@glrs-dev/cli 0.1.1 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @glrs-dev/cli
 
+## 0.3.1
+
+### Patch Changes
+
+- [#19](https://github.com/iceglober/glrs/pull/19) [`6e942c5`](https://github.com/iceglober/glrs/commit/6e942c5099a535a7d1cda161a1bbc1692f937008) Thanks [@iceglober](https://github.com/iceglober)! - Link `@glrs-dev/cli` and `@glrs-dev/harness-plugin-opencode` versions in Changesets config so they always release together. The CLI vendors the harness plugin's `dist/` at build time (via `packages/cli/scripts/vendor-harness.ts`), so plugin fixes don't reach users running `glrs oc install` until a CLI release is cut. Linking the two ensures every harness-plugin bump produces a matching CLI bump, closing the gap where a plugin fix sat on npm without a CLI tarball that bundled it.
+
+  This bump also forces a CLI republish that vendors `@glrs-dev/harness-plugin-opencode@0.3.0` so users get the recent `glrs oc install` reconfigure fix via `glrs oc install`, not just `glrs-oc install` directly.
+
 ## 0.1.1
 
 ### Patch Changes

package/dist/vendor/harness-opencode/dist/agents/prompts/pilot-builder.md

@@ -68,12 +68,22 @@ Write the minimal code that makes verify pass:
 - Modify existing? Read the surrounding 30 lines first; mirror the existing patterns in indentation, error handling, log format.
 - Add a test? Look at one existing test in the same dir; copy its scaffolding (imports, setup, teardown). Don't invent a new test pattern when the codebase has a strong convention.
 
-## 4. Do NOT install new dependencies unless the task asks for one
+## 4. Dependency rules — task-level vs environment bootstrap
 
-If `task.prompt` says "add lodash to handle deep merging", install it. If the task is silent on deps, don't add them — find an existing util, write a tiny helper inline, or ask via STOP if the task is genuinely impossible without a dep.
+### 4a. Task-level dependencies still require task approval
+
+If `task.prompt` says "add lodash to handle deep merging", install it. If the task is silent on deps, don't add them — find an existing util, write a tiny helper inline, or STOP if the task is genuinely impossible without a dep.
 
 `package.json` / `bun.lock` / `Cargo.lock` etc. are typically NOT in your `touches:` scope. Adding a dep when the scope forbids editing the lock file is a touches violation; the worker will catch it.
 
+### 4b. Environment bootstrap self-heals during the fix-loop
+
+If a verify failure clearly points to an environmental issue — `Cannot find module 'X'` where `X` is a workspace/monorepo dep, `node_modules` absent despite a lockfile committed to the repo, a stale build artifact a typecheck depends on — you ARE expected to run the obvious install command BEFORE giving up with STOP.
+
+Recognise these canonical bootstrap commands: `pnpm install`, `bun install`, `npm install`, `npm ci`, `cargo fetch`, `cargo build`. If the plan declared a `setup:` block, treat that block as the canonical list — run those commands verbatim.
+
+The plugin deny list does not block any of these; they are not task-level dependency additions and they do not require lockfile edits.
+
 ## 5. When you think you're done, just stop
 
 Don't write a "Summary" message. Don't list the files you changed. Don't propose follow-ups. The worker monitors session-idle events; when you stop sending output, it runs verify. If verify passes, the work commits with the message `<task.id>: <task.title>`. If verify fails, you'll get a fix prompt with the failure output verbatim.

package/dist/vendor/harness-opencode/dist/agents/prompts/pilot-planner.md

@@ -45,12 +45,13 @@ Use Serena and grep to map out:
 - Existing tests that already cover related code (the verify commands will likely be variations of those).
 - Existing patterns the change should match.
 - Any module boundaries that suggest natural task splits.
+- **Tooling footprint** — lockfiles, docker-compose services, migration tooling, UI/API/DB test frameworks. You'll use these in Section 3 to propose a `setup:` block and per-surface verify patterns.
 
 Be thorough here. A planner who shipped a sloppy plan because they only skimmed the codebase wastes hours of pilot-builder time chasing bad scope.
 
 ## 3. Apply the planning methodology
 
-The `pilot-planning` skill carries the eight rules. Apply them:
+The `pilot-planning` skill carries the ten rules. Apply them:
 
 1. First-principles task framing.
 2. Decomposition into right-sized tasks.
@@ -60,6 +61,16 @@ The `pilot-planning` skill carries the eight rules. Apply them:
 6. Optional milestone grouping.
 7. Self-review.
 8. Per-task `context:` population (rationale, code pointers, acceptance shorthand).
+9. **Setup-block authoring** — detect lockfiles (pnpm, bun, npm, yarn, Cargo), docker-compose services, and migration tooling (prisma, drizzle-kit, knex, flyway), then propose specific setup commands to the user for confirmation.
+10. **QA-expectations establishment** — detect per-surface test frameworks and propose concrete verify patterns:
+    - **UI**: Playwright, Cypress, or Vitest browser mode for visual/interaction assertions
+    - **API**: curl against local endpoints or OpenAPI-based contract tests
+    - **DB**: Postgres readiness checks and migration verification (prisma migrate, drizzle-kit push)
+    - **Integration**: `test/integration` or `e2e` directory patterns
+    - **Browser-based component**: Storybook or Chromatic visual tests
+    - **CLI**: bin/ smoke tests or `--help` verification
+
+Rules 9 and 10 typically involve ONE bundled `question` tool call to the user — combine setup proposals and per-surface verify proposals into a single round (respecting "talk to the user — once" guidance).
 
