@jmanuelcorral/openteam 0.16.0 → 0.16.1

package/dist/index.js

@@ -2450,6 +2450,10 @@ function splitVirtualPath(path) {
 
 // src/cli/graphOperator.ts
 var ALLOWED_GATE = { allowed: true, violations: [] };
+var ALLOWED_EVALUATION = {
+  kind: "evaluated",
+  gate: ALLOWED_GATE
+};
 function journalRoot(config) {
   return config.graph?.journalRoot ?? DEFAULT_GRAPH_JOURNAL_ROOT;
 }
@@ -2539,7 +2543,7 @@ async function listWorktreeObservations(config, options) {
   })));
 }
 function createGraphOperator(options) {
-  const evaluateCutoverGate = options.evaluateCutoverGate ?? (async () => ALLOWED_GATE);
+  const evaluateCutoverGate = options.evaluateCutoverGate ?? (async () => ALLOWED_EVALUATION);
   const worktreeOptions = options.exec === undefined ? undefined : {
     exec: options.exec,
     repoRoot: options.repoRoot ?? process.cwd(),
@@ -4298,6 +4302,36 @@ var SUPPORTED_OPENCODE_VERSIONS = [
   "1.18.18",
   "1.18.19"
 ];
+var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
+function parseSemver(version) {
+  const normalized = version.trim().replace(/^[=^~v]+/, "");
+  const match = SEMVER_RE.exec(normalized);
+  if (match === null) {
+    throw new Error(`invalid semver: "${version}"`);
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+function isCertificateVersionCompatible(certifiedVersion, liveVersion) {
+  if (certifiedVersion === liveVersion) {
+    return true;
+  }
+  let certified;
+  let live;
+  try {
+    certified = parseSemver(certifiedVersion);
+    live = parseSemver(liveVersion);
+  } catch {
+    return false;
+  }
+  if (certified.major !== live.major || certified.minor !== live.minor) {
+    return false;
+  }
+  return live.patch >= certified.patch;
+}
 
 // src/graph/soakLedger.ts
 import { z as z15 } from "zod";
@@ -4556,8 +4590,8 @@ function parseShadowCertificate(value, opencodeVersion) {
   if (sha256Hex(canonicalCertificate(unsigned)) !== digest) {
     throw new ShadowCertificateError("digest-mismatch", "certificate digest does not cover the presented evidence");
   }
-  if (certificate.opencodeVersion !== opencodeVersion) {
-    throw new ShadowCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", expected "${opencodeVersion}"`);
+  if (!isCertificateVersionCompatible(certificate.opencodeVersion, opencodeVersion)) {
+    throw new ShadowCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", running "${opencodeVersion}" — evidence is accepted only on ${certificate.opencodeVersion} or a newer patch of the same minor line`);
   }
   return certificate;
 }
@@ -4741,8 +4775,8 @@ function parseReleaseCertificate(value, opencodeVersion, expectedShadowDigest) {
   if (sha256Hex(canonicalReleaseCertificate(unsigned)) !== digest) {
     throw new ReleaseCertificateError("digest-mismatch", "certificate digest does not cover the presented evidence");
   }
-  if (certificate.opencodeVersion !== opencodeVersion) {
-    throw new ReleaseCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", expected "${opencodeVersion}"`);
+  if (!isCertificateVersionCompatible(certificate.opencodeVersion, opencodeVersion)) {
+    throw new ReleaseCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", running "${opencodeVersion}" — evidence is accepted only on ${certificate.opencodeVersion} or a newer patch of the same minor line`);
   }
   return certificate;
 }
@@ -8344,7 +8378,7 @@ function legacyRosterFindings(audit) {
   }
   return findings;
 }
-function rosterHealthSection(audit, loadError, rosterRoleCount) {
+function rosterHealthSection(audit, loadError, rosterRoleCount, rosterMissing) {
   const auditFindings = audit?.findings ?? legacyRosterFindings(audit ?? {});
   const unparseable = auditFindings.find((finding) => finding.kind === "unparseable-roster");
   const unparseableMessage = loadError ?? unparseable?.message;
@@ -8357,6 +8391,14 @@ function rosterHealthSection(audit, loadError, rosterRoleCount) {
     ];
   }
   if (audit === undefined) {
+    if (rosterMissing === true) {
+      return [
+        "  roster health:",
+        `    ✗ ${OPENTEAM_ROSTER_PATH} does not exist — no team roster has been cast.`,
