@pennixrv/trellis 0.6.45 → 0.7.0-beta.5

package/dist/templates/opencode/plugins/inject-spec-context.js

@@ -0,0 +1,121 @@
+/* global process */
+/**
+ * Trellis Dynamic Spec Injection Plugin
+ *
+ * OpenCode tool hooks cannot add context to the current model turn. A FULL
+ * spec emission therefore blocks the write once with a model-visible error;
+ * the shared Python engine records the emission, so the model's retry proceeds.
+ */
+
+import { execFileSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+import { debugLog } from "../lib/trellis-context.js";
+
+const PYTHON_CMD = process.platform === "win32" ? "python" : "python3";
+
+function runSpecHook(directory, payload) {
+  const hookPath = join(
+    directory,
+    ".opencode",
+    "hooks",
+    "inject-spec-context.py",
+  );
+  if (!existsSync(hookPath)) return null;
+
+  try {
+    const stdout = execFileSync(PYTHON_CMD, [hookPath], {
+      cwd: directory,
+      encoding: "utf-8",
+      input: JSON.stringify(payload),
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15000,
+    });
+    if (!stdout.trim()) return null;
+    const parsed = JSON.parse(stdout);
+    return parsed?.hookSpecificOutput ?? null;
+  } catch (error) {
+    debugLog(
+      "spec",
+      "Spec hook failed open:",
+      error instanceof Error ? error.message : String(error),
+    );
+    return null;
+  }
+}
+
+function buildToolPayload(directory, input, output) {
+  const tool = input?.tool?.toLowerCase();
+  const args = output?.args;
+  if (!args) return null;
+
+  if (tool === "edit" || tool === "write") {
+    if (typeof args.filePath !== "string" || !args.filePath.trim()) return null;
+    return {
+      hook_event_name: "PreToolUse",
+      session_id: input?.sessionID,
+      cwd: directory,
+      tool_name: tool === "edit" ? "Edit" : "Write",
+      tool_input: { file_path: args.filePath },
+    };
+  }
+
+  if (tool === "apply_patch") {
+    if (typeof args.patchText !== "string" || !args.patchText.trim())
+      return null;
+    return {
+      hook_event_name: "PreToolUse",
+      session_id: input?.sessionID,
+      cwd: directory,
+      tool_name: "apply_patch",
+      tool_input: { command: args.patchText },
+    };
+  }
+
+  return null;
+}
+
+export default async ({ directory }) => ({
+  event: async ({ event }) => {
+    if (
+      process.env.TRELLIS_HOOKS === "0" ||
+      process.env.TRELLIS_DISABLE_HOOKS === "1"
+    ) {
+      return;
+    }
+    if (event?.type !== "session.compacted" || !event?.properties?.sessionID) {
+      return;
+    }
+
+    runSpecHook(directory, {
+      hook_event_name: "SessionStart",
+      session_id: event.properties.sessionID,
+      source: "compact",
+      cwd: directory,
+    });
+  },
+
+  "tool.execute.before": async (input, output) => {
+    if (
+      process.env.TRELLIS_HOOKS === "0" ||
+      process.env.TRELLIS_DISABLE_HOOKS === "1"
+    ) {
+      return;
+    }
+
+    const payload = buildToolPayload(directory, input, output);
+    if (!payload) return;
+
+    const result = runSpecHook(directory, payload);
+    const context = result?.additionalContext;
+    if (result?.permissionDecision !== "deny" || typeof context !== "string") {
+      return;
+    }
+
+    throw new Error(
+      "Trellis loaded governing specs before this tool call. " +
+        "Follow them, then retry the same tool call.\n\n" +
+        context,
+    );
+  },
+});