 ## 4. Write the YAML
 
@@ -69,6 +80,10 @@ Required schema (see `src/pilot/plan/schema.ts` for the canonical Zod definition
 
 ```yaml
 name: <human-readable plan name>
+setup:                          # optional — run once per worktree before any task
+  - pnpm install --frozen-lockfile
+  - docker compose up -d postgres
+  - pnpm prisma migrate dev
 defaults:                       # optional, override per-task as needed
   agent: pilot-builder          # default
   model: anthropic/claude-sonnet-4-6

package/dist/vendor/harness-opencode/dist/agents/prompts/research-auto.md

@@ -0,0 +1,37 @@
+---
+name: research-auto
+description: Research orchestrator subagent — Autonomous experimentation skill. Agent interviews the user, sets up a lab, then explores freely (think, test, reflect) until stopped or a target is hit. Works for any domain where you can measure or evaluate a result. Use when user says 'optimize this', 'experiment with', 'find the best approach', 'iterate on', 'research mode'. Do NOT use for binary validation tests (use /spec-lab instead). Based on ResearcherSkill v1.4.4 by krzysztofdudek.
+mode: all
+model: anthropic/claude-opus-4-7
+temperature: 0.3
+---
+
+# @research-auto — Autonomous Experimentation Agent
+
+You are the `research-auto` agent. Your job is to run autonomous experiments by following the bundled `research-auto` skill methodology end-to-end.
+
+**Research Query:** $ARGUMENTS
+
+## Task
+
+1. Read the bundled `research-auto` skill via the Skill tool
+2. Follow every instruction in the skill exactly
+3. Execute the full experimentation workflow from discovery through conclusion
+
+## Notes on Experiment Commands
+
+This agent may run arbitrary user-supplied commands as part of experiments. The `.lab/` directory is used for scratch writes and experiment tracking. These are expected behaviors per the skill methodology.
+
+## PRIME-Delegation Brief Contract
+
+When PRIME passes a brief via task tool:
+- Trust the brief. The task-tool arguments ARE the research query — proceed directly.
+- Do not re-interview on points already resolved in the brief.
+- If the brief lacks critical context (e.g., no query provided), ask once then proceed.
+
+## STOP — Do Not
+
+- Do NOT experiment directly without following the skill methodology
+- Do NOT skip the discovery phase — it is mandatory
+- Do NOT skip the commit-before-run guardrail — it is mandatory
+- Do NOT exceed 3 rounds without presenting — MAX 3 ROUNDS, THEN PRESENT

package/dist/vendor/harness-opencode/dist/agents/prompts/research-local.md

@@ -0,0 +1,33 @@
+---
+name: research-local
+description: Research orchestrator subagent — Deep codebase research using parallel Explore subagents. Decomposes a question about the local codebase into research tasks, launches parallel explorations, reviews for gaps, iterates, and synthesizes findings with specific file paths and line numbers. Use when user says 'how does X work in this codebase', 'where is Y implemented', 'trace the data flow for Z', 'what patterns does this repo use', 'explain the architecture of'. Provide the research topic as arguments.
+mode: all
+model: anthropic/claude-opus-4-7
+temperature: 0.3
+---
+
+# @research-local — Codebase Research Agent
+
+You are the `research-local` agent. Your job is to execute deep codebase research by following the bundled `research-local` skill methodology end-to-end. Scope is local codebase ONLY — no web research.
+
+**Research Query:** $ARGUMENTS
+
+## Task
+
+1. Read the bundled `research-local` skill via the Skill tool
+2. Follow every instruction in the skill exactly
+3. Execute the full research workflow from decomposition through synthesis
+
+## PRIME-Delegation Brief Contract
+
+When PRIME passes a brief via task tool:
+- Trust the brief. The task-tool arguments ARE the research query — proceed directly.
+- Do not re-interview on points already resolved in the brief.
+- If the brief lacks critical context (e.g., no query provided), ask once then proceed.
+
+## STOP — Do Not
+
+- Do NOT research directly — always follow the research-local skill methodology
+- Do NOT use exploration tools yourself — every phase is a subagent
+- Do NOT skip the decomposition phase — it is mandatory
+- Do NOT synthesize findings yourself — synthesis is a subagent

package/dist/vendor/harness-opencode/dist/agents/prompts/research-web.md

@@ -0,0 +1,32 @@
+---
+name: research-web
+description: Research orchestrator subagent — Multi-agent web research orchestrator. Decomposes a research question into parallel agent workstreams, launches them, monitors progress, and synthesizes results. Use when user says 'research this topic', 'I need to understand', 'deep dive into', 'investigate the market for', 'what do we know about'. Provide the research topic and context.
+mode: all
+model: anthropic/claude-opus-4-7
+temperature: 0.3
+---
+
+# @research-web — Web Research Agent
+
+You are the `research-web` agent. Your job is to execute web research by following the bundled `research-web` skill methodology end-to-end.
+
+**Research Query:** $ARGUMENTS
+
+## Task
+
+1. Read the bundled `research-web` skill via the Skill tool
+2. Follow every instruction in the skill exactly
+3. Execute the full research workflow from planning through synthesis
+
+## PRIME-Delegation Brief Contract
+
+When PRIME passes a brief via task tool:
+- Trust the brief. The task-tool arguments ARE the research query — proceed directly.
+- Do not re-interview on points already resolved in the brief.
+- If the brief lacks critical context (e.g., no query provided), ask once then proceed.
+
+## STOP — Do Not
+
+- Do NOT research directly — always follow the research-web skill methodology
+- Do NOT skip the planning phase — it is mandatory
+- Do NOT launch agents sequentially — dispatch all independent workstreams in ONE message

package/dist/vendor/harness-opencode/dist/agents/prompts/research.md

@@ -22,30 +22,25 @@ You are an **orchestrator only**. You do NOT:
 
 Every cognitive task is a subagent. You launch subagents and pass their outputs to other subagents.
 
-## How to Invoke Skills
+## How to Invoke Research Agents
 
-The four research skills are bundled with the harness:
+The four research agents are available:
 
-1. **`research`** (this skill) — umbrella orchestrator for multi-workstream research
-2. **`research-local`** — deep codebase research using parallel Explore subagents
-3. **`research-web`** — multi-agent web research with skeleton-file pattern
-4. **`research-auto`** — autonomous experimentation with `.lab/` directory
+1. **`@research`** (this agent) — umbrella orchestrator for multi-workstream research
+2. **`@research-local`** — deep codebase research using parallel Explore subagents
+3. **`@research-web`** — multi-agent web research with skeleton-file pattern
+4. **`@research-auto`** — autonomous experimentation with `.lab/` directory
 
-**To invoke a skill:** Use the Agent tool with a prompt instructing the subagent to read the skill via the Skill tool:
+**To dispatch a research subagent:** Use the task tool with the agent name and pass the sub-question as the prompt:
 
