@fro.bot/systematic 3.5.1 → 3.5.3

package/ATTRIBUTIONS.md

@@ -71,10 +71,10 @@ SOFTWARE.
 
 ## pbakaus/impeccable — Apache 2.0
 
-**Source repository:** [https://github.com/pbakaus/impeccable](https://github.com/pbakaus/impeccable)  
-**Pinned commit:** `642f03d5a10eb3deb91bd511241e387e23b9aa39`  
-**License:** Apache 2.0  
-**Copyright:** Paul Bakaus  
+**Source repository:** [https://github.com/pbakaus/impeccable](https://github.com/pbakaus/impeccable)
+**Pinned commit:** `642f03d5a10eb3deb91bd511241e387e23b9aa39`
+**License:** Apache 2.0
+**Copyright:** Paul Bakaus
 
 ### Files derived
 
@@ -272,7 +272,7 @@ The following is the full Apache License, Version 2.0 text, reproduced here in c
 ## vercel-labs/agent-browser — Apache-2.0
 
 **Source repository:** [`vercel-labs/agent-browser`](https://github.com/vercel-labs/agent-browser)
-**Pinned version:** `v0.33.0` (npm `agent-browser@0.33.0`)
+**Pinned version:** `v0.33.1` (npm `agent-browser@0.33.1`)
 **License:** Apache-2.0
 **Copyright:** Copyright 2025 Vercel Inc.
 
@@ -289,14 +289,14 @@ Vendored verbatim from the pinned npm package (`node_modules/agent-browser/skill
 Refresh is **automated** via the pinned `devDependency` + `agent-browser:build` regeneration + `agent-browser:drift` CI gate:
 
 1. Renovate opens a version-bump PR when upstream releases a new `agent-browser` version.
-2. The `postUpgradeTasks` in `renovate.json5` runs `bun run agent-browser:build`, which regenerates `skills/agent-browser/SKILL.md` from the newly pinned version and lands the updated stub in the same PR.
+2. The `postUpgradeTasks` in `renovate.json5` runs `bun run postupgrade` (which runs `bun run agent-browser:build`), which regenerates `skills/agent-browser/SKILL.md` from the newly pinned version and lands the updated stub in the same PR.
 3. The CI `agent-browser:drift` step verifies the committed file matches the pinned package and fails the PR if it does not.
 
 This is fully automated — no human adaptation pass is required, in contrast to `obra/superpowers` which is manually refreshed because its content is hand-adapted on each bump.
 