package/dist/templates/opencode/plugins/inject-workflow-state.js

@@ -1,4 +1,4 @@
-/* global process */
+/* global process, console */
 /**
  * Trellis Workflow State Injection Plugin
  *
@@ -9,7 +9,12 @@
  * `experimental.chat.messages.transform`. Stored history and the TUI
  * are not modified (issue #553). Breadcrumb text is pulled exclusively
  * from the project's workflow.md [workflow-state:STATUS] tag blocks —
- * workflow.md is the single source of truth. There are no fallback
+ * workflow.md is the single source of truth. When the active task's
+ * task.json selects a workflow variant ("workflow": "<id>"), the tag
+ * blocks are read from .trellis/workflows/<id>.md instead (missing
+ * variant file → one stderr warning + fallback through personal/team/global
+ * defaults; see
+ * resolveWorkflowMd). There are no fallback
  * tables in this plugin: when workflow.md is missing or a tag is
  * absent, the breadcrumb degrades to a generic
  * "Refer to workflow.md for current step." line so users see (and fix)
@@ -21,7 +26,7 @@
  *   - task.json malformed or missing status
  */
 
-import { existsSync, readFileSync } from "fs"
+import { existsSync, readFileSync, statSync } from "fs"
 import { join } from "path"
 import {
   MESSAGES_TRANSFORM_HOOK,
@@ -111,17 +116,113 @@ function promptHasSkipKeyword(text, keyword) {
   return pattern.test(text)
 }
 
+// Per-task workflow selection (mirrors the Python resolver in
+// .trellis/scripts/common/workflow_selection.py). Ids are restricted to
+// [A-Za-z0-9_-]+ so a task.json value can never traverse outside
+// .trellis/workflows/.
+const WORKFLOW_ID_RE = /^[A-Za-z0-9_-]+$/
+
+// Map a workflow id to its .trellis/workflows/<id>.md file if valid and
+// present, else "". Shared by every resolution layer. Never throws.
+function libraryVariant(directory, workflowId) {
+  if (!workflowId || !WORKFLOW_ID_RE.test(workflowId)) return ""
+  const variantPath = join(directory, ".trellis", "workflows", `${workflowId}.md`)
+  try {
+    if (statSync(variantPath).isFile()) return variantPath
+  } catch {
+    // ENOENT etc. — missing variant file.
+  }
+  return ""
+}
+
+// Personal override id from the gitignored .developer file (`workflow=<id>`
+// line). "" when absent/unreadable. Never throws.
+function developerWorkflowId(directory) {
+  try {
+    const text = readFileSync(join(directory, ".trellis", ".developer"), "utf-8")
+    for (const line of text.split(/\r?\n/)) {
+      if (line.startsWith("workflow=")) return line.slice("workflow=".length).trim()
+    }
+  } catch {
+    // No .developer / unreadable — no personal override.
+  }
+  return ""
+}
+
+// Team-shared default id from config.yaml's top-level `default_workflow:` key.
+// Commented lines (starting with '#') are naturally excluded by the anchor.
+// "" when unset/unreadable. Never throws.
+const DEFAULT_WORKFLOW_RE = /^default_workflow:\s*(['"]?)([A-Za-z0-9_-]+)\1\s*(?:#.*)?$/m
+function configDefaultWorkflowId(directory) {
+  try {
+    const text = readFileSync(join(directory, ".trellis", "config.yaml"), "utf-8")
+    const m = text.match(DEFAULT_WORKFLOW_RE)
+    if (m) return m[2]
+  } catch {
+    // No config.yaml / unreadable — no team default.
+  }
+  return ""
+}
+
+/**
+ * Resolve which workflow markdown file feeds this turn's breadcrumbs.
+ *
+ * Precedence (identical across all Trellis consumers), highest to lowest —
+ * each layer resolves an id to .trellis/workflows/<id>.md and falls through
+ * when unset, invalid, or naming a missing file:
+ *   1. Per-task pin  — active task's task.json "workflow" (session-bound; a
+ *      bad id / missing file warns once on stderr, then falls through).
+ *   2. Personal      — .developer `workflow=<id>` (gitignored, per-developer).
+ *   3. Team default  — config.yaml `default_workflow` (git-tracked, shared).
+ *   4. Global        — .trellis/workflow.md.
+ * With neither a pin nor the personal/team keys set, this is the global path.
+ * Never throws.
+ */
+function resolveWorkflowMd(ctx, directory, platformInput) {
+  const globalPath = join(directory, ".trellis", "workflow.md")
+
+  // 1. Per-task pin (session-bound explicit choice).
+  let workflowId = ""
+  try {
+    const active = ctx.getActiveTask(platformInput)
+    if (active.taskPath && !active.stale) {
+      const taskDir = ctx.resolveTaskDir(active.taskPath)
+      if (taskDir) {
+        const data = JSON.parse(readFileSync(join(taskDir, "task.json"), "utf-8"))
+        if (data && typeof data.workflow === "string") workflowId = data.workflow
+      }
+    }
+  } catch {
+    // No active task / unreadable task.json — not a selection.
+    workflowId = ""
+  }
+  if (workflowId) {
+    const pinned = libraryVariant(directory, workflowId)
+    if (pinned) return pinned
+    console.error(
+      `Warning: active task selects workflow ${JSON.stringify(workflowId)} but .trellis/workflows/ has no matching file; using default workflow resolution`,
+    )
+  }
+
+  // 2. Personal override, then 3. team default — silent on miss (defaults,
+  // not an explicit per-task choice). 4. Global fallback.
+  const personal = libraryVariant(directory, developerWorkflowId(directory))
+  if (personal) return personal
+  const team = libraryVariant(directory, configDefaultWorkflowId(directory))
+  if (team) return team
+  return globalPath
+}
+
 /**
- * Parse workflow.md for [workflow-state:STATUS] blocks.
+ * Parse the resolved workflow markdown for [workflow-state:STATUS] blocks.
  *
- * Returns {status: body}. workflow.md is the single source of truth —
- * there are no fallback tables here. Missing tags (or a missing /
- * unreadable workflow.md) fall back to a generic line in
+ * Returns {status: body}. The workflow file is the single source of
+ * truth — there are no fallback tables here. Missing tags (or a missing /
+ * unreadable workflow file) fall back to a generic line in
  * buildBreadcrumb so users see the broken state and fix workflow.md
  * rather than the plugin silently masking it.
  */
-function loadBreadcrumbs(directory) {
-  const workflowPath = join(directory, ".trellis", "workflow.md")
+function loadBreadcrumbs(workflowPath) {
   if (!existsSync(workflowPath)) return {}
   let content
   try {
@@ -228,7 +329,7 @@ export default async ({ directory }) => {
             return
           }
 
