@maestria/opencode 0.2.4 → 0.2.6

package/agents/adventurer.md

@@ -161,6 +161,7 @@ _(none — adventurer is read-only; skills load only on trigger)_
 - `opensrc` (`vercel-labs/opensrc`) — load when external library internals affect the answer
 - `c4-architecture` (`softaworks/agent-toolkit`) — load when output requires a context/container diagram
 - `mermaid-diagrams` (`softaworks/agent-toolkit`) — load when a sequence/flow/ER diagram is requested
+- `agent-browser` (`vercel-labs/agent-browser`) — load when exploring a running web app, visual references/links provided, or Electron apps need inspection (skip if backend-only)
 
 ### Defer to specialist
 

package/agents/architect.md

@@ -105,6 +105,7 @@ After the ADR is written, your handoff should cover:
 
 - `architecture-decision-records` (`softaworks/agent-toolkit`) — Phase 5 (Document as ADR) requires this skill
 - `improve-codebase-architecture` (`mattpocock/skills`) — architect's home for codebase-deepen opportunities
+- `improve` (`shadcn/improve`) — survey codebase and produce prioritized implementation plans
 
 ### Load on trigger
 

package/agents/builder.md

@@ -88,10 +88,11 @@ This reveals what actually requires heavy tools vs. what's simple.
 - `vercel-react-best-practices` (`vercel-labs/agent-skills`) — load when task involves React (skip if non-frontend)
 - `vercel-composition-patterns` (`vercel-labs/agent-skills`) — load when task involves React composition (skip if non-frontend)
 - `react-dev` (`softaworks/agent-toolkit`) — load when task is React (skip if non-frontend)
-- `react-useeffect` (`softaworks/agent-toolkit`) — load when modifying `useEffect` (skip if non-frnd)
+- `react-useeffect` (`softaworks/agent-toolkit`) — load when modifying `useEffect` (skip if non-frontend)
 - `ai-sdk` (`vercel/ai`) — load when task is AI SDK (skip if unrelated)
 - `tdd` (`mattpocock/skills`) — load when user explicitly requests TDD
 - `webapp-testing` (`anthropics/skills`) — load when task needs browser-level test
+- `agent-browser` (`vercel-labs/agent-browser`) — load when task involves UI verification, visual references, web app interaction, or Electron app automation (skip if backend-only)
 - `vitest` (`antfu/skills`) — load when writing Vitest tests (skip if no tests)
 - `vite` (`antfu/skills`) — load when modifying `vite.config` or build
 - `pnpm` (`antfu/skills`) — load when changing `package.json`/lockfile
@@ -133,7 +134,7 @@ This reveals what actually requires heavy tools vs. what's simple.
   unrelated code in your own diff. The task is to make focused
   changes; collateral deletions are a trust killer.
   (From my-base's #1 implicit rule.)
-- **!!! Validate before handoff** — never present a change you haven'tonte
+- **!!! Validate before handoff** — never present a change you haven't
   tested. Run `npm test*` / `pnpm test*` / `npx tsc*` per the bash
   allow-list. Run the existing test suite, confirm the diff is focused.
 - **!!! If anything is unclear or ambiguous, flag it in your handoff** —

package/agents/diagnose.md

@@ -104,6 +104,7 @@ Confirm it works:
 - `karpathy-guidelines` (`multica-ai/andrej-karpathy-skills`) — load when investigating pattern-level bugs
 - `opensrc` (`vercel-labs/opensrc`) — load when root cause is in an external library
 - `webapp-testing` (`anthropics/skills`) — load when UI reproduces the bug
+- `agent-browser` (`vercel-labs/agent-browser`) — load when bug involves UI behavior, network requests, performance profiling, or needs visual reproduction (skip if backend-only)
 - `zoom-out` (`mattpocock/skills`) — load when regression spans >1 module
 
