI | [CONNECT_CODEX.zh.md](docs/CONNECT_CODEX.zh.md) |
+| OpenCode † | [CONNECT_OPENCODE.zh.md](docs/CONNECT_OPENCODE.zh.md) |
 | 其他 MCP agent（Cursor / Continue / 自研等） | [CONNECT_OTHER_AGENTS.zh.md](docs/CONNECT_OTHER_AGENTS.zh.md) |
 
+† OpenCode 的接入由社区维护的 [`opencode-chorus`](https://github.com/etnperlong/opencode-chorus) 插件提供（npm: [`opencode-chorus`](https://www.npmjs.com/package/opencode-chorus)），作者 [@etnperlong](https://github.com/etnperlong)，特此感谢！
+
 在 Web UI 的 **Settings → Agents → Create API Key** 创建 API Key。Key 以 `cho_` 开头，仅在创建时显示一次。
 
 ![Create API Key](docs/images/create-key.png)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chorus-aidlc/chorus",
-  "version": "0.6.8",
+  "version": "0.7.1",
   "description": "The Agent Harness for AI-Human Collaboration — session lifecycle, task state, sub-agent orchestration, observability, and failure recovery",
   "homepage": "https://github.com/Chorus-AIDLC/Chorus",
   "repository": {

package/prisma/migrations/20260430034110_add_agent_permissions/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "Agent" ADD COLUMN     "permissions" TEXT[] DEFAULT ARRAY[]::TEXT[];

package/prisma/schema.prisma

@@ -63,6 +63,7 @@ model Agent {
   company      Company   @relation(fields: [companyUuid], references: [uuid])
   name         String
   roles        String[]  @default(["developer"])  // pm | developer (multi-select)
+  permissions  String[]  @default([])              // Custom permission bits (resource:action); merged with role presets at auth time
   // Agent persona definition (Zero Context Injection)
   persona      String?   // Custom persona description (brief)
   systemPrompt String?   // Full system prompt (optional, overrides default template)