@markjaquith/agency 2.37.0 → 2.37.1

package/README.md

@@ -92,13 +92,9 @@ preserved as user-owned content.
 
 The OpenCode config loads Agency's hidden instructions in addition to any
 user-owned root `AGENTS.md` and advertises the complete workbase as one portable
-relative reference. `agency work` sets `OPENCODE_CONFIG` to the managed file and
-injects runtime-only absolute rules that allow external access across the
-workbase while denying edits outside the execution unit's writable checkout.
-This makes the config effective from nested task and phase Git checkouts without
-persisting a machine-specific path or granting access outside the workbase. Bash
-and Agency operations must still follow the write authority reported by
-`agency context`.
+reference. OpenCode discovers that config from task and epic launch directories.
+Agents receive whole-workbase visibility from that reference. Bash and Agency
+operations must still follow the write authority reported by `agency context`.
 
 Repository aliases and canonical fetch remotes are declared in tracked
 `agency.json`; local bare clones and symlinks remain ignored under
@@ -226,10 +222,8 @@ Every runner receives the same `AGENCY_RUNNER`, `AGENCY_CLAIMANT`,
 environment is added without overriding these normalized values.
 `AGENCY_CLAIM_REVISION` is empty for local `agency work` launches.
 `AGENCY_PROMPT` is empty unless `--auto` is set.
-The `opencode` runner additionally receives `OPENCODE_CONFIG` for the workbase's
-managed integration and `OPENCODE_CONFIG_CONTENT` with runtime-only,
-workbase-scoped access and edit rules. These values keep the Git-synced config
-portable while providing whole-workbase read access at every launch location.
+The `opencode` runner discovers the managed project config from its task or epic
+working directory; Agency does not inject OpenCode-specific configuration.
 `AGENCY_CLAIM_REVISION` is empty for local `agency work` launches.
 `AGENCY_PROMPT` is empty unless `--auto` is set.
 `--print-command` prints the exact cwd and argv plus non-secret environment keys

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markjaquith/agency",
-  "version": "2.37.0",
+  "version": "2.37.1",
   "description": "Manage agentic work across repositories with durable workbases",
   "keywords": [
     "agents",

package/src/cli.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, afterEach, describe, expect, test } from "bun:test"
 import { access, mkdir, realpath } from "node:fs/promises"
-import { join, relative } from "node:path"
+import { join } from "node:path"
 import errorFixture from "../fixtures/protocol/error.json"
 import successFixture from "../fixtures/protocol/success.json"
 import { cleanupTempDir, createTempDir } from "./test-utils"
@@ -862,6 +862,9 @@ status: open
 			await runGit(["-C", source, "remote", "add", "origin", daemon.remote])
 
 			parseJson(await runCli(["init", root, "--json"], parent))
+			expect(
+				Bun.spawnSync(["git", "init", "--initial-branch=main", root]).exitCode,
+			).toBe(0)
 			const agencyConfigPath = join(root, "agency.json")
 			const agencyConfig = JSON.parse(await Bun.file(agencyConfigPath).text())
 			await Bun.write(
@@ -942,10 +945,8 @@ status: open
 				),
 			)
 