 ### Upstream Apache-2.0 license text
 
-The following is the full Apache License, Version 2.0 text from `agent-browser@0.33.0`, reproduced here in compliance with the license's notice requirements:
+The following is the full Apache License, Version 2.0 text from `agent-browser@0.33.1`, reproduced here in compliance with the license's notice requirements:
 
 ```
                                  Apache License

package/dist/index.js

@@ -1309,6 +1309,15 @@ var DEFAULT_LIMITS = {
   maxTotalFileBytes: 16777216,
   maxPathBytes: 4096
 };
+var UNTRACKED_FILES_ARGS = [
+  "ls-files",
+  "--others",
+  "--exclude-standard",
+  "--full-name",
+  "-z",
+  "--",
+  ":/"
+];
 function unavailable(result) {
   return { status: "unavailable", reasonCode: result.reasonCode };
 }
@@ -1420,15 +1429,15 @@ function runCommand(runner, args2, cwd, limits) {
   }
   return { status: "ok", output: { stdout: result.stdout } };
 }
-function readRevision(runner, root, limits) {
-  const branch = runCommand(runner, ["symbolic-ref", "--short", "HEAD"], root, limits);
+function readRevision(runner, context, limits) {
+  const branch = runCommand(runner, ["symbolic-ref", "--short", "HEAD"], context.commandDirectory, limits);
   if (branch.status === "error" && branch.reasonCode !== "command-failed") {
     return branch;
   }
   const branchValue = branch.status === "ok" ? branch.output.stdout.trim() : "detached";
   let head;
   try {
-    head = runner(["rev-parse", "--verify", "HEAD"], root, limits.maxCommandOutputBytes, limits.maxCommandTimeoutMs);
+    head = runner(["rev-parse", "--verify", "HEAD"], context.commandDirectory, limits.maxCommandOutputBytes, limits.maxCommandTimeoutMs);
   } catch {
     return { status: "error", reasonCode: "command-failed" };
   }
@@ -1439,7 +1448,7 @@ function readRevision(runner, root, limits) {
     return { status: "error", reasonCode: "command-output-limit" };
   }
   const headValue = head.status === 0 ? head.stdout.trim() : "unborn";
-  const inside = runCommand(runner, ["rev-parse", "--is-inside-work-tree"], root, limits);
+  const inside = runCommand(runner, ["rev-parse", "--is-inside-work-tree"], context.commandDirectory, limits);
   if (inside.status === "error")
     return inside;
   return {
@@ -1454,8 +1463,8 @@ function readRevision(runner, root, limits) {
 function isEnoent(error) {
   return error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT";
 }
-function appendSubmoduleFact(hash, runner, root, relativePath, limits, totalBytes) {
-  const submodule = runCommand(runner, ["-C", relativePath, "rev-parse", "--verify", "HEAD"], root, limits);
+function appendSubmoduleFact(hash, runner, submodulePath, relativePath, limits, totalBytes) {
+  const submodule = runCommand(runner, ["rev-parse", "--verify", "HEAD"], submodulePath, limits);
   if (submodule.status === "error")
     return submodule;
   const revision = submodule.output.stdout.trim();
@@ -1512,9 +1521,9 @@ function appendRegularFact(hash, fileReader, absolutePath, relativePath, stat, l
   hash.update("\x00");
   return { status: "ok", totalBytes: totalBytes + content.byteLength };
 }
-function appendFileFactV2(hash, runner, fileReader, symlinkReader, statReader, root, entry, limits, totalBytes) {
+function appendFileFactV2(hash, runner, fileReader, symlinkReader, statReader, context, entry, limits, totalBytes) {
   const { mode, relativePath } = entry;
-  const absolutePath = safePath(root, relativePath);
+  const absolutePath = safePath(context.worktreeRoot, relativePath);
   if (!absolutePath || outputBytes(relativePath) > limits.maxPathBytes) {
     return { status: "error", reasonCode: "file-read-failed" };
   }
@@ -1525,20 +1534,20 @@ function appendFileFactV2(hash, runner, fileReader, symlinkReader, statReader, r
     return isEnoent(error) ? { status: "ok", totalBytes } : { status: "error", reasonCode: "file-read-failed" };
   }
   if (mode === "160000")
-    return appendSubmoduleFact(hash, runner, root, relativePath, limits, totalBytes);
+    return appendSubmoduleFact(hash, runner, absolutePath, relativePath, limits, totalBytes);
   if (stat.isSymbolicLink) {
     return appendSymlinkFact(hash, symlinkReader, absolutePath, relativePath, limits, totalBytes);
   }
   return appendRegularFact(hash, fileReader, absolutePath, relativePath, stat, limits, totalBytes);
 }
-function readWorktreeRevisionV2(runner, fileReader, symlinkReader, statReader, root, limits) {
-  const tracked = runCommand(runner, ["ls-files", "-z"], root, limits);
+function readWorktreeRevisionV2(runner, fileReader, symlinkReader, statReader, context, limits) {
+  const tracked = runCommand(runner, ["ls-files", "--full-name", "-z", "--", ":/"], context.commandDirectory, limits);
   if (tracked.status === "error")
     return tracked;
-  const staged = runCommand(runner, ["ls-files", "--stage", "-z"], root, limits);
+  const staged = runCommand(runner, ["ls-files", "--stage", "--full-name", "-z", "--", ":/"], context.commandDirectory, limits);
   if (staged.status === "error")
     return staged;
-  const untracked = runCommand(runner, ["ls-files", "--others", "--exclude-standard", "-z"], root, limits);
+  const untracked = runCommand(runner, UNTRACKED_FILES_ARGS, context.commandDirectory, limits);
   if (untracked.status === "error")
     return untracked;
   const stageEntries = parseStageEntries(staged.output.stdout, limits.maxPathBytes);
@@ -1558,17 +1567,17 @@ function readWorktreeRevisionV2(runner, fileReader, symlinkReader, statReader, r
