@glrs-dev/harness-plugin-opencode 2.4.1 → 2.7.0

package/dist/index.js

@@ -8,7 +8,7 @@ import {
 
 // src/config-hook.ts
 import * as fs from "fs";
-import * as path from "path";
+import * as path2 from "path";
 import * as os from "os";
 
 // src/agents/shared/index.ts
@@ -39,15 +39,16 @@ var UI_EVALUATION_LADDER = readMd("ui-evaluation-ladder.md");
 // src/agents/index.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname2, join as join2 } from "path";
+import * as path from "path";
+import { dirname as dirname2, join as join3 } from "path";
 var HERE2 = dirname2(fileURLToPath2(import.meta.url));
 function readPrompt(name) {
   const candidates = [
-    join2(HERE2, "prompts", name),
+    join3(HERE2, "prompts", name),
     // dev: src/agents/prompts/
-    join2(HERE2, "agents", "prompts", name),
+    join3(HERE2, "agents", "prompts", name),
     // dist: dist/ → dist/agents/prompts/
-    join2(HERE2, "..", "..", "src", "agents", "prompts", name)
+    join3(HERE2, "..", "..", "src", "agents", "prompts", name)
     // fallback dev
   ];
   for (const p of candidates) {
@@ -216,9 +217,8 @@ var CORE_BASH_ALLOW_LIST = {
   "eslint *": "allow",
   "prettier *": "allow",
   "biome *": "allow",
-  // Our own CLI (install, doctor, autopilot, etc.) — reviewer/build invocations.
-  "bunx @glrs-dev/harness-plugin-opencode *": "allow",
-  "glrs-oc *": "allow",
+  // Our own CLI (harness, autopilot, loop, etc.) — reviewer/build invocations.
+  "glrs *": "allow",
   // GitHub CLI — read-only gh calls are fine; destructive `gh pr merge`
   // is gated at the PRIME level by human intent (user runs /ship).
   "gh pr view *": "allow",
@@ -244,6 +244,18 @@ var CORE_DESTRUCTIVE_BASH_DENIES = {
   "git push --force-with-lease*": "allow",
   "git push * --force-with-lease*": "allow"
 };
+var AUTOPILOT_BASH_DENIES = {
+  ...CORE_DESTRUCTIVE_BASH_DENIES,
+  "git checkout *": "deny",
+  "git switch *": "deny",
+  "git push*": "deny",
+  "gh pr *": "deny",
+  // Allow checkout of individual files (git checkout <ref> -- <path>)
+  "git checkout * -- *": "allow",
+  // Allow git checkout for creating new branches from current HEAD only
+  // (but NOT switching to existing branches)
+  "git checkout -b *": "allow"
+};
 var PRIME_PERMISSIONS = {
   edit: "allow",
   bash: {
@@ -337,47 +349,7 @@ var BUILD_PERMISSIONS = {
   playwright: "allow",
   linear: "allow"
 };
-var SPEC_REVIEWER_PERMISSIONS = {
-  edit: "deny",
-  bash: {
-    "*": "allow",
-    ...CORE_BASH_ALLOW_LIST,
-    ...CORE_DESTRUCTIVE_BASH_DENIES
-  },
-  webfetch: "deny",
-  ast_grep: "allow",
-  tsc_check: "allow",
-  eslint_check: "allow",
-  todo_scan: "allow",
-  comment_check: "allow",
-  question: "allow",
-  serena: "allow",
-  memory: "deny",
-  git: "allow",
-  playwright: "allow",
-  linear: "deny"
-};
-var CODE_REVIEWER_PERMISSIONS = {
-  edit: "deny",
-  bash: {
-    "*": "allow",
-    ...CORE_BASH_ALLOW_LIST,
-    ...CORE_DESTRUCTIVE_BASH_DENIES
-  },
-  webfetch: "deny",
-  ast_grep: "allow",
-  tsc_check: "allow",
-  eslint_check: "allow",
-  todo_scan: "allow",