-			const taskWorkspace = parseJson(
-				await runCli(["work", "prepare", "example", "--json"], root),
-			)
-			const phaseWorkspace = parseJson(
+			parseJson(await runCli(["work", "prepare", "example", "--json"], root))
+			parseJson(
 				await runCli(
 					[
 						"work",
@@ -984,22 +985,18 @@ status: open
 				{
 					args: ["--task", "example"],
 					cwd: join(workbaseRoot, "tasks/example"),
-					writable: taskWorkspace.writablePath,
 				},
 				{
 					args: ["--task", "pipeline", "--phase", "build"],
 					cwd: join(workbaseRoot, "tasks/pipeline"),
-					writable: phaseWorkspace.writablePath,
 				},
 				{
 					args: ["--epic", "delivery"],
 					cwd: join(workbaseRoot, "epics/delivery"),
-					writable: null,
 				},
 				{
 					args: ["--task", "pipeline"],
 					cwd: join(workbaseRoot, "tasks/pipeline"),
-					writable: null,
 				},
 			]
 			for (const launch of launches) {
@@ -1011,9 +1008,8 @@ status: open
 				expect(printed.stderr).toBe("")
 				const contract = JSON.parse(printed.stdout)
 				expect(contract.cwd).toBe(launch.cwd)
-				expect(contract.environment.OPENCODE_CONFIG).toBe(
-					join(workbaseRoot, ".opencode/opencode.jsonc"),
-				)
+				expect(contract.environment.OPENCODE_CONFIG).toBeUndefined()
+				expect(contract.environment.OPENCODE_CONFIG_CONTENT).toBeUndefined()
 				const environment = {
 					...process.env,
 					...contract.environment,
@@ -1030,35 +1026,24 @@ status: open
 					expect.arrayContaining([
 						expect.objectContaining({
 							permission: "external_directory",
-							pattern: join(workbaseRoot, "**"),
+							pattern: join(workbaseRoot, "*"),
 							action: "allow",
 						}),
 					]),
 				)
-				expect(agent.permission).toEqual(
-					expect.arrayContaining([
-						expect.objectContaining({
-							permission: "edit",
-							pattern: "*",
-							action: "deny",
-						}),
-					]),
-				)
-				if (launch.writable) {
-					expect(agent.permission).toEqual(
-						expect.arrayContaining(
-							[workbaseRoot, launch.cwd].map((base) =>
-								expect.objectContaining({
-									permission: "edit",
-									pattern: join(relative(base, launch.writable!), "**"),
-									action: "allow",
-								}),
-							),
-						),
-					)
-				}
-
 				if (launch === launches[0]) {
+					const configProbe = Bun.spawnSync(["opencode", "debug", "config"], {
+						cwd: contract.cwd,
+						env: environment,
+					})
+					expect(configProbe.exitCode).toBe(0)
+					expect(JSON.parse(configProbe.stdout.toString()).references).toEqual({
+						workbase: {
+							path: "..",
+							description:
+								"Complete Agency workbase context; write authority still comes only from agency context",
+						},
+					})
 					for (const document of documents) {
 						const read = Bun.spawnSync(
 							[
@@ -1080,6 +1065,55 @@ status: open
 				}
 			}
 
+			const directEnvironment: Record<string, string | undefined> = {
+				...process.env,
+				XDG_CONFIG_HOME: isolatedConfigHome,
+				OPENCODE_DISABLE_EXTERNAL_SKILLS: "1",
+			}
+			delete directEnvironment.OPENCODE_CONFIG
+			delete directEnvironment.OPENCODE_CONFIG_CONTENT
+			delete directEnvironment.AGENCY_WORKBASE
+			for (const cwd of [
+				join(workbaseRoot, "tasks/example"),
+				join(workbaseRoot, "tasks/pipeline"),
+				join(workbaseRoot, "epics/delivery"),
+			]) {
+				const probe = Bun.spawnSync(["opencode", "debug", "agent", "build"], {
+					cwd,
+					env: directEnvironment,
+				})
+				expect(probe.exitCode).toBe(0)
+				const agent = JSON.parse(probe.stdout.toString())
+				expect(agent.permission).toEqual(
+					expect.arrayContaining([
+						expect.objectContaining({
+							permission: "external_directory",
+							pattern: join(workbaseRoot, "*"),
+							action: "allow",
+						}),
+					]),
+				)
+				for (const document of documents) {
+					const read = Bun.spawnSync(
+						[
+							"opencode",
+							"debug",
+							"agent",
+							"build",
+							"--tool",
+							"read",
+							"--params",
+							JSON.stringify({ filePath: document }),
+						],
+						{ cwd, env: directEnvironment },
+					)
+					expect(read.exitCode).toBe(0)
+					expect(JSON.parse(read.stdout.toString()).result.output).toContain(
+						`<path>${document}</path>`,
+					)
+				}
+			}
+
 			parseJson(
 				await runCli(["task", "status", "example", "done", "--json"], root),
 			)
@@ -1135,7 +1169,7 @@ status: open
 				graph.nodes.find((node: any) => node.id === "task:pipeline").status,
 			).toBe("working")
 		},
-		30_000,
+		90_000,
 	)
 