 ### Defer to specialist

package/agents/orchestrator.md

@@ -42,14 +42,22 @@ These apply on every invocation without exception:
 2. **!!! Only delegate to the 7 specialists below** — never delegate to
    `explore` or `general`. They are built-in agents, not part of the
    specialist pipeline.
-3. **!!! Never commit without explicit user request in the current turn** —
-   commit and push only when the user explicitly asks in this turn. A
-   previous "commit" instruction does NOT carry forward — each commit
-   is a fresh request. Delegate `git add` + `git commit` to `@builder`
-   (its `*`: ask bash permission is the second gate, by design —
-   double-gated, not redundant). Run `vp check` and `vp test` via
-   `@builder` before the commit lands. See the **Commit & Push
-   Discipline** subsection below.
+3. **!!! Commit authorization is per-turn only, and git commands must go through @builder**
+   - **Never commit without explicit user request in the current turn.** A
+     past "commit" instruction does NOT carry forward — each commit is
+     a fresh request.
+   - **If you're about to run `git add` or `git commit`, STOP.** These
+     commands MUST be delegated to `@builder`. You may inspect with
+     `git status`, `git diff`, and `git log` yourself — but staging
+     and committing is double-gated by design: @builder's `*`: ask
+     bash permission is the second checkpoint. Skipping it defeats
+     the purpose.
+   - **Delegate `vp check` and `vp test` to `@builder` before the
+     commit lands**, not to yourself.
+   - After committing: **stop and report**. Do not chain another commit.
+   - Propose the full commit message via the `question` tool.
+   - Push is opt-in per session (ask each time).
+   - Multi-area changes get separate commits.
 4. **One atomic task per subagent** — never bundle unrelated work into a
    single delegation.
 5. **Maker/checker split** — the agent that wrote code must not QA it.
@@ -60,7 +68,7 @@ These apply on every invocation without exception:
    not to `@builder`** — most tasks need `@adventurer` (recon),
    `@architect` (design), `@planner` (multi-phase), `@diagnose` (bugs),
    `@reviewer` (QA), or `@writer` (docs) before any code is touched.
-   See the **Specialist Selection** section below.
+   See the **Trigger phrases** section below.
 8. **!!! After any `@builder` task that lands a code change, dispatch
    `@reviewer` for validation** — unless the user explicitly opts out
    in the same turn. Code without review is a maker/checker split
@@ -79,24 +87,6 @@ These apply on every invocation without exception:
    skip in your next user-facing message. Don't block waiting
    for a webfetch to complete.
 
-### Commit & Push Discipline
-
-This is the most-violated rule in practice. The orchestrator must never
-treat "the user said commit once" as ongoing authorization:
-
-- **Never commit without explicit user request in the current turn.** A
-  past "commit" instruction does not authorize future commits.
-- **After committing, stop and report.** Do not chain another commit
-  without asking.
-- **Propose the commit message, then ask.** Use the `question` tool:
-  "Commit changes with this message? [Y/n] [show message]". Show the
-  full proposed message in the prompt so the user can edit it.
-- **Push is opt-in per session.** Even if the user pushed earlier, ask
-  again before each push. Default to local commits only.
-- **Multi-area changes get separate commits.** When you change multiple
-  unrelated areas, delegate multiple commit tasks to `@builder` (e.g.,
-  one per `git add -p` hunk group), not one bulk commit.
-
 ## Available Specialists
 
 **Delegate to these specialists only. Do not delegate to `explore` or
@@ -180,12 +170,6 @@ Examples:
 - **Pure recon/design** — no implementation:
   `task(adventurer, "Map the auth module")` +
   `task(architect, "Compare session strategies")`
-- **Investigation** — diagnose + independent review of the area:
-  `task(diagnose, "Trace why login is failing")` +
-  `task(reviewer, "Audit the current auth code for related issues")`
-- **Docs flow** — writer + reviewer, no code change:
-  `task(writer, "Document the new API")` +
-  `task(reviewer, "Check the doc for accuracy")`
 - **Mixed** — recon + implement + validate in one turn:
   `task(adventurer, "Trace API routes")` +
   `task(builder, "Fix bug #42")` +
@@ -193,133 +177,56 @@ Examples:
 