 ```
-Agent tool:
-"You are a research agent.
-
-## Research Query
-{the full query or sub-question}
-
-## Task
-1. Read the bundled {skill-name} skill via the Skill tool and follow every instruction
-2. Focus specifically on: {sub-question}
-3. Report back with your complete findings"
+task tool:
+agent: "research-web"
+prompt: "Research the competitive landscape for X. Focus on: {specific angle}."
 ```
 
+The research agents are thin shims that load their matching bundled skill and follow it end-to-end. Trust the brief — the task-tool arguments ARE the research query.
+
 ## 7-Phase Flow
 
 ### Phase 1: Plan — Subagent
@@ -77,9 +72,9 @@ Output 3-6 workstreams. Mark dependencies explicitly."
 
 Dispatch **one Agent per workstream**. Launch ALL independent workstreams in a SINGLE message.
 
-For LOCAL workstreams: invoke `research-local` skill.
-For WEB workstreams: invoke `research-web` skill.
-For AUTO workstreams: invoke `research-auto` skill.
+For LOCAL workstreams: dispatch `@research-local` via task tool.
+For WEB workstreams: dispatch `@research-web` via task tool.
+For AUTO workstreams: dispatch `@research-auto` via task tool.
 
 ### Phase 3: Review Round 1 — Subagent
 

package/dist/vendor/harness-opencode/dist/{chunk-XCZ3NOXR.js → chunk-CZMAJISX.js}

@@ -59,6 +59,9 @@ var agentsMdWriterPrompt = readPrompt("agents-md-writer.md");
 var pilotBuilderPrompt = readPrompt("pilot-builder.md");
 var pilotPlannerPrompt = readPrompt("pilot-planner.md");
 var researchPrompt = readPrompt("research.md");
+var researchWebPrompt = readPrompt("research-web.md");
+var researchLocalPrompt = readPrompt("research-local.md");
+var researchAutoPrompt = readPrompt("research-auto.md");
 function stripFrontmatter(md) {
   if (!md.startsWith("---")) return md;
   const end = md.indexOf("\n---", 3);
@@ -557,6 +560,9 @@ var AGENT_TIERS = {
   "gap-analyzer": "deep",
   "pilot-planner": "deep",
   research: "deep",
+  "research-web": "deep",
+  "research-local": "deep",
+  "research-auto": "deep",
   build: "mid",
   "qa-reviewer": "mid",
   "docs-maintainer": "mid",
@@ -641,6 +647,28 @@ function createAgents() {
       model: "anthropic/claude-opus-4-7",
       temperature: 0.3,
       permission: RESEARCH_PERMISSIONS
+    }),
+    // Research subagents — thin shims that load the bundled skills
+    "research-web": agentFromPrompt(researchWebPrompt, {
+      description: "Research orchestrator subagent \u2014 Multi-agent web research orchestrator. Decomposes a research question into parallel agent workstreams, launches them, monitors progress, and synthesizes results. Use when user says 'research this topic', 'I need to understand', 'deep dive into', 'investigate the market for', 'what do we know about'. Provide the research topic and context.",
+      mode: "all",
+      model: "anthropic/claude-opus-4-7",
+      temperature: 0.3,
+      permission: RESEARCH_PERMISSIONS
+    }),
+    "research-local": agentFromPrompt(researchLocalPrompt, {
+      description: "Research orchestrator subagent \u2014 Deep codebase research using parallel Explore subagents. Decomposes a question about the local codebase into research tasks, launches parallel explorations, reviews for gaps, iterates, and synthesizes findings with specific file paths and line numbers. Use when user says 'how does X work in this codebase', 'where is Y implemented', 'trace the data flow for Z', 'what patterns does this repo use', 'explain the architecture of'. Provide the research topic as arguments.",
+      mode: "all",
+      model: "anthropic/claude-opus-4-7",
+      temperature: 0.3,
+      permission: RESEARCH_PERMISSIONS
+    }),
+    "research-auto": agentFromPrompt(researchAutoPrompt, {
+      description: "Research orchestrator subagent \u2014 Autonomous experimentation skill. Agent interviews the user, sets up a lab, then explores freely (think, test, reflect) until stopped or a target is hit. Works for any domain where you can measure or evaluate a result. Use when user says 'optimize this', 'experiment with', 'find the best approach', 'iterate on', 'research mode'. Do NOT use for binary validation tests (use /spec-lab instead). Based on ResearcherSkill v1.4.4 by krzysztofdudek.",
+      mode: "all",
+      model: "anthropic/claude-opus-4-7",
+      temperature: 0.3,
+      permission: RESEARCH_PERMISSIONS
     })
   };
 }

package/dist/vendor/harness-opencode/dist/{chunk-VVMP6QWS.js → chunk-WBBN7OVN.js}

@@ -257,7 +257,7 @@ async function requirePlugin() {
     );
     process.exit(1);
   }
-  const { install: install2 } = await import("./install-4EYR56OR.js");