+        "      consequence: without a roster openteam cannot distribute work across roles, so every request is handled by a single agent and no work splitting happens.",
+        `      remedy: run \`openteam setup\` to cast a team and write the roster (${OPENTEAM_ROSTER_PATH}), then re-run \`openteam doctor\`.`
+      ];
+    }
     return [];
   }
   const missing = auditFindings.filter((finding) => finding.kind === "missing-guaranteed-role").map((finding) => finding.roleID);
@@ -8392,6 +8434,14 @@ function rosterHealthSection(audit, loadError, rosterRoleCount) {
   }
   return lines;
 }
+function orchestratorAgentSection() {
+  return [
+    "  orchestrator agent:",
+    `    ✗ ${ORCHESTRATOR_AGENT_PATH} does not exist — opencode has no openteam coordinator agent.`,
+    "      consequence: this is the primary agent that reads the roster and calls `openteam-orchestrate` to fan work out across roles; without it opencode has no openteam coordinator, so every request is handled by a single agent and no work splitting happens.",
+    `      remedy: run \`openteam setup\` to generate ${ORCHESTRATOR_AGENT_PATH}, then re-run \`openteam doctor\`.`
+  ];
+}
 function gitignoreSection(gitignore) {
   if (gitignore.missingRules.length === 0) {
     return [
@@ -8455,7 +8505,10 @@ function renderDoctor(input) {
   if (input.diagnostics !== undefined) {
     lines.push(...diagnosticsSection(input.diagnostics));
   }
-  lines.push(...rosterHealthSection(input.rosterAudit, input.rosterLoadError, input.rosterRoleCount));
+  lines.push(...rosterHealthSection(input.rosterAudit, input.rosterLoadError, input.rosterRoleCount, input.rosterMissing));
+  if (input.orchestratorAgentMissing === true) {
+    lines.push(...orchestratorAgentSection());
+  }
   if (input.gitignore !== undefined) {
     lines.push(...gitignoreSection(input.gitignore));
   }
@@ -8539,14 +8592,31 @@ function leaseLine(lease) {
   const state = lease.released ? "released" : "active";
   return `  lease:      ${lease.holder} → ${lease.runID} (${state})`;
 }
-function renderGraphStatus(snapshot) {
+function appendEffectiveLines(lines, gate) {
+  switch (gate.kind) {
+    case "not-applicable":
+      return;
+    case "passed":
+      lines.push("  effective:  active");
+      return;
+    case "unevaluable":
+      lines.push("  effective:  unknown — could not evaluate the cutover gate");
+      lines.push(`    ${gate.reason}`);
+      return;
+    case "denied":
+      lines.push("  effective:  off — cutover gate denied");
+      for (const violation of gate.violations) {
+        lines.push(`    • ${violation.code}: ${violation.detail}`);
+      }
+  }
+}
+function renderGraphStatus(snapshot, gate = { kind: "not-applicable" }) {
   const lines = [
     "openteam graph status:",
-    `  config:     ${snapshot.effectiveMode} (source: ${snapshot.source})`,
-    leaseLine(snapshot.lease),
-    `  journal:    ${snapshot.journal}`,
-    `  effects:    ${snapshot.pendingEffects} pending, ${snapshot.unknownEffects} unknown`
+    `  config:     ${snapshot.effectiveMode} (source: ${snapshot.source})`
   ];
+  appendEffectiveLines(lines, gate);
+  lines.push(leaseLine(snapshot.lease), `  journal:    ${snapshot.journal}`, `  effects:    ${snapshot.pendingEffects} pending, ${snapshot.unknownEffects} unknown`);
   const needsReconciliation = isRecoveryRequired(snapshot.journal, snapshot.unknownEffects);
   if (needsReconciliation) {
     lines.push("  ⚠ Reconciliation required: journal or effects in an uncertain state.");
@@ -9990,8 +10060,7 @@ async function runAgents(deps, configPath, opencodeConfigPaths, configResolution
 async function runGraph(positionals, deps, configPath, configResolution) {
   const sub = positionals[1];
   if (sub === "status") {
-    const snapshot = await deps.readGraphSnapshot(configPath, configResolution);
-    return { exitCode: 0, stdout: renderGraphStatus(snapshot) };
+    return runGraphStatus(deps, configPath, configResolution);
   }
   if (sub === "cancel") {
     return runGraphCancel(positionals, deps, configPath, configResolution);