   hash.update("systematic:opencode-observer:worktree:v2\x00");
   let totalBytes = 0;
   for (const relativePath of paths) {
-    const result = appendFileFactV2(hash, runner, fileReader, symlinkReader, statReader, root, { relativePath, mode: modes.get(relativePath) ?? "" }, limits, totalBytes);
+    const result = appendFileFactV2(hash, runner, fileReader, symlinkReader, statReader, context, { relativePath, mode: modes.get(relativePath) ?? "" }, limits, totalBytes);
     if (result.status === "error")
       return result;
     totalBytes = result.totalBytes;
   }
   return { status: "ok", digest: hash.digest("hex") };
 }
-function readCommitClosure(runner, root, limits) {
+function readCommitClosure(runner, context, limits) {
   let diff;
   try {
-    diff = runner(["diff", "--quiet", "HEAD", "--", "."], root, limits.maxCommandOutputBytes, limits.maxCommandTimeoutMs);
+    diff = runner(["diff", "--quiet", "HEAD", "--", ":/"], context.commandDirectory, limits.maxCommandOutputBytes, limits.maxCommandTimeoutMs);
   } catch {
     return { status: "error", reasonCode: "command-failed" };
   }
@@ -1581,7 +1590,7 @@ function readCommitClosure(runner, root, limits) {
   if (diff.status !== 0 && diff.status !== 1) {
     return { status: "error", reasonCode: "command-failed" };
   }
-  const untracked = runCommand(runner, ["ls-files", "--others", "--exclude-standard", "-z"], root, limits);
+  const untracked = runCommand(runner, UNTRACKED_FILES_ARGS, context.commandDirectory, limits);
   if (untracked.status === "error")
     return untracked;
   return {
@@ -1765,8 +1774,8 @@ function readCheckReadback(runner, root, limits, pullRequest) {
   const state = checkState(parsedChecks.value, limits);
   return state === undefined ? { status: "unavailable", reasonCode: "remote-missing-field" } : remoteResultFromPullRequest(pullRequest, { checkState: state });
 }
-function readRemoteSnapshot(runner, operation, phase, root, limits) {
-  return operation === "push" ? readPushRemoteSnapshot(runner, phase, root, limits) : readRemotePullRequest(runner, operation, root, limits);
+function readRemoteSnapshot(runner, operation, phase, commandDirectory, limits) {
+  return operation === "push" ? readPushRemoteSnapshot(runner, phase, commandDirectory, limits) : readRemotePullRequest(runner, operation, commandDirectory, limits);
 }
 function createOpencodeOperationObserver(options) {
   const limits = mergeLimits(options.limits);
@@ -1801,13 +1810,17 @@ function createOpencodeOperationObserver(options) {
       if (root.length === 0 || outputBytes(root) > limits.maxPathBytes) {
         return { status: "unavailable", reasonCode: "target-unavailable" };
       }
-      const repository = readRevision(runner, root, limits);
+      const context = {
+        commandDirectory: targetDirectory,
+        worktreeRoot: root
+      };
+      const repository = readRevision(runner, context, limits);
       if (repository.status === "error")
         return unavailable(repository);
-      const worktree = readWorktreeRevisionV2(runner, fileReader, symlinkReader, statReader, root, limits);
+      const worktree = readWorktreeRevisionV2(runner, fileReader, symlinkReader, statReader, context, limits);
       if (worktree.status === "error")
         return unavailable(worktree);
-      const closure = readCommitClosure(runner, root, limits);
+      const closure = readCommitClosure(runner, context, limits);
       if (closure.status === "error")
         return unavailable(closure);
       return {
@@ -1829,7 +1842,7 @@ function createOpencodeOperationObserver(options) {
       if (root.length === 0 || outputBytes(root) > limits.maxPathBytes) {
         return { status: "unavailable", reasonCode: "target-unavailable" };
       }
-      return readRemoteSnapshot(remoteRunner, operation, phase, root, limits);
+      return readRemoteSnapshot(remoteRunner, operation, phase, targetDirectory, limits);
     }
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.5.1",
+  "version": "3.5.3",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",
@@ -55,6 +55,7 @@
     "registry:drift": "bun scripts/generate-registry.ts --check",
     "registry:validate": "bun scripts/build-registry.ts --validate-only",
     "claude-code:build": "bun scripts/build-claude-code-plugin.ts",
+    "postupgrade": "bun run build && bun run agent-browser:build",
     "prepublishOnly": "bun run build && bun run schema:generate"
   },
   "keywords": [
@@ -92,14 +93,14 @@
   "devDependencies": {
     "@biomejs/biome": "2.5.6",
     "@earendil-works/pi-coding-agent": "0.80.10",
-    "@opencode-ai/plugin": "1.18.8",
-    "@opencode-ai/sdk": "1.18.8",
+    "@opencode-ai/plugin": "1.18.9",
+    "@opencode-ai/sdk": "1.18.9",
     "@semantic-release/exec": "7.1.0",
     "@tintinweb/pi-subagents": "0.14.3",
     "@types/bun": "latest",
     "@types/js-yaml": "4.0.9",
     "@types/node": "24.13.3",
-    "agent-browser": "0.33.0",
+    "agent-browser": "0.33.1",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "conventional-changelog-conventionalcommits": "9.3.1",

package/skills/orchestrating-subagents/SKILL.md

@@ -17,6 +17,7 @@ Every subagent dispatch should carry the same bounded brief, expressed through t
 Specialist: systematic-implementer
 Objective: Implement the auth module
 Scope: Make only the changes needed for the auth module.
+Workspace: /absolute/path/to/expected-repository-or-worktree
 Return: List the changed files and summarize the implementation.
 ```
 