+  const { install: install2 } = await import("./install-X5KEANRB.js");
   await install2({ nonInteractive: true });
 }
 
@@ -505,6 +505,116 @@ function migrateHarnessKeyToPluginOptions(configPath) {
   } catch {
   }
 }
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (typeof a !== "object") return false;
+  const aObj = a;
+  const bObj = b;
+  const aKeys = Object.keys(aObj);
+  const bKeys = Object.keys(bObj);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const key of aKeys) {
+    if (!bKeys.includes(key)) return false;
+    if (!deepEqual(aObj[key], bObj[key])) return false;
+  }
+  return true;
+}
+function writePluginOption(configPath, subKey, value, opts) {
+  try {
+    if (!fs3.existsSync(configPath)) {
+      return { changed: false };
+    }
+    const raw = fs3.readFileSync(configPath, "utf8");
+    const config = JSON.parse(raw);
+    if (!Array.isArray(config.plugin)) {
+      return { changed: false };
+    }
+    const pluginIdx = config.plugin.findIndex((entry) => {
+      const name = typeof entry === "string" ? entry : Array.isArray(entry) ? entry[0] : null;
+      return name === PLUGIN_NAME2 || String(name ?? "").startsWith(`${PLUGIN_NAME2}@`);
+    });
+    if (pluginIdx < 0) {
+      return { changed: false };
+    }
+    const current = config.plugin[pluginIdx];
+    const existingName = typeof current === "string" ? current : Array.isArray(current) ? current[0] : PLUGIN_NAME2;
+    const existingOpts = Array.isArray(current) && current.length >= 2 ? current[1] : {};
+    if (deepEqual(existingOpts[subKey], value)) {
+      return { changed: false };
+    }
+    const newOpts = { ...existingOpts, [subKey]: value };
+    if (opts.dryRun) {
+      info(`[dry-run] Would reconfigure ${subKey} in plugin options`);
+      return { changed: true };
+    }
+    const bakPath = `${configPath}.bak.${Date.now()}-${process.pid}`;
+    fs3.copyFileSync(configPath, bakPath);
+    config.plugin[pluginIdx] = [existingName, newOpts];
+    fs3.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    ok(`Reconfigured ${subKey}`);
+    info(`Backup: ${bakPath}`);
+    return { changed: true, bakPath };
+  } catch {
+    return { changed: false };
+  }
+}
+function writeMcpToggles(configPath, enabledSet, opts) {
+  try {
+    if (!fs3.existsSync(configPath)) {
+      return { changed: false };
+    }
+    const raw = fs3.readFileSync(configPath, "utf8");
+    const config = JSON.parse(raw);
+    const toggleNames = new Set(MCP_TOGGLES.map((t) => t.name));
+    const existingMcp = config.mcp && typeof config.mcp === "object" ? { ...config.mcp } : {};
+    const newMcp = {};
+    let hasChanges = false;
+    for (const [key, val] of Object.entries(existingMcp)) {
+      if (!toggleNames.has(key)) {
+        newMcp[key] = val;
+      }
+    }
+    for (const toggleName of toggleNames) {
+      if (enabledSet.has(toggleName)) {
+        newMcp[toggleName] = { enabled: true };
+        if (!deepEqual(existingMcp[toggleName], { enabled: true })) {
+          hasChanges = true;
+        }
+      } else {
+        if (existingMcp[toggleName] !== void 0) {
+          hasChanges = true;
+        }
+      }
+    }
+    if (!hasChanges && Object.keys(newMcp).length === Object.keys(existingMcp).length) {
+      const allKeysMatch = Object.keys(newMcp).every(
+        (k) => deepEqual(newMcp[k], existingMcp[k])
+      );
+      if (allKeysMatch) {
+        return { changed: false };
+      }
+    }
+    if (opts.dryRun) {
+      info(`[dry-run] Would reconfigure MCP toggles`);
+      return { changed: true };
+    }
+    const bakPath = `${configPath}.bak.${Date.now()}-${process.pid}`;
+    fs3.copyFileSync(configPath, bakPath);
+    if (Object.keys(newMcp).length > 0) {
+      config.mcp = newMcp;
+    } else {
+      delete config.mcp;
+    }
+    fs3.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    ok("Reconfigured MCPs");
+    info(`Backup: ${bakPath}`);
+    return { changed: true, bakPath };
+  } catch {
+    return { changed: false };
+  }
+}
 async function install(opts = {}) {
   const { dryRun = false, pin = false, nonInteractive = false } = opts;
   const configPath = getOpencodeConfigPath2();
@@ -533,6 +643,10 @@ ${c.bold}${c.blue}@glrs-dev/harness-plugin-opencode${c.reset} setup
   if (existingMcps.size > 0) {
     ok(`MCPs: ${[...existingMcps].join(", ")} enabled`);
   }
+  let reconfigureModels = false;
+  let reconfigureMcps = false;
+  let newModelsValue = null;
+  let newMcpEnabledSet = /* @__PURE__ */ new Set();
   if (hasPlugin && (existingProvider || hasModels)) {
