@opencode_weave/weave 0.5.1 → 0.5.2

package/README.md

@@ -21,9 +21,8 @@ Weave is a lean OpenCode plugin with multi-agent orchestration. It provides a co
   - [Quick Tasks (No Plan Needed)](#quick-tasks-no-plan-needed)
 - [Installation](#installation)
   - [Prerequisites](#prerequisites)
-  - [Step 1: Install](#step-1-install)
-  - [Step 2: Register in opencode.json](#step-2-register-in-opencodejson)
-  - [Step 3: Restart OpenCode](#step-3-restart-opencode)
+  - [Step 1: Add to opencode.json](#step-1-add-to-opencodejson)
+  - [Step 2: Restart OpenCode](#step-2-restart-opencode)
   - [Troubleshooting](#troubleshooting)
 - [Uninstalling](#uninstalling)
 - [Configuration](#configuration)
@@ -149,17 +148,8 @@ This package is published on [npm](https://www.npmjs.com/package/@opencode_weave
 ### Prerequisites
 
 - [OpenCode](https://opencode.ai)
-- Bun or Node.js
 
-### Step 1: Install
-
-```bash
-bun add @opencode_weave/weave
-# or
-npm install @opencode_weave/weave
-```
-
-### Step 2: Register in opencode.json
+### Step 1: Add to opencode.json
 
 Add the plugin to your `opencode.json` file:
 
@@ -169,9 +159,9 @@ Add the plugin to your `opencode.json` file:
 }
 ```
 
-### Step 3: Restart OpenCode
+### Step 2: Restart OpenCode
 
-The plugin loads automatically upon restart and works with zero configuration out of the box.
+OpenCode automatically installs npm plugins at startup — no manual `bun add` or `npm install` required. The plugin loads automatically upon restart and works with zero configuration out of the box.
 
 ### Troubleshooting
 
@@ -194,15 +184,7 @@ Delete the `@opencode_weave/weave` entry from the `plugin` array in your `openco
 }
 ```
 
-### Step 2: Uninstall the package
-
-```bash
-bun remove @opencode_weave/weave
-# or
-npm uninstall @opencode_weave/weave
-```
-
-### Step 3: Clean up project artifacts (optional)
+### Step 2: Clean up project artifacts (optional)
 
 Weave may have created plan and state files during usage. Remove them if no longer needed:
 
@@ -216,7 +198,7 @@ You can also remove any project-level configuration if present:
 rm -f .opencode/weave-opencode.jsonc .opencode/weave-opencode.json
 ```
 
-### Step 4: Clean up user-level configuration (optional)
+### Step 3: Clean up user-level configuration (optional)
 
 If you no longer use Weave in any project, remove the global configuration:
 

package/dist/index.js

@@ -525,7 +525,7 @@ FORMAT RULES:
 - Use /start-work to hand off to Tapestry for todo-list driven execution of multi-step plans
 - Use shuttle for category-specific specialized work
 - Use Weft for reviewing completed work or validating plans before execution
-- MUST use Warp for security audits when changes touch auth, crypto, certificates, tokens, signatures, or input validation — not optional
+  - MUST use Warp for security audits when changes touch auth, crypto, certificates, tokens, signatures, input validation, secrets, passwords, sessions, CORS, CSP, .env files, or OAuth/OIDC/SAML flows — not optional. When in doubt, invoke Warp — false positives (fast APPROVE) are cheap.
 - Delegate aggressively to keep your context lean
 </Delegation>
 
@@ -573,6 +573,15 @@ For complex tasks that benefit from structured planning before execution:
    - /start-work loads the plan, creates work state at \`.weave/state.json\`, and switches to Tapestry
    - Tapestry reads the plan and works through tasks, marking checkboxes as it goes
 4. RESUME: If work was interrupted, \`/start-work\` resumes from the last unchecked task
+5. POST-EXECUTION REVIEW (MANDATORY — NO SKIP CONDITIONS):
+   After Tapestry reports all tasks complete, you MUST run this gate before reporting success to the user:
+   a. Run \`git diff --stat\` to identify all changed files
+   b. Delegate to Weft (quality review) AND Warp (security audit) in parallel
+   c. Warp self-triages: if no security-relevant changes, it fast-exits with APPROVE — so always invoke it
+   d. If Weft or Warp REJECT → address blocking issues, then re-run the rejecting reviewer
+   e. Only report success to the user after BOTH Weft and Warp APPROVE
+   - This step has NO skip conditions. Not for small changes, not for user request, not for time pressure.
+   - Skipping this step is a workflow violation.
 
 When to use this workflow vs. direct execution:
 - USE plan workflow: Large features, multi-file refactors, anything with 5+ steps or architectural decisions
@@ -580,19 +589,26 @@ When to use this workflow vs. direct execution:
 </PlanWorkflow>
 
 <ReviewWorkflow>
-After significant implementation work completes:
+Two review modes — different rules for each:
+
+**Post-Plan-Execution Review (after PlanWorkflow Step 5):**
+- ALWAYS mandatory. No skip conditions. See PlanWorkflow Step 5 for the full protocol.
+- ALWAYS delegate to BOTH Weft (quality) AND Warp (security) in parallel
+- Warp self-triages: fast-exits with APPROVE if no security-relevant changes detected
+- Both must APPROVE before reporting success to the user
+
+**Ad-Hoc Review (non-plan work):**
 - Delegate to Weft to review the changes
 - Weft is read-only and approval-biased — it rejects only for real problems
 - If Weft approves: proceed confidently
 - If Weft rejects: address the specific blocking issues, then re-review
 
-When to invoke Weft:
-- After completing a multi-step plan
+When to invoke ad-hoc Weft:
 - After any task that touches 3+ files
 - Before shipping to the user when quality matters
 - When you're unsure if work meets acceptance criteria
 
-When to skip Weft:
+When to skip ad-hoc Weft:
 - Single-file trivial changes
 - User explicitly says "skip review"
 - Simple question-answering (no code changes)
@@ -688,7 +704,8 @@ When activated by /start-work with a plan file:
    d. Mark complete: use Edit tool to change \`- [ ]\` to \`- [x]\` in the plan file
    e. Report: "Completed task N/M: [title]"
 4. CONTINUE to the next unchecked task
-5. When ALL checkboxes are checked, report final summary
+5. When ALL checkboxes are checked, report final summary and include:
+   "All tasks complete. **Post-execution review required** — Loom must run Weft and Warp before reporting success."
 
 NEVER stop mid-plan unless explicitly told to or completely blocked.
 </PlanExecution>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencode_weave/weave",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Weave — lean OpenCode plugin with multi-agent orchestration",
   "author": "Weave",
   "license": "MIT",