@fro.bot/systematic 3.16.3 → 3.16.5

package/dist/cli.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { type CapabilityClock, type CapabilityOutputSink, type ConfigObservationMetadata } from './lib/capability-snapshot.js';
-interface CapabilityCliRoots {
+export interface CapabilityCliRoots {
     readonly agentsRoot: string;
     readonly cwd: string;
     readonly homeDir: string;

package/dist/index.js

@@ -11776,6 +11776,15 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     }
     return source;
   }
+  function withoutStaleConditionalMetadata(existingMetadata) {
+    if (!("questionAttestation" in existingMetadata))
+      return existingMetadata;
+    if (existingMetadata.sourceDigest !== currentMarkerSource().source) {
+      return existingMetadata;
+    }
+    const { questionAttestation: _stale, ...rest } = existingMetadata;
+    return rest;
+  }
   function metadata2() {
     const source = currentMarkerSource();
     const result = {
@@ -11803,7 +11812,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
       result.satisfiedCount = source.debug.satisfiedCount;
       result.missingCount = source.debug.missingCount;
       result.family = source.debug.family;
-      result.status = source.debug.status;
+      result.debugEpochStatus = source.debug.status;
     }
     return result;
   }
@@ -11821,7 +11830,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
       output.title = "Workflow unit started";
       output.output = JSON.stringify({ status: "started" });
       output.metadata = {
-        ...existingMetadata,
+        ...withoutStaleConditionalMetadata(existingMetadata),
         ...metadata2(),
         workflowGuard: { status: "started" }
       };
@@ -11834,7 +11843,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
       reasonCode
     });
     output.metadata = {
-      ...existingMetadata,
+      ...withoutStaleConditionalMetadata(existingMetadata),
       ...metadata2(),
       workflowGuard: {
         status: "rejected",
@@ -11842,34 +11851,53 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
       }
     };
   }
-  function writeCompletionResult(output, result, target) {
+  function targetMetadataField(target) {
+    return target ? { target } : {};
+  }
+  function writeSuccessfulCompletionResult(output, target) {
     if (!isRecord7(output))
       return;
-    if (result.status === "completed" || result.status === "duplicate") {
-      output.title = "Workflow transition completed";
-      output.output = `workflow guard completed ${target}`;
-      output.metadata = {
-        ...metadata2(),
-        workflowGuard: { status: "completed", target }
-      };
+    const existingMetadata = isRecord7(output.metadata) ? output.metadata : {};
+    output.title = "Workflow transition completed";
+    output.output = `workflow guard completed ${target}`;
+    output.metadata = {
+      ...withoutStaleConditionalMetadata(existingMetadata),
+      ...metadata2(),
+      workflowGuard: { status: "completed", target }
+    };
+  }
+  function writeTerminalCompletionResult(output, result, target) {
+    if (!isRecord7(output))
       return;
-    }
-    const reasonCode = "reasonCode" in result ? result.reasonCode : "guard-unavailable";
-    const resultStatus = result.status === "waiting" ? "unavailable" : result.status;
+    const existingMetadata = isRecord7(output.metadata) ? output.metadata : {};
     output.title = "Workflow transition unavailable";
     output.output = JSON.stringify({
-      status: resultStatus,
-      reasonCode
+      status: result.status,
+      reasonCode: result.reasonCode
     });
     output.metadata = {
+      ...withoutStaleConditionalMetadata(existingMetadata),
       ...metadata2(),
       workflowGuard: {
-        status: resultStatus,
-        target,
-        reasonCode
+        status: result.status,
+        ...targetMetadataField(target),
+        reasonCode: result.reasonCode
       }
     };
   }
+  function writeAbandonedCompletionResult(output, target, reasonCode) {
+    writeTerminalCompletionResult(output, { target, status: "unavailable", reasonCode }, target);
+  }
+  function writeAbandonedCompletionMetadata(output, target, reasonCode) {
+    if (!isRecord7(output))
+      return;
+    const existingMetadata = isRecord7(output.metadata) ? output.metadata : {};
+    output.metadata = {
+      ...withoutStaleConditionalMetadata(existingMetadata),
+      ...metadata2(),
+      workflowGuard: { status: "unavailable", target, reasonCode }
+    };
+  }
   function prepareSkill(host, args2) {
     const skill = normalizeSkill(host.tool, args2);
     if (!skill)
@@ -12286,6 +12314,14 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