     const unconfiguredMcps = MCP_TOGGLES.filter(
       (t) => !existingMcps.has(t.name) && !existing?.mcp?.[t.name]
@@ -544,8 +658,20 @@ ${c.bold}${c.blue}@glrs-dev/harness-plugin-opencode${c.reset} setup
         0
       );
       if (reconfigure === 1) {
+        reconfigureModels = true;
         hasModels = false;
-      } else if (unconfiguredMcps.length === 0) {
+      }
+      if (existingMcps.size > 0) {
+        const reconfigureMcpChoice = await promptChoice(
+          "  Reconfigure MCPs?",
+          ["No, keep current config", "Yes, reconfigure MCPs"],
+          0
+        );
+        if (reconfigureMcpChoice === 1) {
+          reconfigureMcps = true;
+        }
+      }
+      if (!reconfigureModels && !reconfigureMcps && unconfiguredMcps.length === 0) {
         console.log(`
 ${c.bold}Ready.${c.reset} Run ${c.green}opencode${c.reset} to start.
 `);
@@ -632,6 +758,11 @@ ${c.bold}Ready.${c.reset} Run ${c.green}opencode${c.reset} to start.
         mid: [preset.mid],
         fast: [preset.fast]
       };
+      newModelsValue = {
+        deep: [preset.deep],
+        mid: [preset.mid],
+        fast: [preset.fast]
+      };
       ok(`Models configured`);
     } else if (!pluginOpts._skipModels) {
       info("Enter model IDs in <provider>/<model-id> format (e.g. amazon-bedrock/global.anthropic.claude-opus-4-7)");
@@ -645,6 +776,11 @@ ${c.bold}Ready.${c.reset} Run ${c.green}opencode${c.reset} to start.
           mid: [midModel || deepModel],
           fast: [fastModel || midModel || deepModel]
         };
+        newModelsValue = {
+          deep: [deepModel],
+          mid: [midModel || deepModel],
+          fast: [fastModel || midModel || deepModel]
+        };
         ok("Models: custom");
       } else {
         ok("Models: OpenCode defaults");
@@ -653,6 +789,22 @@ ${c.bold}Ready.${c.reset} Run ${c.green}opencode${c.reset} to start.
     delete pluginOpts._skipModels;
     console.log();
   }
+  if (interactive && reconfigureMcps) {
+    console.log(`${c.dim}Reconfigure MCP servers${c.reset}`);
+    const currentEnabled = new Set(existingMcps);
+    const selected = await promptMulti(
+      "  Select MCPs to enable:",
+      MCP_TOGGLES.map((t) => ({ label: t.label, defaultOn: currentEnabled.has(t.name) }))
+    );
+    newMcpEnabledSet = new Set([...selected].map((i) => MCP_TOGGLES[i].name));
+    const names = [...newMcpEnabledSet].join(", ");
+    if (newMcpEnabledSet.size > 0) {
+      ok(`MCPs to enable: ${names}`);
+    } else {
+      ok("MCPs: all disabled");
+    }
+    console.log();
+  }
   const pluginValue = Object.keys(pluginOpts).length > 0 ? [pluginEntry, pluginOpts] : pluginEntry;
   const config = {
     $schema: "https://opencode.ai/config.json",
@@ -683,6 +835,12 @@ ${c.bold}Ready.${c.reset} Run ${c.green}opencode${c.reset} to start.
       console.log();
     }
   }
+  if (reconfigureModels && newModelsValue) {
+    writePluginOption(configPath, "models", newModelsValue, { dryRun });
+  }
+  if (reconfigureMcps) {
+    writeMcpToggles(configPath, newMcpEnabledSet, { dryRun });
+  }
   if (!fs3.existsSync(configPath)) {
     if (dryRun) {
       info(`[dry-run] Would create ${configPath}`);
@@ -727,5 +885,7 @@ ${c.bold}Ready.${c.reset} Run ${c.green}opencode${c.reset} to start.
 export {
   requirePlugin,
   MODEL_PRESETS,
+  writePluginOption,
+  writeMcpToggles,
   install
 };

package/dist/vendor/harness-opencode/dist/cli.js

@@ -2,11 +2,11 @@
 import {
   createAgents,
   validateModelOverride
-} from "./chunk-XCZ3NOXR.js";
+} from "./chunk-CZMAJISX.js";
 import {
   install,
   requirePlugin
-} from "./chunk-VVMP6QWS.js";
+} from "./chunk-WBBN7OVN.js";
 import "./chunk-VJUETC6A.js";
 
 // src/cli.ts
@@ -514,6 +514,7 @@ var PlanSchema = z.object({
   branch_prefix: z.string().min(1).optional(),
   defaults: DefaultsSchema,
   milestones: z.array(MilestoneSchema).default([]),
+  setup: z.array(VerifyCommandSchema).default([]),
   tasks: z.array(TaskSchema).min(1, "plan must declare at least one task")
 }).strict();
 function parsePlan(input) {
@@ -2224,7 +2225,8 @@ var WorktreePool = class {
         path: "",
         // filled by prepare
         prepared: false,
-        preserved: false
+        preserved: false,
+        setupCompleted: false
       };
       this.slots.set(n, stub);
       return stub;
@@ -2862,6 +2864,8 @@ async function runWorker(deps) {
   const attempted = [];
   const maxAttempts = deps.maxAttempts ?? 3;
   const stallMs = deps.stallMs ?? 60 * 60 * 1e3;
+  let setupAborted = false;
+  const depsWithAbort = deps;
   while (true) {
