@fro.bot/systematic 3.16.3 → 3.16.4

package/dist/cli.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { type CapabilityClock, type CapabilityOutputSink, type ConfigObservationMetadata } from './lib/capability-snapshot.js';
-interface CapabilityCliRoots {
+export interface CapabilityCliRoots {
     readonly agentsRoot: string;
     readonly cwd: string;
     readonly homeDir: string;

package/dist/index.js

@@ -11803,7 +11803,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
       result.satisfiedCount = source.debug.satisfiedCount;
       result.missingCount = source.debug.missingCount;
       result.family = source.debug.family;
-      result.status = source.debug.status;
+      result.debugEpochStatus = source.debug.status;
     }
     return result;
   }
@@ -11845,10 +11845,12 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
   function writeCompletionResult(output, result, target) {
     if (!isRecord7(output))
       return;
+    const existingMetadata = isRecord7(output.metadata) ? output.metadata : {};
     if (result.status === "completed" || result.status === "duplicate") {
       output.title = "Workflow transition completed";
       output.output = `workflow guard completed ${target}`;
       output.metadata = {
+        ...existingMetadata,
         ...metadata2(),
         workflowGuard: { status: "completed", target }
       };
@@ -11862,6 +11864,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
       reasonCode
     });
     output.metadata = {
+      ...existingMetadata,
       ...metadata2(),
       workflowGuard: {
         status: resultStatus,
@@ -11870,6 +11873,19 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
       }
     };
   }
+  function writeAbandonedCompletionResult(output, target, reasonCode) {
+    writeCompletionResult(output, { target, status: "unavailable", reasonCode }, target);
+  }
+  function writeAbandonedCompletionMetadata(output, target, reasonCode) {
+    if (!isRecord7(output))
+      return;
+    const existingMetadata = isRecord7(output.metadata) ? output.metadata : {};
+    output.metadata = {
+      ...existingMetadata,
+      ...metadata2(),
+      workflowGuard: { status: "unavailable", target, reasonCode }
+    };
+  }
   function prepareSkill(host, args2) {
     const skill = normalizeSkill(host.tool, args2);
     if (!skill)
@@ -12286,6 +12302,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
         callId: pending.callID,
         transitionId: pending.transitionId
       });
+      writeAbandonedCompletionMetadata(output, pending.target, "failed-operation");
       return;
     }
     const result = guard.finalizeTransition({
@@ -12440,19 +12457,32 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     }
     return readbacks;
   }
+  function finishMismatchedTarget(callDigest, pending, output) {
+    abandonComplete(callDigest, pending, false);
+    markUnavailable();
+    writeAbandonedCompletionResult(output, pending.target, "invalid-transition");
+  }
+  function finishUnreplayableComplete(finalTarget, output) {
+    markUnavailable();
+    writeAbandonedCompletionResult(output, finalTarget ?? "unit", "guard-unavailable");
+  }
+  function finishUnavailableReadback(callDigest, pending, output) {
+    abandonComplete(callDigest, pending, true);
+    markUnavailable();
+    writeAbandonedCompletionResult(output, pending.target, "finalization-failed");
+  }
   async function finishComplete(host, output) {
     const callDigest = digestCall(ledger, host.callID);
     const pending = pendingCompletes.get(callDigest);
     const finalTarget = normalizeTarget(host.args);
     if (pending && (!finalTarget || finalTarget !== pending.target)) {
-      abandonComplete(callDigest, pending, false);
-      markUnavailable();
+      finishMismatchedTarget(callDigest, pending, output);
       return;
     }
     if (!pending) {
       if (replayTerminalComplete(callDigest, finalTarget, output))
         return;
-      markUnavailable();
+      finishUnreplayableComplete(finalTarget, output);
       return;
     }
     if (!options.observer) {
@@ -12461,8 +12491,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     }
     const readbacks = await completionReadbacks();
     if (readbacks.status === "unavailable") {
-      abandonComplete(callDigest, pending, true);
-      markUnavailable();
+      finishUnavailableReadback(callDigest, pending, output);
       return;
     }
     finalizeComplete(callDigest, pending, output, readbacks.status === "ready" ? readbacks.readbacks : undefined);