         callId: pending.callID,
         transitionId: pending.transitionId
       });
+      writeAbandonedCompletionMetadata(output, pending.target, "failed-operation");
+      abandonedCompletes.set(callDigest, pending.target);
+      terminalCompletes.set(callDigest, {
+        target: pending.target,
+        status: "unavailable",
+        reasonCode: "failed-operation",
+        metadataOnly: true
+      });
       return;
     }
     const result = guard.finalizeTransition({
@@ -12295,7 +12331,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     });
     if (result.status === "completed" || result.status === "duplicate") {
       finalizedCompletes.set(callDigest, pending);
-      writeCompletionResult(output, result, pending.target);
+      writeSuccessfulCompletionResult(output, pending.target);
       return;
     }
     markUnavailable();
@@ -12307,7 +12343,14 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     };
     abandonedCompletes.set(callDigest, pending.target);
     terminalCompletes.set(callDigest, terminal);
-    writeCompletionResult(output, terminal, pending.target);
+    writeTerminalCompletionResult(output, terminal, pending.target);
+  }
+  function writeTerminalReplay(output, terminal, target) {
+    if (terminal.metadataOnly) {
+      writeAbandonedCompletionMetadata(output, target, terminal.reasonCode);
+      return;
+    }
+    writeTerminalCompletionResult(output, terminal, target);
   }
   function replayTerminalComplete(callDigest, finalTarget, output) {
     const questionChallengeID = blockedQuestionCalls.get(callDigest);
@@ -12318,10 +12361,15 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
         return true;
       }
     }
+    const terminal = terminalCompletes.get(callDigest);
+    if (terminal?.target) {
+      writeTerminalReplay(output, terminal, terminal.target);
+      blockedCompletes.delete(callDigest);
+      return true;
+    }
     const replay = finalizedCompletes.get(callDigest);
     const abandonedTarget = abandonedCompletes.get(callDigest);
     const blockedTarget = blockedCompletes.get(callDigest);
-    const terminal = terminalCompletes.get(callDigest);
     const expectedTarget = replay?.target ?? abandonedTarget ?? blockedTarget;
     if (!expectedTarget)
       return false;
@@ -12331,8 +12379,6 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     }
     if (replay)
       replayComplete(callDigest);
-    if (terminal)
-      writeCompletionResult(output, terminal, expectedTarget);
     blockedCompletes.delete(callDigest);
     return true;
   }
@@ -12440,19 +12486,37 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     }
     return readbacks;
   }
+  function finishMismatchedTarget(callDigest, pending, output) {
+    abandonComplete(callDigest, pending, true);
+    terminalCompletes.set(callDigest, {
+      target: pending.target,
+      status: "unavailable",
+      reasonCode: "invalid-transition"
+    });
+    markUnavailable();
+    writeAbandonedCompletionResult(output, pending.target, "invalid-transition");
+  }
+  function finishUnreplayableComplete(finalTarget, output) {
+    markUnavailable();
+    writeAbandonedCompletionResult(output, finalTarget, "guard-unavailable");
+  }
+  function finishUnavailableReadback(callDigest, pending, output) {
+    abandonComplete(callDigest, pending, true);
+    markUnavailable();
+    writeAbandonedCompletionResult(output, pending.target, "finalization-failed");
+  }
   async function finishComplete(host, output) {
     const callDigest = digestCall(ledger, host.callID);
     const pending = pendingCompletes.get(callDigest);
     const finalTarget = normalizeTarget(host.args);
     if (pending && (!finalTarget || finalTarget !== pending.target)) {
-      abandonComplete(callDigest, pending, false);
-      markUnavailable();
+      finishMismatchedTarget(callDigest, pending, output);
       return;
     }
     if (!pending) {
       if (replayTerminalComplete(callDigest, finalTarget, output))
         return;
-      markUnavailable();
+      finishUnreplayableComplete(finalTarget, output);
       return;
     }
     if (!options.observer) {
@@ -12461,8 +12525,7 @@ function createSessionRuntime(options, operationObservers, recoveredOperationCon
     }
     const readbacks = await completionReadbacks();
     if (readbacks.status === "unavailable") {
-      abandonComplete(callDigest, pending, true);
-      markUnavailable();
+      finishUnavailableReadback(callDigest, pending, output);
       return;
     }
     finalizeComplete(callDigest, pending, output, readbacks.status === "ready" ? readbacks.readbacks : undefined);