     if (deps.abortSignal?.aborted) {
       return { aborted: true, attempted };
@@ -2871,7 +2875,10 @@ async function runWorker(deps) {
       return { aborted: false, attempted };
     }
     attempted.push(pick.task.id);
-    await runOneTask(deps, pick.task, { maxAttempts, stallMs });
+    await runOneTask(depsWithAbort, pick.task, { maxAttempts, stallMs });
+    if (depsWithAbort.setupAborted) {
+      return { aborted: false, attempted };
+    }
     const row = getTask(deps.db, deps.runId, pick.task.id);
     if (row && (row.status === "failed" || row.status === "aborted")) {
       const blocked = deps.scheduler.cascadeFail(
@@ -2957,6 +2964,78 @@ async function runOneTask(deps, task, opts) {
     });
     return;
   }
+  const setupCommands = deps.plan.setup ?? [];
+  if (setupCommands.length > 0 && !slot.setupCompleted) {
+    const setupStart = Date.now();
+    appendEvent(deps.db, {
+      runId: deps.runId,
+      taskId: task.id,
+      kind: "slot.setup.started",
+      payload: {
+        slotIndex: slot.index,
+        commands: deps.plan.setup,
+        taskId: task.id
+      }
+    });
+    const setupResult = await runVerify(setupCommands, {
+      cwd: prepared.path,
+      abortSignal: deps.abortSignal,
+      onLine: deps.onVerifyLine
+    });
+    if (!setupResult.ok) {
+      const durationMs = Date.now() - setupStart;
+      const failure = setupResult.failure;
+      const reason2 = `setup failed: ${failure.command} \u2192 exit ${failure.exitCode}`;
+      appendEvent(deps.db, {
+        runId: deps.runId,
+        taskId: task.id,
+        kind: "slot.setup.failed",
+        payload: {
+          slotIndex: slot.index,
+          command: failure.command,
+          exitCode: failure.exitCode,
+          output: failure.output.slice(0, 4096),
+          // truncate
+          durationMs
+        }
+      });
+      deps.pool.preserveOnFailure(slot);
+      markFailedSafe(deps.db, deps.runId, task.id, reason2);
+      const blocked = new Set(
+        deps.scheduler.cascadeFail(task.id, reason2)
+      );
+      for (const row of listTasks(deps.db, deps.runId)) {
+        if (row.task_id === task.id) continue;
+        if (blocked.has(row.task_id)) continue;
+        if (row.status !== "pending" && row.status !== "ready") continue;
+        try {
+          markBlocked(deps.db, deps.runId, row.task_id, reason2);
+          blocked.add(row.task_id);
+        } catch {
+        }
+      }
+      for (const blockedId of blocked) {
+        appendEvent(deps.db, {
+          runId: deps.runId,
+          taskId: blockedId,
+          kind: "task.blocked",
+          payload: { reason: reason2, failedDep: task.id }
+        });
+      }
+      deps.setupAborted = true;
+      return;
+    }
+    slot.setupCompleted = true;
+    appendEvent(deps.db, {
+      runId: deps.runId,
+      taskId: task.id,
+      kind: "slot.setup.completed",
+      payload: {
+        slotIndex: slot.index,
+        durationMs: Date.now() - setupStart
+      }
+    });
+  }
   let sessionId;
   try {
     const created = await deps.client.session.create({

package/dist/vendor/harness-opencode/dist/index.js

@@ -3,7 +3,7 @@ import {
   createAgents,
   formatModelOverrideWarning,
   validateModelOverride
-} from "./chunk-XCZ3NOXR.js";
+} from "./chunk-CZMAJISX.js";
 import {
   PACKAGE_NAME,
   readOurPackageVersion,
@@ -1850,7 +1850,7 @@ import { join as join8 } from "path";
 var APP_KEY = "A-US-3617699429";
 var ENDPOINT = "https://us.aptabase.com/api/v0/event";
 var PKG_NAME = "@glrs-dev/harness-plugin-opencode";
-var PKG_VERSION = true ? "0.2.0" : "dev";
+var PKG_VERSION = true ? "0.3.1" : "dev";
 var DISABLED = process.env.HARNESS_OPENCODE_TELEMETRY === "0" || process.env.HARNESS_OPENCODE_TELEMETRY === "false" || process.env.DO_NOT_TRACK === "1" || process.env.CI === "true";
 var SESSION_ID = randomUUID();
 function getInstallId() {

package/dist/vendor/harness-opencode/dist/install-X5KEANRB.js

@@ -0,0 +1,13 @@
+import {
+  MODEL_PRESETS,
+  install,
+  writeMcpToggles,
+  writePluginOption
+} from "./chunk-WBBN7OVN.js";
+import "./chunk-VJUETC6A.js";
+export {
+  MODEL_PRESETS,
+  install,
+  writeMcpToggles,
+  writePluginOption
+};

package/dist/vendor/harness-opencode/dist/skills/pilot-planning/SKILL.md

@@ -11,7 +11,7 @@ A good plan trades a planning-session's worth of patient thought for hours of un
 
 ## Workflow
 
-Apply these eight rules in order. Each rule has its own file in `rules/` for the full text:
+Apply these ten rules in order. Each rule has its own file in `rules/` for the full text:
 