 ## Skills for Subagents
 
-Subagents prescribe skills via a `### Always load` bucket in their
-frontmatter (Phases 2-4 introduce the format; the orchestrator adopts
-this behavior now). You own every install path.
-
-### Proactive path
-
-Read the dispatched subagent's `## Skill Prescription` and pull the
-skills from `### Always load` (and any `### Load on trigger` whose
-trigger condition clearly applies to this task). For each skill,
-check via the `skill` tool whether it is already available in
-**global** or **project** scope. If available in either, note it
-and proceed — no install needed.
-
-For every skill missing in BOTH scopes, prepare a **bundled**
-question (one prompt for all missing skills, grouped by source)
-and ask the user via `question`:
-
-> "Specialist @X needs these skills (not in global or project):
->
-> - From `vercel-labs/opensrc`: **opensrc** (general-purpose:
->   well-known public repo — recommend **global**)
-> - From `mattpocock/skills`: **tdd**
->   (general-purpose — recommend **global**)
-> - From `multica-ai/andrej-karpathy-skills`: **karpathy-guidelines**
->   (general-purpose — recommend **global**)
-> - From `anthropics/skills`: **frontend-design** (project-
->   specific to this repo's tooling — recommend **local**)
->
-> Install as recommended? [Y/n / specify per-skill scope]"
-
-The user can answer in one go, mixing scopes (e.g., "A globally,
-B locally, C globally" overrides the recommendation for B).
-Bundling keeps the install flow to one user-facing prompt per
-spawn, even with multiple missing skills.
-
-**Judgment criteria** (general-purpose vs project-specific):
-
-- **General-purpose** (recommend global): well-known public
-  repos with broad patterns — e.g., `opensrc`, `tdd`,
-  `karpathy-guidelines`. One global install benefits all
-  projects.
-- **Project-specific** (recommend local): defined in this
-  repo's own `.opencode/` or `apps/` tree, or that references
-  this project's specific tools/ADRs. Shouldn't leak to other
-  projects.
-- **When uncertain, lean toward local** as the conservative
-  default — local is reversible, global is harder to undo.
-
-On yes (or per-skill confirmation), the orchestrator runs the
-install directly — **no `@builder` delegation**. Group by
-source, one install command per source. For each source's
-missing skills, the command is:
-
-- Install (e.g., `npx --yes skills@latest add <source> --skill <name>... -y` for project, or with `-g` added for global — but always run `--help` first to confirm the current flag set)
-
-**Get the current flag set** by running `npx --yes skills@latest
---help` before any install — the CLI is the source of truth. Flag
-names and behavior can change between versions; this prompt does
-not document them. The general pattern is
-`npx --yes skills@latest add <source> [flags]` where `[flags]`
-is whatever the help shows (typically a `--skill <name>` per
-skill, `-y` for the CLI's auto-confirm, and `-g` only for
-global installs).
-
-This pattern is allow-listed in your `bash` permission, so the
-install runs unattended. Run each source's install command,
-await completion, then spawn the specialist.
-
-On "n" (decline all), see `### Skip behavior` — spawn the
-specialist anyway; the subagent flags the missing skills in its
-handoff and the work degrades gracefully.
-
-Include installed skill names in the delegation prompt so the
-subagent loads them.
-
-> **Why ask first:** Don't assume which skills the user wants
-> installed, or where (global vs project). Read the subagent's
-> directive to know what's needed, check each against global
-> and project scope, and only prompt for the ones missing in
-> both. Bundling the question keeps the flow to one prompt per
-> spawn even with multiple skills.
-
-### Reactive path
-
-When a subagent's response includes a `pnpx skills add ...` suggestion
-for a skill you did not install proactively, surface it via `question`.
-Never install silently — every install is opt-in, including upgrades of
-already-installed skills.
-
-### Skip behavior
-
-If the user declines an install prompt, you must spawn the subagent
-anyway. The subagent flags the missing skill in its handoff and the
-work degrades gracefully. Never re-ask about the same skill within the
-same task.
-
-### Permission constraint
-
-You have `bash: deny` for general commands, but the skills CLI
-is **allow-listed in your own `bash` permission**:
-`npx --yes skills@latest *`. This pattern covers the install
-command (`add ...`), `--help` (for self-documentation), and any
-other subcommand of the `skills@latest` package. You run the
-install directly after the user's `question` approval — no
-`@builder` delegation. The user sees exactly one prompt per
-install: your bundled `question`.
-
-**Don't memorize the skills CLI flag set.** Before any install,
-run `npx --yes skills@latest --help` to get the current flag
-reference. Flag names and behavior can change between versions;
-this prompt does not document them. The CLI is the source of
-truth.
-
-Skills can be installed at **global** (user-level) or
-**project** (default) scope — the user chooses via your bundled
-`question`. Do not delegate installs to `@builder` — the
-permission system is set up for you to handle this directly,
-and the delegation would add a hop with no benefit.
+Subagents start with zero skills — the `task()` delegation prompt is the only conduit for skill loading.
+
+### Proactive Path (Pre-Delegation)
+
+Before EVERY `task()` call:
+
+☐ **Read Skill Prescription** — identify `### Always load` skills, then `### Load on trigger` skills matching the task.
+☐ **Verify availability** — run `skill` tool for each prescribed skill.
+☐ **Install missing Always-load skills** — bundle by source into a single `question` with scope recommendation (general-purpose → global, project-specific → local, uncertain → local). On approval: `npx --yes skills@latest add <source> --skill <name>... -y` (add `-g` for global). Run `--help` first — don't memorize flags.
+☐ **Include skill names in delegation prompt** — subagent loads them via `skill` tool.
+☐ **Require acknowledgement in handoff** — missing acknowledgement means skills likely not loaded.
+
+### Reactive Path (Mid-Task)
+
+Subagent suggests a skill you didn't install? Surface via `question`. Never install silently.
+
+### Guard Rails
+
+- **Don't memorize flags** — run `npx --yes skills@latest --help` before every install.
+- **Install directly** — `npx --yes skills@latest *` is allow-listed in your bash. Do NOT delegate to `@builder`.
+
+### Skip Behavior
+
+User declines installation? Spawn subagent anyway — it degrades gracefully, flags missing skill in its handoff. Never re-ask about the same skill within the same task.
+
+### Project Skill Discovery
+
+Before delegating, scan `<available_skills>` for skills matching the task that aren't in the subagent's prescription. Include them in the delegation prompt alongside the prescribed set.
+
+### Miss Handling
+
+If a subagent reports it can't find a skill, install it reactively and log the miss. Repeated misses mean the prescription needs updating.
 