@@ -10046,7 +10115,9 @@ function renderGraphOutcome(outcome) {
 async function resolveOperatorGraphPolicy(config, operator) {
   let graph = resolveGraphConfig(config, "file");
   if (isGateApplicable(graph.effectiveMode)) {
-    graph = applyGraphGate(graph, await operator.evaluateCutoverGate());
+    const evaluation = await operator.evaluateCutoverGate(config);
+    const gate = evaluation.kind === "evaluated" ? evaluation.gate : { allowed: false, violations: [] };
+    graph = applyGraphGate(graph, gate);
   }
   return {
     graph,
@@ -10064,6 +10135,32 @@ function checkOperatorGate(policy) {
     stdout: renderLegacyGraphReason(decision2)
   };
 }
+async function runGraphStatus(deps, configPath, configResolution) {
+  const snapshot = await deps.readGraphSnapshot(configPath, configResolution);
+  if (!isGateApplicable(snapshot.effectiveMode)) {
+    return { exitCode: 0, stdout: renderGraphStatus(snapshot) };
+  }
+  const operator = deps.graphOperator;
+  if (operator === undefined) {
+    const gate2 = {
+      kind: "unevaluable",
+      reason: "graph operator ports are not configured"
+    };
+    return { exitCode: 0, stdout: renderGraphStatus(snapshot, gate2) };
+  }
+  const config = await deps.loadConfig(configPath, configResolution);
+  const evaluation = await operator.evaluateCutoverGate(config);
+  if (evaluation.kind === "unevaluable") {
+    const gate2 = {
+      kind: "unevaluable",
+      reason: evaluation.reason
+    };
+    return { exitCode: 0, stdout: renderGraphStatus(snapshot, gate2) };
+  }
+  const resolved = applyGraphGate(resolveGraphConfig(config, "file"), evaluation.gate);
+  const gate = resolved.gateDenied === true ? { kind: "denied", violations: resolved.gateViolations ?? [] } : { kind: "passed" };
+  return { exitCode: 0, stdout: renderGraphStatus(snapshot, gate) };
+}
 async function runGraphCancel(positionals, deps, configPath, configResolution) {
   const runID = positionals[2];
   if (runID === undefined || runID.trim() === "") {
@@ -10510,6 +10607,9 @@ async function runCli(argv, deps) {
         const summary = summarizeQueueWaits(queueEvents);
         queueWait = summary !== undefined ? { summary } : {};
       }
+      const rosterMissing = deps.loadRosterForDoctor !== undefined && roster === undefined && rosterLoadError === undefined;
+      const orchestratorAgentName = ORCHESTRATOR_AGENT_PATH.slice(ORCHESTRATOR_AGENT_PATH.lastIndexOf("/") + 1).replace(/\.md$/, "");
+      const orchestratorAgentMissing = !agentFiles.some((file) => file.name === orchestratorAgentName);
       return {
         exitCode: 0,
         stdout: renderDoctor({
@@ -10523,6 +10623,8 @@ async function runCli(argv, deps) {
           ...rosterAudit !== undefined ? { rosterAudit } : {},
           ...rosterRoleCount !== undefined ? { rosterRoleCount } : {},
           ...rosterLoadError !== undefined ? { rosterLoadError } : {},
+          ...rosterMissing ? { rosterMissing } : {},
+          ...orchestratorAgentMissing ? { orchestratorAgentMissing } : {},
           ...diagnostics !== undefined && diagnostics.length > 0 ? { diagnostics } : {},
           ...opencodeConfigError !== undefined ? { opencodeConfigError } : {},
           ...cacheEntries !== undefined ? { cacheEntries, cliVersion: deps.version } : {},
@@ -13387,7 +13489,7 @@ var createOtlpSpanExporter = (connection, config) => {
 // package.json
 var package_default = {
   name: "@jmanuelcorral/openteam",
-  version: "0.16.0",
+  version: "0.16.1",
   packageManager: "bun@1.3.14",
   description: "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
   license: "MIT",
@@ -13751,6 +13853,14 @@ async function buildGateInput(config, storage, opencodeVersion, warn) {
   const operatorApproval = config.graph?.operatorApproval ?? false;
   return { shadow, release, soak, migration, operatorApproval };
 }
+var OPENCODE_VERSION_UNRESOLVED_REASON = "the opencode version is not determinable outside a running opencode session, " + "so the cutover gate cannot be verified here — the running plugin logs the " + "authoritative gate result and warns loudly on a real denial";