package/dist/lib/config-handler.d.ts

@@ -1,4 +1,6 @@
 import type { Config } from '@opencode-ai/plugin';
+import type { AgentConfig } from '@opencode-ai/sdk';
+import { type PermissionSetting } from './validation.js';
 export interface ConfigHandlerDeps {
     directory: string;
     bundledSkillsDir: string;
@@ -11,6 +13,41 @@ export interface ConfigHandlerDeps {
 }
 export declare function toTitleCase(name: string): string;
 export declare function formatAgentDescription(name: string, description: string | undefined): string;
+/**
+ * Per-tool permission rule map as actually emitted by {@link permissionFromRules}:
+ * each key is a match pattern (`'*'` or an exact name) mapped to a setting.
+ */
+export type AgentPermissionRuleMap = Record<string, PermissionSetting>;
+/**
+ * Agent permission shape as emitted onto `AgentConfig.permission`, narrowed at
+ * this module's boundary to include `skill`. The `@opencode-ai/sdk` v1 `Config`
+ * type this module targets omits `skill` from `AgentConfig['permission']`
+ * (it only appears on the SDK's v2 `PermissionRuleConfig` surface), but
+ * `applyPermissionOverlay`/`addManagedSkillRules` genuinely write a `skill`
+ * rule map identical in shape to `bash`. This type documents and reads that
+ * real runtime shape without migrating the module to the v2 type surface.
+ *
+ * `permissionFromRules` emits a rule map for whatever tool key gets passed to
+ * `setPermissionRule` — not just the named keys below (e.g. `task`, per
+ * `PermissionConfig` in validation.ts and the `task` overlay field applied at
+ * config-handler.ts's overlay pass). The named keys stay for documentation of
+ * the common cases; the index signature covers every other emitted tool key.
+ */
+export interface EmittedAgentPermission {
+    edit?: AgentPermissionRuleMap;
+    bash?: AgentPermissionRuleMap;
+    webfetch?: AgentPermissionRuleMap;
+    doom_loop?: AgentPermissionRuleMap;
+    external_directory?: AgentPermissionRuleMap;
+    skill?: AgentPermissionRuleMap;
+    readonly [tool: string]: AgentPermissionRuleMap | undefined;
+}
+/**
+ * Read an agent's emitted permission map, narrowed to include `skill` (see
+ * {@link EmittedAgentPermission}). Use this instead of `AgentConfig['permission']`
+ * when a caller needs to observe the `skill` rule map this module writes.
+ */
+export declare function readEmittedAgentPermission(agent: AgentConfig | undefined): EmittedAgentPermission | undefined;
 /**
  * Create the config hook handler for the Systematic plugin.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.16.3",
+  "version": "3.16.4",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",
@@ -40,6 +40,8 @@
     "test:integration": "bun test tests/integration",
     "test:all": "bun test",
     "typecheck": "tsc --noEmit",
+    "typecheck:scripts": "tsc -p tsconfig.scripts.json",
+    "typecheck:all": "tsc -p tsconfig.tests.json",
     "lint": "biome check .",
     "fix": "bun run lint --fix",
     "docs:dev": "bun run --cwd docs dev",
@@ -93,10 +95,10 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.11",
+    "@biomejs/biome": "2.5.12",
     "@earendil-works/pi-coding-agent": "0.83.0",
-    "@opencode-ai/plugin": "1.18.21",
-    "@opencode-ai/sdk": "1.18.21",
+    "@opencode-ai/plugin": "1.18.27",
+    "@opencode-ai/sdk": "1.18.27",
     "@semantic-release/exec": "7.1.0",
     "@tintinweb/pi-subagents": "0.14.3",
     "@types/bun": "latest",