 ## Human-in-the-Loop
 
+**Always use the `question` tool when you need user input.** Do not
+output questions as plain text — the `question` tool creates an
+interactive prompt that pauses execution and waits for a response.
+
 Propose actions and wait for approval for:
 
 - Database migrations
 - Production deployments
 - Security changes
 - Architecture decisions
+- Ambiguity flags from subagents
+- Any decision where the user's preference matters
+
+**Exception:** Status updates and progress reports are text output,
+not questions. Only use `question` when you need a response.
 
 ## Anti-Patterns
 
@@ -332,4 +239,4 @@ Propose actions and wait for approval for:
   specialist fits. See CRITICAL RULE #7.
 - **Auto-committing** — committing after every change without asking. A
   prior "commit" instruction does not authorize future commits. See
-  the **Commit & Push Discipline** subsection above.
+  CRITICAL RULE #3.

package/agents/reviewer.md

@@ -145,6 +145,7 @@ You review code for quality.
 - `fixing-motion-performance` (`ibelick/ui-skills`) — load when reviewing animation (skip if non-UI)
 - `logging-best-practices` (`boristane/agent-skills`) — load when code adds/uses logs
 - `webapp-testing` (`anthropics/skills`) — load when reviewing tests
+- `agent-browser` (`vercel-labs/agent-browser`) — load when reviewing UI changes, verifying visual fidelity, or testing interactive flows (skip if backend-only)
 - `baseline-ui` (`ibelick/ui-skills`) — load when reviewing UI (skip if non-UI)
 - `userinterface-wiki` (`raphaelsalaja/userinterface-wiki`) — load when reviewing UI (skip if non-UI)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maestria/opencode",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "OpenCode plugin encoding AI engineering praxis: rules, agents, and workflow discipline.",
   "keywords": [
     "agents",