-  comment_check: "allow",
-  question: "allow",
-  serena: "allow",
-  memory: "deny",
-  git: "allow",
-  playwright: "allow",
-  linear: "deny"
-};
-var CODE_REVIEWER_THOROUGH_PERMISSIONS = {
+var REVIEWER_PERMISSIONS = {
   edit: "deny",
   bash: {
     "*": "allow",
@@ -591,6 +563,10 @@ function createAgents() {
       temperature: 0.2,
       permission: {
         ...PRIME_PERMISSIONS,
+        bash: {
+          ...typeof PRIME_PERMISSIONS.bash === "object" ? PRIME_PERMISSIONS.bash : { "*": "allow" },
+          ...AUTOPILOT_BASH_DENIES
+        },
         question: "deny"
       },
       tools: AUTOPILOT_PRIME_DISABLED_TOOLS
@@ -602,6 +578,10 @@ function createAgents() {
       temperature: 0.1,
       permission: {
         ...PRIME_PERMISSIONS,
+        bash: {
+          ...typeof PRIME_PERMISSIONS.bash === "object" ? PRIME_PERMISSIONS.bash : { "*": "allow" },
+          ...AUTOPILOT_BASH_DENIES
+        },
         question: "deny"
       },
       tools: AUTOPILOT_PRIME_DISABLED_TOOLS
@@ -628,13 +608,13 @@ function createAgents() {
     // via overrides (see permission blocks above). docs-maintainer has no
     // frontmatter permission declaration and keeps that behavior.
     "spec-reviewer": agentFromPrompt(specReviewerPrompt, {
-      permission: SPEC_REVIEWER_PERMISSIONS
+      permission: REVIEWER_PERMISSIONS
     }),
     "code-reviewer": agentFromPrompt(codeReviewerPrompt, {
-      permission: CODE_REVIEWER_PERMISSIONS
+      permission: REVIEWER_PERMISSIONS
     }),
     "code-reviewer-thorough": agentFromPrompt(codeReviewerThoroughPrompt, {
-      permission: CODE_REVIEWER_THOROUGH_PERMISSIONS
+      permission: REVIEWER_PERMISSIONS
     }),
     "plan-reviewer": agentFromPrompt(planReviewerPrompt, {
       permission: PLAN_REVIEWER_PERMISSIONS
@@ -700,19 +680,53 @@ function createAgents() {
     })
   };
 }
+function applyAgentOverrides(agents, overrides, repoRoot) {
+  if (!overrides) return agents;
+  for (const [agentName, override] of Object.entries(overrides)) {
+    const agent = agents[agentName];
+    if (!agent) {
+      console.warn(`applyAgentOverrides: unknown agent "${agentName}" \u2014 ignoring`);
+      continue;
+    }
+    if (override.model !== void 0) {
+      agent.model = override.model;
+    }
+    if (override.prompt !== void 0) {
+      if (path.isAbsolute(override.prompt)) {
+        throw new Error(
+          `applyAgentOverrides: absolute path not allowed for agent "${agentName}"; got "${override.prompt}". Paths must be relative to repo root.`
+        );
+      }
+      const promptPath = path.join(repoRoot, override.prompt);
+      try {
+        const rawPrompt = readFileSync2(promptPath, "utf8");
+        const processedPrompt = injectUIEvaluationLadder(
+          injectWorkflowMechanics(rawPrompt)
+        );
+        agent.prompt = processedPrompt;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(
+          `applyAgentOverrides: failed to read prompt file for agent "${agentName}": "${promptPath}" \u2014 ${message}`
+        );
+      }
+    }
+  }
+  return agents;
+}
 