 	test("envelopes help and version output in machine mode", async () => {

package/src/commands/work.test.ts

@@ -486,23 +486,10 @@ describe("work command", () => {
 			],
 			cwd: "/workbase/epics/delivery",
 		})
-		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBe(
-			"/workbase/.opencode/opencode.jsonc",
-		)
+		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBeUndefined()
 		expect(
-			JSON.parse(harness.launchEnvironments[0]!.OPENCODE_CONFIG_CONTENT!),
-		).toEqual({
-			permission: {
-				external_directory: { "/workbase/**": "allow" },
-				edit: { "*": "deny" },
-			},
-			agent: {
-				build: { permission: { edit: { "*": "deny" } } },
-				plan: { permission: { edit: { "*": "deny" } } },
-				general: { permission: { edit: { "*": "deny" } } },
-				explore: { permission: { edit: { "*": "deny" } } },
-			},
-		})
+			harness.launchEnvironments[0]?.OPENCODE_CONFIG_CONTENT,
+		).toBeUndefined()
 	})
 
 	test("resolves an existing positional path before treating it as a task ID", async () => {
@@ -553,9 +540,7 @@ describe("work command", () => {
 			],
 			cwd: "/workbase/tasks/delivery",
 		})
-		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBe(
-			"/workbase/.opencode/opencode.jsonc",
-		)
+		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBeUndefined()
 	})
 
 	test("infers a phase from a nested checkout directory", async () => {
@@ -585,9 +570,7 @@ describe("work command", () => {
 		expect(harness.statusUpdates).toEqual([
 			"phase:example:implementation:working",
 		])
-		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBe(
-			"/workbase/.opencode/opencode.jsonc",
-		)
+		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBeUndefined()
 	})
 
 	test("infers a single-phase task from a nested checkout directory", async () => {
@@ -601,9 +584,7 @@ describe("work command", () => {
 
 		expect(harness.events[0]).toBe("materialize")
 		expect(harness.launches[0]?.cwd).toBe(taskDirectory)
-		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBe(
-			"/workbase/.opencode/opencode.jsonc",
-		)
+		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBeUndefined()
 	})
 
 	test("selects a target when no directory is provided", async () => {
@@ -781,9 +762,7 @@ describe("work command", () => {
 		])
 		expect(harness.launchEnvironments[0]?.AGENCY_PROMPT).toBe("")
 		expect(harness.statusUpdates).toEqual(["task:example:working"])
-		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBe(
-			"/workbase/.opencode/opencode.jsonc",
-		)
+		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBeUndefined()
 		expect(harness.progressUpdates).toEqual([
 			"start:Preparing workspace...",
 			"succeed:Workspace ready",
@@ -936,33 +915,15 @@ describe("work command", () => {
 		expect(harness.taskStatuses.example).toBe("done")
 	})
 
-	test("prints the runtime OpenCode integration config", async () => {
+	test("does not inject runtime OpenCode configuration", async () => {
 		const harness = createHarness()
 		const output = await captureLogs(() =>
 			harness.run({ taskId: "example", opencode: true, printCommand: true }),
 		)
 		const printed = JSON.parse(output.join("\n"))
 
