@markjaquith/agency 2.39.0 → 2.39.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markjaquith/agency",
-  "version": "2.39.0",
+  "version": "2.39.2",
   "description": "Manage agentic work across repositories with durable workbases",
   "keywords": [
     "agents",
@@ -59,6 +59,7 @@
   },
   "scripts": {
     "test": "find src \\( -name '*.test.ts' -o -name '*.test.tsx' \\) -print0 | xargs -0 -n 1 -P 4 bun test",
+    "test:opencode": "AGENCY_TEST_OPENCODE=1 bun test src/cli.test.ts --test-name-pattern 'provides effective whole-workbase OpenCode access'",
     "format": "oxfmt",
     "format:check": "oxfmt --check",
     "knip": "knip --production",

package/src/cli.test.ts

@@ -416,7 +416,7 @@ describe("CLI", () => {
 	})
 
 	test("routes command help and global options on either side of commands", async () => {
-		for (const [command, usage] of [
+		const commands = [
 			["init", "Usage: agency init"],
 			["workbase", "Usage: agency workbase"],
 			["integration", "Usage: agency integration"],
@@ -433,11 +433,19 @@ describe("CLI", () => {
 			["context", "Usage: agency context"],
 			["graph", "Usage: agency graph"],
 			["next", "Usage: agency next"],
-		] as const) {
-			const result = await runCli([command, "--help"])
-			expect(result.exitCode).toBe(0)
-			expect(result.stdout).toContain(usage)
-			expect(result.stderr).toBe("")
+		] as const
+		for (let offset = 0; offset < commands.length; offset += 4) {
+			const results = await Promise.all(
+				commands.slice(offset, offset + 4).map(async ([command, usage]) => ({
+					usage,
+					result: await runCli([command, "--help"]),
+				})),
+			)
+			for (const { result, usage } of results) {
+				expect(result.exitCode).toBe(0)
+				expect(result.stdout).toContain(usage)
+				expect(result.stderr).toBe("")
+			}
 		}
 
 		const helpBefore = await runCli(["--help", "task"])
@@ -836,7 +844,9 @@ status: open
 		).toBe("example\n")
 	})
 
-	test.skipIf(Bun.which("opencode") === null)(
+	test.skipIf(
+		Bun.which("opencode") === null || process.env.AGENCY_TEST_OPENCODE !== "1",
+	)(
 		"provides effective whole-workbase OpenCode access from every launch topology",
 		async () => {
 			const parent = await createTempDir()
@@ -1009,7 +1019,13 @@ status: open
 				const contract = JSON.parse(printed.stdout)
 				expect(contract.cwd).toBe(launch.cwd)
 				expect(contract.environment.OPENCODE_CONFIG).toBeUndefined()
-				expect(contract.environment.OPENCODE_CONFIG_CONTENT).toBeUndefined()
+				expect(
+					JSON.parse(contract.environment.OPENCODE_CONFIG_CONTENT),
+				).toEqual({
+					permission: {
+						external_directory: { [join(workbaseRoot, "*")]: "allow" },
+					},
+				})
 				const environment = {
 					...process.env,
 					...contract.environment,

package/src/commands/work.test.ts

@@ -45,6 +45,9 @@ const multiPhaseWorkspace: ExecutionWorkspace = {
 }
 
 const taskDirectory = "/workbase/tasks/example"
+const workbasePermission = JSON.stringify({
+	permission: { external_directory: { "/workbase/*": "allow" } },
+})
 
 interface HarnessOptions {
 	readonly workspace?: ExecutionWorkspace
@@ -487,9 +490,9 @@ describe("work command", () => {
 			cwd: "/workbase/epics/delivery",
 		})
 		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBeUndefined()
-		expect(
-			harness.launchEnvironments[0]?.OPENCODE_CONFIG_CONTENT,
-		).toBeUndefined()
+		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG_CONTENT).toBe(
+			workbasePermission,
+		)
 	})
 
 	test("resolves an existing positional path before treating it as a task ID", async () => {
@@ -915,7 +918,7 @@ describe("work command", () => {
 		expect(harness.taskStatuses.example).toBe("done")
 	})
 
-	test("does not inject runtime OpenCode configuration", async () => {
+	test("grants managed OpenCode launches absolute workbase access", async () => {
 		const harness = createHarness()
 		const output = await captureLogs(() =>
 			harness.run({ taskId: "example", opencode: true, printCommand: true }),
@@ -923,7 +926,7 @@ describe("work command", () => {
 		const printed = JSON.parse(output.join("\n"))
 
 		expect(printed.environment.OPENCODE_CONFIG).toBeUndefined()
-		expect(printed.environment.OPENCODE_CONFIG_CONTENT).toBeUndefined()
+		expect(printed.environment.OPENCODE_CONFIG_CONTENT).toBe(workbasePermission)
 	})
 
 	test("does not override customized OpenCode access policy", async () => {

package/src/commands/work.ts

@@ -122,7 +122,10 @@ export const work = (
 		const inputAllowed = options.inputAllowed ?? true
 		const root = yield* resolveWorkbase(startPath, pickBase, inputAllowed)
 		if (!root) return
-		yield* integrations.sync(root)
+		const integration = yield* integrations.sync(root)
+		const managedOpencode = integration.files.some(
+			(file) => file.name === "opencode" && file.state === "managed",
+		)
 		const { config } = yield* workbase.loadConfig(root)
 
 		let target: WorkTarget | null = null
@@ -331,6 +334,13 @@ export const work = (
 			...resolved.environment,
 			...runnerEnvironment(runner, variables),
 		}
+		if (runner === "opencode" && managedOpencode) {
+			environment.OPENCODE_CONFIG_CONTENT = JSON.stringify({
+				permission: {
+					external_directory: { [join(root, "*")]: "allow" },
+				},
+			})
+		}
 		if (options.printCommand) {
 			log(
 				JSON.stringify(