 // src/commands/index.ts
 import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 var HERE3 = dirname3(fileURLToPath3(import.meta.url));
 function readPrompt2(name) {
   const candidates = [
-    join3(HERE3, "prompts", name),
+    join4(HERE3, "prompts", name),
     // dev: src/commands/prompts/
-    join3(HERE3, "commands", "prompts", name),
+    join4(HERE3, "commands", "prompts", name),
     // dist: dist/ → dist/commands/prompts/
-    join3(HERE3, "..", "..", "src", "commands", "prompts", name)
+    join4(HERE3, "..", "..", "src", "commands", "prompts", name)
     // fallback dev
   ];
   for (const p of candidates) {
@@ -808,19 +822,19 @@ function createMcpConfig() {
 
 // src/skills/paths.ts
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname4, join as join4 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 function getSkillsRoot() {
   const here = dirname4(fileURLToPath4(import.meta.url));
-  return join4(here, "skills");
+  return join5(here, "skills");
 }
 
 // src/config-hook.ts
 function writePermDebugSnapshot(config) {
   if (process.env["HARNESS_OPENCODE_PERM_DEBUG"] !== "1") return;
   try {
-    const stateDir = process.env["XDG_STATE_HOME"] || path.join(os.homedir(), ".local", "state");
-    const targetDir = path.join(stateDir, "harness-opencode");
-    const targetFile = path.join(targetDir, "perm-debug.json");
+    const stateDir = process.env["XDG_STATE_HOME"] || path2.join(os.homedir(), ".local", "state");
+    const targetDir = path2.join(stateDir, "harness-opencode");
+    const targetFile = path2.join(targetDir, "perm-debug.json");
     const version = readOurPackageVersion(import.meta.url);
     const agentBlock = config.agent ?? {};
     const agentPerms = {};
@@ -893,6 +907,21 @@ function resolveHarnessModels(agents, config, pluginOptions) {
 function applyConfig(config, pluginOptions) {
   const ourAgents = createAgents();
   resolveHarnessModels(ourAgents, config, pluginOptions);
+  const agentOverrides = pluginOptions?.agents;
+  if (agentOverrides) {
+    applyAgentOverrides(ourAgents, agentOverrides, process.cwd());
+  }
+  const envOverrides = process.env["GLRS_AGENT_OVERRIDES"];
+  if (envOverrides) {
+    try {
+      const parsed = JSON.parse(envOverrides);
+      if (parsed && typeof parsed === "object") {
+        applyAgentOverrides(ourAgents, parsed, process.cwd());
+      }
+    } catch {
+      console.warn(`Failed to parse GLRS_AGENT_OVERRIDES env var: ignoring`);
+    }
+  }
   config.agent = { ...ourAgents, ...config.agent ?? {} };
   const ourCommands = createCommands();
   config.command = {
@@ -1389,7 +1418,7 @@ function createTools() {
 
 // src/plugins/dotenv.ts
 import * as fs2 from "fs";
-import * as path2 from "path";
+import * as path3 from "path";
 var DOTENV_FILES = [".env", ".env.local"];
 function parseDotenv(content) {
   const out = {};
@@ -1422,7 +1451,7 @@ function loadDotenv(directory) {
   const merged = {};
   const filesLoaded = [];
   for (const name of DOTENV_FILES) {
-    const filePath = path2.join(directory, name);
+    const filePath = path3.join(directory, name);
     let content;
     try {
       content = fs2.readFileSync(filePath, "utf8");
@@ -1477,7 +1506,7 @@ var notify_default = plugin;
 