package/dist/lib/config-handler.d.ts

@@ -1,4 +1,6 @@
 import type { Config } from '@opencode-ai/plugin';
+import type { AgentConfig } from '@opencode-ai/sdk';
+import { type PermissionSetting } from './validation.js';
 export interface ConfigHandlerDeps {
     directory: string;
     bundledSkillsDir: string;
@@ -11,6 +13,41 @@ export interface ConfigHandlerDeps {
 }
 export declare function toTitleCase(name: string): string;
 export declare function formatAgentDescription(name: string, description: string | undefined): string;
+/**
+ * Per-tool permission rule map as actually emitted by {@link permissionFromRules}:
+ * each key is a match pattern (`'*'` or an exact name) mapped to a setting.
+ */
+export type AgentPermissionRuleMap = Record<string, PermissionSetting>;
+/**
+ * Agent permission shape as emitted onto `AgentConfig.permission`, narrowed at
+ * this module's boundary to include `skill`. The `@opencode-ai/sdk` v1 `Config`
+ * type this module targets omits `skill` from `AgentConfig['permission']`
+ * (it only appears on the SDK's v2 `PermissionRuleConfig` surface), but
+ * `applyPermissionOverlay`/`addManagedSkillRules` genuinely write a `skill`
+ * rule map identical in shape to `bash`. This type documents and reads that
+ * real runtime shape without migrating the module to the v2 type surface.
+ *
+ * `permissionFromRules` emits a rule map for whatever tool key gets passed to
+ * `setPermissionRule` — not just the named keys below (e.g. `task`, per
+ * `PermissionConfig` in validation.ts and the `task` overlay field applied at
+ * config-handler.ts's overlay pass). The named keys stay for documentation of
+ * the common cases; the index signature covers every other emitted tool key.
+ */
+export interface EmittedAgentPermission {
+    edit?: AgentPermissionRuleMap;
+    bash?: AgentPermissionRuleMap;
+    webfetch?: AgentPermissionRuleMap;
+    doom_loop?: AgentPermissionRuleMap;
+    external_directory?: AgentPermissionRuleMap;
+    skill?: AgentPermissionRuleMap;
+    readonly [tool: string]: AgentPermissionRuleMap | undefined;
+}
+/**
+ * Read an agent's emitted permission map, narrowed to include `skill` (see
+ * {@link EmittedAgentPermission}). Use this instead of `AgentConfig['permission']`
+ * when a caller needs to observe the `skill` rule map this module writes.
+ */
+export declare function readEmittedAgentPermission(agent: AgentConfig | undefined): EmittedAgentPermission | undefined;
 /**
  * Create the config hook handler for the Systematic plugin.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.16.3",
+  "version": "3.16.5",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",
@@ -40,6 +40,8 @@
     "test:integration": "bun test tests/integration",
     "test:all": "bun test",
     "typecheck": "tsc --noEmit",
+    "typecheck:scripts": "tsc -p tsconfig.scripts.json",
+    "typecheck:all": "tsc -p tsconfig.tests.json",
     "lint": "biome check .",
     "fix": "bun run lint --fix",
     "docs:dev": "bun run --cwd docs dev",
@@ -93,10 +95,10 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.11",
+    "@biomejs/biome": "2.5.12",
     "@earendil-works/pi-coding-agent": "0.83.0",
-    "@opencode-ai/plugin": "1.18.21",
-    "@opencode-ai/sdk": "1.18.21",
+    "@opencode-ai/plugin": "1.18.29",
+    "@opencode-ai/sdk": "1.18.29",
     "@semantic-release/exec": "7.1.0",
     "@tintinweb/pi-subagents": "0.14.3",
     "@types/bun": "latest",
@@ -110,7 +112,7 @@
     "rimraf": "6.1.3",
     "semantic-release": "25.0.9",
     "semantic-release-export-data": "1.2.0",
-    "typebox": "1.3.25",
+    "typebox": "1.3.26",
     "typescript": "7.0.2"
   },
   "dependencies": {