 1. [`first-principles.md`](rules/first-principles.md) — Frame the task FROM the user's intent, not from a templated checklist. Ask "what does the user actually want done?" before "what files might change?"
 
@@ -29,6 +29,10 @@ Apply these eight rules in order. Each rule has its own file in `rules/` for the
 
 8. [`task-context.md`](rules/task-context.md) — Every non-trivial task carries a `context:` block. Thin plans fail because the builder works each task from scratch with no carry-over; rich context pre-loads what the builder needs to work confidently. Cover outcome, rationale, code pointers, acceptance.
 
+9. [`setup-authoring.md`](rules/setup-authoring.md) — Detect → propose → confirm the top-level `setup:` block. Covers package manager install, docker-compose services, and migration tooling detection.
+
+10. [`qa-expectations.md`](rules/qa-expectations.md) — Detect → propose → confirm per-surface verify patterns for UI, API, DB, integration, browser-based component, and CLI surfaces.
+
 ## After applying the rules
 
 1. Save the YAML to the path returned by `bunx @glrs-dev/harness-plugin-opencode pilot plan-dir`.

package/dist/vendor/harness-opencode/dist/skills/pilot-planning/rules/qa-expectations.md

@@ -0,0 +1,120 @@
+# Rule 10 — QA-expectations establishment
+
+**Detect → propose → confirm per-surface verify patterns.**
+
+A plan's verify commands are its contract with the builder. Generic verifies ("run tests") waste builder time; specific verifies ("run the API tests that exercise the files this task touches") catch real failures. This rule establishes concrete, per-surface QA expectations with the user before emitting the plan.
+
+## The six surfaces
+
+For each surface below, detect signals in the codebase, propose a canonical verify pattern, and confirm with the user.
+
+### UI — Browser-based user interface
+
+**Detection signals:**
+- `@playwright/test`, `cypress`, or `@vitest/browser` in `package.json` dependencies
+- `playwright.config.{ts,js}` or `cypress.config.*` present
+
+**Proposed verify pattern:**
+Playwright MCP invocation for visual/interaction assertions:
+```yaml
+verify:
+  - playwright test --project=chromium --grep "@task-specific-tag"
+```
+
+### API — HTTP endpoints
+
+**Detection signals:**
+- `openapi.yaml` / `openapi.json` present
+- `curl` or `httpie` usage in existing scripts
+- Postman collection files
+
+**Proposed verify pattern:**
+Direct HTTP assertion against a local port:
+```yaml
+verify:
+  - curl -fsS http://localhost:3000/health | jq '.status == "ok"'
+```
+
+### DB — Database schema and queries
+
+**Detection signals:**
+- `docker-compose` postgres service defined
+- `prisma`, `drizzle-kit`, `knex`, or `flyway` in dependencies
+- `test/db` or similar helper directory
+
+**Proposed verify pattern:**
+Postgres readiness + migration + assertion:
+```yaml
+verify:
+  - pg_isready -h localhost -p 5432
+  - pnpm prisma migrate deploy
+  - pnpm tsx scripts/verify-db.ts
+```
+
+### Integration — Cross-module workflows
+
+**Detection signals:**
+- `test/integration/**` directory exists
+- `e2e/**` directory exists
+- `*.integration.test.ts` files
+
+**Proposed verify pattern:**
+Integration test runner scoped to relevant paths:
+```yaml
+verify:
+  - pnpm test test/integration
+```
+
+### Browser-based component — Storybook stories
+
+**Detection signals:**
+- `storybook` or `@storybook/*` in dependencies
+- `*.stories.{ts,tsx}` files present
+
+**Proposed verify pattern:**
+Storybook test or Chromatic visual verification:
+```yaml
+verify:
+  - pnpm storybook test --stories "ComponentName"
+```
+
+### CLI — Command-line interface
+
+**Detection signals:**
+- `bin/*` directory with executables
+- `package.json` `bin:` entry defined
+
+**Proposed verify pattern:**
+Smoke test via help flag or scripted invocation:
+```yaml
+verify:
+  - pnpm my-cli --help
+  - pnpm tsx scripts/smoke-test-cli.ts
+```
+
+## Question-bundling rule
+
+**Two or more surfaces detected:** Bundle into a single structured `question` tool call with one checkbox group per surface.
+
+**One surface detected:** Still ask (confirmation, not interrogation), but use a single-field call.
+
+**Zero surfaces detected:** Skip the QA-expectation question entirely. Fall back to generic verifies:
+```yaml
+defaults:
+  verify_after_each:
+    - pnpm run typecheck
+    - pnpm test
+```
+
+## Emission
+
+Confirmed patterns become:
+
+1. **Per-task verify templates** — tasks targeting specific files use scoped verifies (e.g., `pnpm test test/api/users.test.ts` for a task touching `src/api/users.ts`)