 // src/plugins/cost-tracker.ts
 import * as fs3 from "fs/promises";
-import * as path3 from "path";
+import * as path4 from "path";
 import * as os2 from "os";
 var MAX_LINE_BYTES = 2048;
 var ROLLUP_DEBOUNCE_MS = 5e3;
@@ -1485,11 +1514,11 @@ function resolveDataDir() {
   const override = process.env.GLORIOUS_COST_TRACKER_DIR;
   if (override) {
     if (override.startsWith("~")) {
-      return path3.join(os2.homedir(), override.slice(1));
+      return path4.join(os2.homedir(), override.slice(1));
     }
     return override;
   }
-  return path3.join(os2.homedir(), ".glorious", "opencode");
+  return path4.join(os2.homedir(), ".glorious", "opencode");
 }
 function zeroTokens() {
   return {
@@ -1561,8 +1590,8 @@ var plugin2 = async () => {
     return {};
   }
   const dataDir = resolveDataDir();
-  const jsonlPath = path3.join(dataDir, "costs.jsonl");
-  const rollupPath = path3.join(dataDir, "costs.json");
+  const jsonlPath = path4.join(dataDir, "costs.jsonl");
+  const rollupPath = path4.join(dataDir, "costs.json");
   const lastSeen = /* @__PURE__ */ new Map();
   const messageMeta = /* @__PURE__ */ new Map();
   const rollup = emptyRollup();
@@ -1799,7 +1828,7 @@ var cost_tracker_default = plugin2;
 // src/plugins/tool-hooks.ts
 import * as crypto from "crypto";
 import * as fs4 from "fs";
-import * as path4 from "path";
+import * as path5 from "path";
 import * as os3 from "os";
 import { execFile as execFileCb } from "child_process";
 import { promisify as promisify6 } from "util";
@@ -1886,8 +1915,8 @@ function resolveConfig(config, pluginOptions) {
   };
 }
 function getToolOutputDir() {
-  const stateHome = process.env["XDG_STATE_HOME"] || path4.join(os3.homedir(), ".local", "state");
-  return path4.join(stateHome, "harness-opencode", "tool-output");
+  const stateHome = process.env["XDG_STATE_HOME"] || path5.join(os3.homedir(), ".local", "state");
+  return path5.join(stateHome, "harness-opencode", "tool-output");
 }
 function hashContent(content) {
   return crypto.createHash("sha256").update(content).digest("hex").slice(0, 16);
@@ -1920,9 +1949,9 @@ async function resolveSessionDir(client, sess, sessionID) {
 }
 function isUnderToolOutputDir(filePath) {
   try {
-    const abs = path4.resolve(filePath);
-    const spillDir = path4.resolve(getToolOutputDir());
-    return abs === spillDir || abs.startsWith(spillDir + path4.sep);
+    const abs = path5.resolve(filePath);
+    const spillDir = path5.resolve(getToolOutputDir());
+    return abs === spillDir || abs.startsWith(spillDir + path5.sep);
   } catch {
     return false;
   }
@@ -1957,7 +1986,7 @@ function applyBackpressure(cfg, toolName, callID, output, args) {
   try {
     const dir = getToolOutputDir();
     fs4.mkdirSync(dir, { recursive: true });
-    diskPath = path4.join(dir, `${callID}.txt`);
+    diskPath = path5.join(dir, `${callID}.txt`);
     fs4.writeFileSync(diskPath, text);
   } catch {
   }
@@ -2004,7 +2033,7 @@ ${tail}`;
 }
 async function runPostEditVerify(cfg, client, sess, sessionID, filePath, output) {
   if (!cfg.enabled) return;
-  const ext = path4.extname(filePath).toLowerCase();
+  const ext = path5.extname(filePath).toLowerCase();
   if (!TS_EXTENSIONS.has(ext)) return;
   const now = Date.now();
   if (now - sess.lastVerifyTs < 2e3) return;
@@ -2037,17 +2066,17 @@ ${String(stderr)}`;
     }
     if (!raw.trim()) return;
     const errors = parseTscOutput(raw);
-    const normPath = path4.resolve(cwd, filePath);
+    const normPath = path5.resolve(cwd, filePath);
     const fileErrors = errors.filter((e) => {
-      const errPath = path4.isAbsolute(e.file) ? e.file : path4.resolve(cwd, e.file);
-      return path4.normalize(errPath) === path4.normalize(normPath);
+      const errPath = path5.isAbsolute(e.file) ? e.file : path5.resolve(cwd, e.file);
+      return path5.normalize(errPath) === path5.normalize(normPath);
     });
     if (fileErrors.length === 0) return;
     const { rows } = dedupeAndCap(fileErrors, VERIFY_MAX_ERRORS);
     const lines = rows.map(formatRow);
     output.output += `
 