-          const templates = loadBreadcrumbs(directory)
+          const templates = loadBreadcrumbs(resolveWorkflowMd(ctx, directory, platformInput))
           const task = getActiveTask(ctx, platformInput)
           const breadcrumb = task
             ? buildBreadcrumb(task.id, task.status, templates, task.candidates)

package/dist/templates/pi/extensions/trellis/index.ts.txt

@@ -1,4 +1,10 @@
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import {
+  existsSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import {
   delimiter,
@@ -8,6 +14,7 @@ import {
   relative,
   resolve,
 } from "node:path";
+import { homedir } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { isUtf8 } from "node:buffer";
 
@@ -773,10 +780,11 @@ function truncateUtf8(buf: Buffer, cap: number): Buffer {
     if ((lead & 0xe0) === 0xc0) seqLen = 2;
     else if ((lead & 0xf0) === 0xe0) seqLen = 3;
     else if ((lead & 0xf8) === 0xf0) seqLen = 4;
-    // Drop the lead byte too if its full sequence didn't fit.
-    if (i - 1 + seqLen > cap) i--;
+    // Cut before the lead byte when its full sequence didn't fit;
+    // otherwise the trailing sequence is complete — keep it whole.
+    if (i - 1 + seqLen > cap) return buf.subarray(0, i - 1);
   }
-  return buf.subarray(0, i);
+  return buf.subarray(0, cap);
 }
 
 function stripInlineComment(value: string): string {
@@ -1115,10 +1123,66 @@ function readTaskDir(root: string, key: string | null): string | null {
 }
 