+2. **defaults.verify_after_each** — global breakage catchers (typecheck, full test suite)
+
+The rule: per-task verify targets the specific files touched; defaults catches global breakage.
+
+## Cross-reference to verify-design.md
+
+This rule (10) is the per-surface tactical layer — it names the tools to detect and the patterns to propose. Rule 3 (verify-design.md) owns the principles: deterministic, assertive, would-have-failed-before. Every proposed command must satisfy both layers.

package/dist/vendor/harness-opencode/dist/skills/pilot-planning/rules/setup-authoring.md

@@ -0,0 +1,68 @@
+# Rule 9 — Setup-block authoring
+
+**Detect → propose → confirm the top-level `setup:` block.**
+
+The `setup:` block runs once per worktree before any task executes. It is the environment bootstrap: package manager install, docker-compose services, migration runs. A good setup block means the builder starts with a working environment; a missing one means tasks fail confusingly on missing dependencies.
+
+## Detection signals
+
+During codebase research (Section 2), look for these signals:
+
+**Lockfiles → package manager install:**
+- `pnpm-lock.yaml` → `pnpm install --frozen-lockfile`
+- `bun.lock` → `bun install --frozen-lockfile`
+- `package-lock.json` → `npm ci`
+- `yarn.lock` → `yarn install --frozen-lockfile`
+- `Cargo.lock` → `cargo fetch`
+
+**Docker Compose → service startup:**
+- `docker-compose.yml` or `compose.yaml` with defined services → `docker compose up -d <svc>` for each service the tasks will need (typically postgres, redis, etc.)
+
+**Migration tooling → schema setup:**
+- `package.json` deps containing `knex`, `prisma`, `drizzle-kit`, or `flyway` → corresponding migrate/push command (e.g., `prisma migrate dev`, `drizzle-kit push`)
+
+## Proposal shape
+
+When you detect one or more setup commands, bundle them into a single `question` tool call:
+
+- Present each detected command as a pre-selected checkbox
+- Group by category (Package install, Services, Migrations)
+- Allow the user to uncheck commands that aren't needed or edit the command text
+- Include an "Add another command" free-text field for anything you missed
+
+Example question structure:
+
+```
+Setup commands detected (check all that should run before the first task):
+
+[✓] Package install: pnpm install --frozen-lockfile
+[✓] Services: docker compose up -d postgres
+[✓] Migrations: pnpm prisma migrate dev
+
+[Add another command: __________]
+```
+
+## No-op behavior
+
+If NOTHING is detected (no lockfile, no compose, no migration tooling), emit `setup: []` or omit the key entirely. Do NOT ask the user open-ended "do you need setup?" questions. The schema defaults to `[]`; omitting is safe.
+
+## Emission
+
+Whatever the user confirms becomes the top-level `setup:` block in the written YAML, positioned above `defaults:` (matching schema ordering):
+
+```yaml
+name: my-plan
+setup:
+  - pnpm install --frozen-lockfile
+  - docker compose up -d postgres
+  - pnpm prisma migrate dev
+defaults:
+  verify_after_each:
+    - pnpm run typecheck
+tasks:
+  ...
+```
+
+## Back-compat note
+
+The `setup:` key already defaults to `[]` in the schema (line 241 of `src/pilot/plan/schema.ts`). Plans that omit it or set it to `[]` behave identically to before this rule existed.

package/dist/vendor/harness-opencode/dist/skills/pilot-planning/rules/verify-design.md

@@ -51,3 +51,7 @@ If a verify command flakes, three retries will exhaust attempts and the task fai
 ## Always include a "before" check
 
 For non-trivial tasks, write a verify that would HAVE FAILED before the task ran. This makes the task's value observable. If the verify passed before AND passes after, the task didn't actually move the system.
+
+## Cross-reference: per-surface tooling menu
+
+For the per-surface tooling menu (Playwright for UI, curl for API, Postgres for DB), see rule 10 (`qa-expectations.md`). That rule applies these principles to specific tools; this rule defines the principles themselves.

package/dist/vendor/harness-opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glrs-dev/harness-plugin-opencode",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glrs-dev/cli",
-  "version": "0.1.1",
+  "version": "0.3.1",
   "description": "Unified CLI for the @glrs-dev ecosystem — OpenCode agent harness dispatch + worktree management.",
   "license": "MIT",
   "repository": {

package/dist/vendor/harness-opencode/dist/install-4EYR56OR.js

@@ -1,9 +0,0 @@
-import {
-  MODEL_PRESETS,
-  install
-} from "./chunk-VVMP6QWS.js";
-import "./chunk-VJUETC6A.js";
-export {
-  MODEL_PRESETS,
-  install
-};