---- POST-EDIT DIAGNOSTICS (${fileErrors.length} error${fileErrors.length !== 1 ? "s" : ""} in ${path4.basename(filePath)}) ---
+--- POST-EDIT DIAGNOSTICS (${fileErrors.length} error${fileErrors.length !== 1 ? "s" : ""} in ${path5.basename(filePath)}) ---
 ` + lines.join("\n") + `
 --- Fix these before proceeding ---`;
   } catch {
@@ -2061,7 +2090,7 @@ function checkEditLoop(cfg, sess, filePath, output) {
     output.output += `
 
 --- LOOP WARNING ---
-You've edited ${path4.basename(filePath)} ${count} times this session. Consider reconsidering your approach \u2014 are you stuck in a loop? Step back and think about whether a different strategy would be more effective.
+You've edited ${path5.basename(filePath)} ${count} times this session. Consider reconsidering your approach \u2014 are you stuck in a loop? Step back and think about whether a different strategy would be more effective.
 ---`;
   }
 }
@@ -2121,16 +2150,16 @@ import { extname as extname2 } from "path";
 import { createHash as createHash2, randomUUID } from "crypto";
 import { homedir as homedir4 } from "os";
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var APP_KEY = "A-US-3617699429";
 var ENDPOINT = "https://us.aptabase.com/api/v0/event";
 var PKG_NAME = "@glrs-dev/harness-plugin-opencode";
-var PKG_VERSION = true ? "2.4.1" : "dev";
+var PKG_VERSION = true ? "2.7.0" : "dev";
 var DISABLED = process.env.HARNESS_OPENCODE_TELEMETRY === "0" || process.env.HARNESS_OPENCODE_TELEMETRY === "false" || process.env.DO_NOT_TRACK === "1" || process.env.CI === "true";
 var SESSION_ID = randomUUID();
 function getInstallId() {
-  const dir = join9(homedir4(), ".config", "harness-opencode");
-  const file = join9(dir, "install-id");
+  const dir = join10(homedir4(), ".config", "harness-opencode");
+  const file = join10(dir, "install-id");
   try {
     if (existsSync(file)) return readFileSync5(file, "utf8").trim();
     mkdirSync3(dir, { recursive: true });

package/package.json

@@ -1,14 +1,20 @@
 {
   "name": "@glrs-dev/harness-plugin-opencode",
-  "version": "2.4.1",
+  "version": "2.7.0",
   "description": "Opinionated OpenCode agent harness — PRIME, plan, build, QA, skills, MCP wiring, hashline editing.",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
-  "bin": {
-    "glrs-oc": "dist/cli.js",
-    "harness-opencode": "dist/cli.js"
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./cli": {
+      "import": "./dist/cli-exports.js",
+      "types": "./dist/cli-exports.d.ts"
+    }
   },
   "files": [
     "dist",
@@ -24,8 +30,7 @@
     "typecheck": "tsc --noEmit",
     "test": "bun test",
     "lint": "echo 'no linter configured yet'",
-    "dev": "bun run build && bash -c 'PKG_DIR=\"$PWD\"; cd \"${INIT_CWD:-$PWD}\" && GLRS_CLI_DISPATCHED=1 exec bun \"$PKG_DIR/dist/cli.js\" \"$@\"' --",
-    "dev:nobuild": "bash -c 'PKG_DIR=\"$PWD\"; cd \"${INIT_CWD:-$PWD}\" && GLRS_CLI_DISPATCHED=1 exec bun \"$PKG_DIR/dist/cli.js\" \"$@\"' --"
+    "dev": "tsup --watch"
   },
   "peerDependencies": {
     "@opencode-ai/plugin": "^1.15",

package/dist/cli.d.ts

@@ -1 +0,0 @@
-#!/usr/bin/env bun