 // ── Workflow State Breadcrumb ─────────────────────────────────────────
+const WORKFLOW_ID_RE = /^[A-Za-z0-9_-]+$/;
+const DEFAULT_WORKFLOW_RE =
+  /^default_workflow:\s*(['"]?)([A-Za-z0-9_-]+)\1\s*(?:#.*)?$/m;
+
+function workflowVariant(root: string, workflowId: string): string {
+  if (!WORKFLOW_ID_RE.test(workflowId)) return "";
+  const path = join(root, ".trellis", "workflows", `${workflowId}.md`);
+  return exists(path) ? path : "";
+}
+
+function developerWorkflowId(root: string): string {
+  for (const line of readText(join(root, ".trellis", ".developer")).split(
+    /\r?\n/,
+  )) {
+    if (line.startsWith("workflow="))
+      return line.slice("workflow=".length).trim();
+  }
+  return "";
+}
+
+function configDefaultWorkflowId(root: string): string {
+  return (
+    readText(join(root, ".trellis", "config.yaml")).match(
+      DEFAULT_WORKFLOW_RE,
+    )?.[2] ?? ""
+  );
+}
+
+/** Mirrors common/workflow_selection.py without spawning another Python
+ * process on every Pi turn. Invalid or missing selections fall through. */
+function resolveWorkflowMd(root: string, key: string | null): string {
+  const taskDir = readTaskDir(root, key);
+  let workflowId = "";
+  if (taskDir) {
+    try {
+      const task = JSON.parse(
+        readText(join(taskDir, "task.json")),
+      ) as JsonObject;
+      workflowId = typeof task.workflow === "string" ? task.workflow : "";
+    } catch {}
+  }
+  if (workflowId) {
+    const pinned = workflowVariant(root, workflowId);
+    if (pinned) return pinned;
+    console.error(
+      `Warning: active task selects workflow ${JSON.stringify(workflowId)} but .trellis/workflows/ has no matching file; using default workflow resolution`,
+    );
+  }
+
+  const personal = workflowVariant(root, developerWorkflowId(root));
+  if (personal) return personal;
+  const team = workflowVariant(root, configDefaultWorkflowId(root));
+  if (team) return team;
+  return join(root, ".trellis", "workflow.md");
+}
+
 const WF_RE =
   /\[workflow-state:([A-Za-z0-9_-]+)\]\s*\n([\s\S]*?)\n\s*\[\/workflow-state:\1\]/g;
 function workflowBreadcrumb(root: string, key: string | null): string {
-  const wf = readText(join(root, ".trellis", "workflow.md"));
+  const wf = readText(resolveWorkflowMd(root, key));
   if (!wf) return "";
   const templates: Record<string, string> = {};
   for (const m of wf.matchAll(WF_RE)) {
@@ -1413,6 +1477,93 @@ function formatPiOutput(stdout: string, stderr: string): string {
   return ft || stdout || stderr;
 }
 