+async function evaluateCutoverGateForBoundary(config, storage, version) {
+  if (version === undefined) {
+    return { kind: "unevaluable", reason: OPENCODE_VERSION_UNRESOLVED_REASON };
+  }
+  const gateInput = await buildGateInput(config, storage, version, () => {});
+  return { kind: "evaluated", gate: evaluateGraphGate(gateInput) };
+}
 function recorderPortsFromStorage(storage) {
   return {
     fs: {
@@ -13838,7 +13948,7 @@ async function readStoredRosterForDoctor(storage) {
   }
 }
 var auditStoredRosterForDoctor = (roster, configuredRoles) => typeof roster === "string" ? auditRoster(roster, configuredRoles) : auditRoster(roster, configuredRoles);
-function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SESSIONS_DIR, storage = createFsStorageProvider(process.cwd()), fallbackSource = "options", rawOptions) {
+function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SESSIONS_DIR, storage = createFsStorageProvider(process.cwd()), fallbackSource = "options", rawOptions, resolveOpencodeVersion) {
   return {
     loadConfig: async (path4, resolution = { explicit: false }) => {
       const content = await readCliConfigFromStorage(storage, path4, resolution);
@@ -13912,7 +14022,8 @@ function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SE
     }),
     graphOperator: createGraphOperator({
       storage,
-      holder: "openteam-cli"
+      holder: "openteam-cli",
+      evaluateCutoverGate: async (gateConfig) => evaluateCutoverGateForBoundary(gateConfig, storage, resolveOpencodeVersion === undefined ? undefined : await resolveOpencodeVersion())
     }),
     configPath: DEFAULT_CONFIG_PATH,
     telemetryPath,
@@ -14042,7 +14153,14 @@ var server = async (ctx, rawOptions) => {
     injectMemory,
     onRoute: (sid, model) => sessionTracker.trackRoutedModel(sid, model)
   });
-  const cliDeps = createCliDeps(config, registry, telemetryPath, sessionsDir, storage, runtimeConfig.source, rawOptions);
+  const getOpencodeVersion = createLazyOpencodeVersionReader(ctx.serverUrl, {
+    client: ctx.client,
+    onFailure: createOpencodeVersionReadFailureLogger(MAX_LOGGED_OPENCODE_VERSION_FAILURE_CAUSES, diagnostics.warn("opencode-version-read-failed", { toast: false }))
+  });
+  const cliDeps = createCliDeps(config, registry, telemetryPath, sessionsDir, storage, runtimeConfig.source, rawOptions, async () => {
+    const version = await getOpencodeVersion();
+    return version === "unknown" ? undefined : version;
+  });
   const toolcalls = createToolcallTracker({ sink });
   const announcedSessions = new Set;
   const announceEndpoint = (sessionID) => {
@@ -14065,10 +14183,6 @@ var server = async (ctx, rawOptions) => {
   if (config.privacyMode === "forceLocalOnSensitive" && localDefault(config) === null) {
     warnInertPrivacySetting(runtimeConfig.searchedPaths, diagnostics.warn("privacy-inert"));
   }
-  const getOpencodeVersion = createLazyOpencodeVersionReader(ctx.serverUrl, {
-    client: ctx.client,
-    onFailure: createOpencodeVersionReadFailureLogger(MAX_LOGGED_OPENCODE_VERSION_FAILURE_CAUSES, diagnostics.warn("opencode-version-read-failed", { toast: false }))
-  });
   if (isGateApplicable(graphConfig.effectiveMode)) {
     const opencodeVersion = await getOpencodeVersion();
     const gateInput = await buildGateInput(config, storage, opencodeVersion, diagnostics.warn("soak-evidence-rejected", { toast: false }));
@@ -14233,6 +14347,7 @@ export {
   logOpencodeServerUrl,
   logAvailabilityRefreshError,
   isMissingFile,
+  evaluateCutoverGateForBoundary,
   src_default as default,
   createOpencodeVersionReadFailureLogger,
   createLazyOpencodeVersionReader,
@@ -14240,5 +14355,6 @@ export {
   createCliDeps,
   buildGateInput,
   PACKAGE_VERSION,
+  OPENCODE_VERSION_UNRESOLVED_REASON,
   MAX_LOGGED_OPENCODE_VERSION_FAILURE_CAUSES
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jmanuelcorral/openteam",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "packageManager": "bun@1.3.14",
   "description": "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
   "license": "MIT",