-		expect(printed.environment.OPENCODE_CONFIG).toBe(
-			"/workbase/.opencode/opencode.jsonc",
-		)
-		const edit = {
-			"*": "deny",
-			"tasks/example/code/agency/**": "allow",
-			"code/agency/**": "allow",
-		}
-		expect(JSON.parse(printed.environment.OPENCODE_CONFIG_CONTENT)).toEqual({
-			permission: {
-				external_directory: { "/workbase/**": "allow" },
-				edit,
-			},
-			agent: {
-				build: { permission: { edit } },
-				plan: { permission: { edit } },
-				general: { permission: { edit } },
-				explore: { permission: { edit } },
-			},
-		})
+		expect(printed.environment.OPENCODE_CONFIG).toBeUndefined()
+		expect(printed.environment.OPENCODE_CONFIG_CONTENT).toBeUndefined()
 	})
 
 	test("does not override customized OpenCode access policy", async () => {

package/src/commands/work.ts

@@ -122,10 +122,7 @@ export const work = (
 		const inputAllowed = options.inputAllowed ?? true
 		const root = yield* resolveWorkbase(startPath, pickBase, inputAllowed)
 		if (!root) return
-		const integration = yield* integrations.sync(root)
-		const managedOpencode = integration.files.some(
-			(file) => file.name === "opencode" && file.state === "managed",
-		)
+		yield* integrations.sync(root)
 		const { config } = yield* workbase.loadConfig(root)
 
 		let target: WorkTarget | null = null
@@ -239,7 +236,6 @@ export const work = (
 				(target.status !== undefined && target.status !== "open"))
 		let prompt: string
 		let launchPath: string
-		let writablePath: string | undefined
 		if (target.kind === "epic") {
 			prompt = `Work on the epic. Read ${target.path}.`
 			launchPath = dirname(target.path)
@@ -265,7 +261,6 @@ export const work = (
 				? `${action} the task. Read ${workspace.taskPath} and ${workspace.phasePath}.`
 				: `${action} the task. Read ${workspace.taskPath}.`
 			launchPath = dirname(workspace.taskPath)
-			writablePath = workspace.writablePath
 		}
 
 		const explicitlyRequested = Boolean(
@@ -336,35 +331,6 @@ export const work = (
 			...resolved.environment,
 			...runnerEnvironment(runner, variables),
 		}
-		if (runner === "opencode" && managedOpencode) {
-			environment.OPENCODE_CONFIG = join(root, ".opencode", "opencode.jsonc")
-			const execution =
-				target.kind === "phase" ||
-				(target.kind === "task" && !target.multiPhase)
-			const edit = execution
-				? {
-						"*": "deny" as const,
-						...Object.fromEntries(
-							[root, launchPath].map((base) => [
-								join(relative(base, writablePath!), "**").split(sep).join("/"),
-								"allow" as const,
-							]),
-						),
-					}
-				: { "*": "deny" as const }
-			environment.OPENCODE_CONFIG_CONTENT = JSON.stringify({
-				permission: {
-					external_directory: { [join(root, "**")]: "allow" },
-					edit,
-				},
-				agent: {
-					build: { permission: { edit } },
-					plan: { permission: { edit } },
-					general: { permission: { edit } },
-					explore: { permission: { edit } },
-				},
-			})
-		}
 		if (options.printCommand) {
 			log(
 				JSON.stringify(

package/src/workbase/AGENTS.md

@@ -77,7 +77,6 @@ files, and `agency work` reconciles them before launching an agent.
 
 OpenCode can access the complete workbase tree, but this filesystem permission
 does not expand Agency write authority beyond the checkout reported by
-`agency context`. Agency launches expose the managed OpenCode config file at
-runtime and inject absolute access rules scoped to this workbase. Direct edits
-remain denied outside the writable checkout, and no machine-specific path is
-stored in the Git-synced config.
+`agency context`. OpenCode discovers the managed project config from task and
+epic launch directories. No machine-specific path or runtime permission overlay
+is required; agents must follow the authority reported by `agency context`.