+// ── Permission-forwarding parent session (issue #610) ───────────
+// Headless `pi --mode json` children have no UI. `@gotgenes/pi-permission-system`
+// forwards `ask` to the parent only when the child env names the *serving*
+// parent session and is marked as a subagent. Three layers, all required:
+//   1. PI_SUBAGENT_PARENT_SESSION — out-of-process convention
+//   2. PI_SUBAGENT_CHILD=1 — stops pi-subagents overwriting that parent id
+//      with the child's own session id
+//   3. serving heartbeat id, not stale PI_SESSION_ID (compaction can fork
+//      the live id while the permission extension still listens on the
+//      activation-time id). Drop inherited PI_SESSION_ID so the child
+//      mints its own instead of colliding with the parent.
+let lastLiveSessionId: string | null = null;
+
+function currentSessionId(ctx?: PiExtensionContext): string | null {
+  const viaCtx = callStr(
+    ctx?.sessionManager?.getSessionId,
+    ctx?.sessionManager,
+  );
+  if (viaCtx) {
+    lastLiveSessionId = viaCtx;
+    return viaCtx;
+  }
+  return (
+    lastLiveSessionId ??
+    str(process.env.PI_SESSION_ID) ??
+    str(process.env.PI_SESSIONID)
+  );
+}
+
+function piSessionsRoot(): string {
+  const sessionDir = str(process.env.PI_CODING_AGENT_SESSION_DIR);
+  if (sessionDir) return sessionDir;
+  const agentDir = str(process.env.PI_CODING_AGENT_DIR);
+  if (agentDir) return join(agentDir, "sessions");
+  return join(homedir(), ".pi", "agent", "sessions");
+}
+
+function servingSessionId(): string | null {
+  try {
+    const dir = join(piSessionsRoot(), "permission-forwarding", "serving");
+    let best: { sessionId: string; updatedAt: number } | null = null;
+    for (const name of readdirSync(dir)) {
+      if (!name.endsWith(".json")) continue;
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(readFileSync(join(dir, name), "utf-8"));
+      } catch {
+        continue;
+      }
+      if (!isObj(parsed) || parsed.pid !== process.pid) continue;
+      const sessionId = str(parsed.sessionId);
+      const updatedAt =
+        typeof parsed.updatedAt === "number" && Number.isFinite(parsed.updatedAt)
+          ? parsed.updatedAt
+          : 0;
+      if (!sessionId) continue;
+      if (!best || updatedAt > best.updatedAt) best = { sessionId, updatedAt };
+    }
+    return best?.sessionId ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function parentSessionIdForChild(ctx?: PiExtensionContext): string | null {
+  return servingSessionId() ?? currentSessionId(ctx);
+}
+
+function buildChildEnv(
+  key?: string | null,
+  parentSessionId?: string | null,
+): NodeJS.ProcessEnv {
+  const childEnv: NodeJS.ProcessEnv = {
+    ...process.env,
+    TRELLIS_SUBAGENT_CHILD: "1",
+    // Stops pi-subagents from overwriting PI_SUBAGENT_PARENT_SESSION with the
+    // child's own session id, and lets the permission system treat this process
+    // as a subagent (ParentAuthorizer forwarding) even when no parent id is known.
+    PI_SUBAGENT_CHILD: "1",
+    ...(key ? { TRELLIS_CONTEXT_ID: key } : {}),
+    ...(parentSessionId ? { PI_SUBAGENT_PARENT_SESSION: parentSessionId } : {}),
+  };
+  delete childEnv.PI_SESSION_ID;
+  delete childEnv.PI_SESSIONID;
+  return childEnv;
+}
+
 // ── runPi: subprocess execution + event processing ───────────────────
 function runPi(
   root: string,
@@ -1422,6 +1573,7 @@ function runPi(
   emit: () => void,
   key?: string | null,
   signal?: AbortSignal,
+  parentSessionId?: string | null,
 ): Promise<{ output: string; failed: boolean }> {
   return new Promise((resolve) => {
     if (signal?.aborted) {
@@ -1433,11 +1585,7 @@ function runPi(
       return;
     }
     const inv = resolvePiCli();
-    const childEnv = {
-      ...process.env,
-      TRELLIS_SUBAGENT_CHILD: "1",
-      ...(key ? { TRELLIS_CONTEXT_ID: key } : {}),
-    };
+    const childEnv = buildChildEnv(key, parentSessionId);
     const cli = spawn(inv.command, [...inv.args, ...buildPiArgs(cfg)], {
       cwd: root,
       env: childEnv,
@@ -1538,7 +1686,9 @@ async function runSubagent(
   onUpdate?: (r: PiToolResult) => void,
   inheritedThinking?: string,
   inheritedModel?: string,
+  ctx?: PiExtensionContext,
 ): Promise<{ output: string; details: ProgressDetails; failed: boolean }> {
+  const parentSessionId = parentSessionIdForChild(ctx);
   const agentName = normalizeAgent(input.agent);
   const agentRaw = readText(join(root, ".pi", "agents", `${agentName}.md`));
   const agentCfg = parseAgentFM(agentRaw);
@@ -1606,6 +1756,7 @@ async function runSubagent(
             emit,
             key,
             signal,
+            parentSessionId,
           ),
         ),
       );
@@ -1638,6 +1789,7 @@ async function runSubagent(
           emit,
           key,
           signal,
+          parentSessionId,
         );
         prev = result.output;
         failed = failed || result.failed;
@@ -1657,6 +1809,7 @@ async function runSubagent(
       emit,
       key,
       signal,
+      parentSessionId,
     );
     return finish(result.output, result.failed);
   } catch (e) {
@@ -1875,6 +2028,7 @@ export default function trellisExtension(pi: {
         onUpdate,
         inheritedThinking,
         inheritedModel,
+        ctx,
       );
       return {
         content: [{ type: "text", text: result.output }],

