@markjaquith/agency 2.39.1 → 2.39.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markjaquith/agency",
-  "version": "2.39.1",
+  "version": "2.39.2",
   "description": "Manage agentic work across repositories with durable workbases",
   "keywords": [
     "agents",

package/src/cli.test.ts

@@ -1019,7 +1019,13 @@ status: open
 				const contract = JSON.parse(printed.stdout)
 				expect(contract.cwd).toBe(launch.cwd)
 				expect(contract.environment.OPENCODE_CONFIG).toBeUndefined()
-				expect(contract.environment.OPENCODE_CONFIG_CONTENT).toBeUndefined()
+				expect(
+					JSON.parse(contract.environment.OPENCODE_CONFIG_CONTENT),
+				).toEqual({
+					permission: {
+						external_directory: { [join(workbaseRoot, "*")]: "allow" },
+					},
+				})
 				const environment = {
 					...process.env,
 					...contract.environment,

package/src/commands/work.test.ts

@@ -45,6 +45,9 @@ const multiPhaseWorkspace: ExecutionWorkspace = {
 }
 
 const taskDirectory = "/workbase/tasks/example"
+const workbasePermission = JSON.stringify({
+	permission: { external_directory: { "/workbase/*": "allow" } },
+})
 
 interface HarnessOptions {
 	readonly workspace?: ExecutionWorkspace
@@ -487,9 +490,9 @@ describe("work command", () => {
 			cwd: "/workbase/epics/delivery",
 		})
 		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG).toBeUndefined()
-		expect(
-			harness.launchEnvironments[0]?.OPENCODE_CONFIG_CONTENT,
-		).toBeUndefined()
+		expect(harness.launchEnvironments[0]?.OPENCODE_CONFIG_CONTENT).toBe(
+			workbasePermission,
+		)
 	})
 
 	test("resolves an existing positional path before treating it as a task ID", async () => {
@@ -915,7 +918,7 @@ describe("work command", () => {
 		expect(harness.taskStatuses.example).toBe("done")
 	})
 
-	test("does not inject runtime OpenCode configuration", async () => {
+	test("grants managed OpenCode launches absolute workbase access", async () => {
 		const harness = createHarness()
 		const output = await captureLogs(() =>
 			harness.run({ taskId: "example", opencode: true, printCommand: true }),
@@ -923,7 +926,7 @@ describe("work command", () => {
 		const printed = JSON.parse(output.join("\n"))
 
 		expect(printed.environment.OPENCODE_CONFIG).toBeUndefined()
-		expect(printed.environment.OPENCODE_CONFIG_CONTENT).toBeUndefined()
+		expect(printed.environment.OPENCODE_CONFIG_CONTENT).toBe(workbasePermission)
 	})
 
 	test("does not override customized OpenCode access policy", async () => {

package/src/commands/work.ts

@@ -122,7 +122,10 @@ export const work = (
 		const inputAllowed = options.inputAllowed ?? true
 		const root = yield* resolveWorkbase(startPath, pickBase, inputAllowed)
 		if (!root) return
-		yield* integrations.sync(root)
+		const integration = yield* integrations.sync(root)
+		const managedOpencode = integration.files.some(
+			(file) => file.name === "opencode" && file.state === "managed",
+		)
 		const { config } = yield* workbase.loadConfig(root)
 
 		let target: WorkTarget | null = null
@@ -331,6 +334,13 @@ export const work = (
 			...resolved.environment,
 			...runnerEnvironment(runner, variables),
 		}
+		if (runner === "opencode" && managedOpencode) {
+			environment.OPENCODE_CONFIG_CONTENT = JSON.stringify({
+				permission: {
+					external_directory: { [join(root, "*")]: "allow" },
+				},
+			})
+		}
 		if (options.printCommand) {
 			log(
 				JSON.stringify(