@@ -24,6 +25,7 @@ Return: List the changed files and summarize the implementation.
 - **Specialist** — the registered agent or persona best suited to the work (for example, an implementer or researcher)
 - **Objective** — a concise statement of the outcome
 - **Scope** — full instructions, boundaries, dependencies, and files in scope
+- **Workspace** — for any write-capable dispatch, the explicit expected repository or worktree root
 - **Return** — the result format expected from the specialist
 
 **Optional brief elements:**
@@ -61,6 +63,7 @@ After the first result, dispatch:
   Objective: Implement caching
   Scope: Implement caching based on the research result below.
   Input: Include the first specialist's returned research.
+  Workspace: /absolute/path/to/expected-repository-or-worktree
   Return: List changed files and summarize the implementation.
 ```
 
@@ -110,6 +113,12 @@ When dispatching units in parallel, include these instructions in each specialis
 
 > Do not stage files (`git add`), create commits, or run the project test suite. Leave staging and committing to the orchestrator or caller.
 
+## Workspace Attestation
+
+For every write-capable dispatch, the specialist must verify and return its actual repository or worktree root using available repository tooling (for example, `git rev-parse --show-toplevel` when Git is available) and an inventory of changed files. The orchestrator must independently verify the expected worktree's status and diff, plus the source or primary checkout's status, before accepting the result; a path in the brief or a specialist's self-report is not evidence.
+
+If writes landed in the wrong checkout, stop dependent dispatches, inspect both diffs, transfer only intended changes deliberately, and restore only confirmed accidental agent edits. Do not blindly copy or reset.
+
 ## Result Synthesis
 
 After specialists complete, the orchestrator synthesizes results:
@@ -138,6 +147,7 @@ After specialists complete, the orchestrator synthesizes results:
 | Background unavailable | Foreground only — serial or batched |
 | Specialist fails | Diagnose, correct the brief, then re-dispatch or resume the prior session where supported |
 | File collision detected post-parallel | Stage non-colliding files (if workflow owns git ops), re-run colliding units serially |
+| Write-capable dispatch | Include the expected root; require actual-root and changed-file attestation; independently verify both worktrees before acceptance |
 
 ## Common Mistakes