package/dist/templates/shared-hooks/index.d.ts

@@ -11,8 +11,8 @@ export interface HookScript {
     /** Script content — no placeholders, ready to write directly */
     content: string;
 }
-export type SharedHookName = "session-start.py" | "inject-shell-session-context.py" | "inject-workflow-state.py" | "inject-subagent-context.py";
-export type SharedHookPlatform = "claude" | "cursor" | "codex" | "gemini" | "qoder" | "copilot" | "codebuddy" | "droid" | "kiro" | "trae" | "zcode";
+export type SharedHookName = "session-start.py" | "inject-shell-session-context.py" | "inject-workflow-state.py" | "inject-subagent-context.py" | "inject-spec-context.py";
+export type SharedHookPlatform = "claude" | "cursor" | "codex" | "opencode" | "gemini" | "qoder" | "copilot" | "codebuddy" | "droid" | "kiro" | "trae" | "zcode";
 /**
  * Which shared hooks each platform actually invokes. Single source of truth
  * for shared-hook distribution — `collectSharedHooks` reads this table, and
@@ -51,6 +51,12 @@ export type SharedHookPlatform = "claude" | "cursor" | "codex" | "gemini" | "qod
  *   (per-turn breadcrumb), and `inject-subagent-context.py` (sub-agent
  *   spawn). The scripts emit a plain-text Kiro branch — Kiro adds a hook's
  *   stdout directly to the conversation context (no JSON envelope).
+ * - `inject-spec-context.py` — path-scoped spec injection. Claude Code uses
+ *   PostToolUse Read/Edit/Write/MultiEdit; Codex and OpenCode use PreToolUse.
+ *   Codex passes the native apply_patch payload directly. OpenCode's plugin
+ *   adapts write/edit/apply_patch calls and blocks a FULL emission once so the
+ *   model sees the specs before retrying. Class-2 platforms use
+ *   `get_context.py --mode spec` pull mode instead.
  * - Claude Code `statusLine` is intentionally not installed by default.
  *   Users can add their own statusLine command in `.claude/settings.json`,
  *   or opt in to the Trellis one via `trellis init --with-statusline`

package/dist/templates/shared-hooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/templates/shared-hooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,MAAM,WAAW,UAAU;IACzB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GACtB,kBAAkB,GAClB,iCAAiC,GACjC,0BAA0B,GAC1B,4BAA4B,CAAC;AAEjC,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,OAAO,GACP,SAAS,GACT,WAAW,GACX,OAAO,GACP,MAAM,GACN,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAC3C,kBAAkB,EAClB,SAAS,cAAc,EAAE,CAoD1B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,UAAU,EAAE,CAWnD;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,kBAAkB,GAC3B,UAAU,EAAE,CAGd"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/templates/shared-hooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,MAAM,WAAW,UAAU;IACzB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GACtB,kBAAkB,GAClB,iCAAiC,GACjC,0BAA0B,GAC1B,4BAA4B,GAC5B,wBAAwB,CAAC;AAE7B,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,UAAU,GACV,QAAQ,GACR,OAAO,GACP,SAAS,GACT,WAAW,GACX,OAAO,GACP,MAAM,GACN,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAC3C,kBAAkB,EAClB,SAAS,cAAc,EAAE,CA0D1B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,UAAU,EAAE,CAWnD;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,kBAAkB,GAC3B,UAAU,EAAE,CAGd"}

package/dist/templates/shared-hooks/index.js

@@ -51,6 +51,12 @@ function readTemplate(relativePath) {
  *   (per-turn breadcrumb), and `inject-subagent-context.py` (sub-agent
  *   spawn). The scripts emit a plain-text Kiro branch — Kiro adds a hook's
  *   stdout directly to the conversation context (no JSON envelope).
+ * - `inject-spec-context.py` — path-scoped spec injection. Claude Code uses
+ *   PostToolUse Read/Edit/Write/MultiEdit; Codex and OpenCode use PreToolUse.
+ *   Codex passes the native apply_patch payload directly. OpenCode's plugin
+ *   adapts write/edit/apply_patch calls and blocks a FULL emission once so the
+ *   model sees the specs before retrying. Class-2 platforms use
+ *   `get_context.py --mode spec` pull mode instead.
  * - Claude Code `statusLine` is intentionally not installed by default.
  *   Users can add their own statusLine command in `.claude/settings.json`,
  *   or opt in to the Trellis one via `trellis init --with-statusline`
@@ -67,13 +73,19 @@ export const SHARED_HOOKS_BY_PLATFORM = {
         "session-start.py",
         "inject-workflow-state.py",
         "inject-subagent-context.py",
+        "inject-spec-context.py",
     ],
     cursor: [
         "session-start.py",
         "inject-shell-session-context.py",
         "inject-subagent-context.py",
     ],
-    codex: ["inject-workflow-state.py", "inject-subagent-context.py"],
+    codex: [
+        "inject-workflow-state.py",
+        "inject-subagent-context.py",
+        "inject-spec-context.py",
+    ],
+    opencode: ["inject-spec-context.py"],
     gemini: [
         "session-start.py",
         "inject-shell-session-context.py",

package/dist/templates/shared-hooks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/templates/shared-hooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAGjC;IACF,MAAM,EAAE;QACN,kBAAkB;QAClB,0BAA0B;QAC1B,4BAA4B;KAC7B;IACD,MAAM,EAAE;QACN,kBAAkB;QAClB,iCAAiC;QACjC,4BAA4B;KAC7B;IACD,KAAK,EAAE,CAAC,0BAA0B,EAAE,4BAA4B,CAAC;IACjE,MAAM,EAAE;QACN,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;KAC3B;IACD,KAAK,EAAE;QACL,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;KAC3B;IACD,OAAO,EAAE,CAAC,0BAA0B,CAAC;IACrC,SAAS,EAAE;QACT,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;QAC1B,4BAA4B;KAC7B;IACD,KAAK,EAAE;QACL,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;QAC1B,4BAA4B;KAC7B;IACD,IAAI,EAAE;QACJ,kBAAkB;QAClB,0BAA0B;QAC1B,4BAA4B;KAC7B;IACD,IAAI,EAAE;QACJ,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;KAC3B;IACD,KAAK,EAAE;QACL,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;QAC1B,4BAA4B;KAC7B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;IAEV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/templates/shared-hooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAGjC;IACF,MAAM,EAAE;QACN,kBAAkB;QAClB,0BAA0B;QAC1B,4BAA4B;QAC5B,wBAAwB;KACzB;IACD,MAAM,EAAE;QACN,kBAAkB;QAClB,iCAAiC;QACjC,4BAA4B;KAC7B;IACD,KAAK,EAAE;QACL,0BAA0B;QAC1B,4BAA4B;QAC5B,wBAAwB;KACzB;IACD,QAAQ,EAAE,CAAC,wBAAwB,CAAC;IACpC,MAAM,EAAE;QACN,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;KAC3B;IACD,KAAK,EAAE;QACL,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;KAC3B;IACD,OAAO,EAAE,CAAC,0BAA0B,CAAC;IACrC,SAAS,EAAE;QACT,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;QAC1B,4BAA4B;KAC7B;IACD,KAAK,EAAE;QACL,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;QAC1B,4BAA4B;KAC7B;IACD,IAAI,EAAE;QACJ,kBAAkB;QAClB,0BAA0B;QAC1B,4BAA4B;KAC7B;IACD,IAAI,EAAE;QACJ,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;KAC3B;IACD,KAAK,EAAE;QACL,kBAAkB;QAClB,iCAAiC;QACjC,0BAA0B;QAC1B,4BAA4B;KAC7B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;IAEV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC"}