@sjawhar/pi-legion-envoy 1.4.3 → 1.6.0

package/README.md

@@ -103,14 +103,17 @@ Configure the shared `envoy.json` with:
 ```
 
 The user file is `~/.config/opencode/envoy.json`; a
-`<cwd>/.opencode/envoy.json` file shallow-merges over it. `DISPATCH_URL` and
-`DISPATCH_TOKEN` override the file values for one process; `DISPATCH_TOKEN_FILE`
-(a path whose trimmed contents are the token — how the Legion daemon delivers it
-to a pane) wins over both and never falls back when unreadable. Omitting
-`dispatch.serverUrl` while `dispatch.enabled` is true targets
+`<cwd>/.opencode/envoy.json` file shallow-merges over it. A repository
+`dispatch.serverUrl` requires `dispatch.token` in that same repository file:
+it never combines with a user-file or process-environment credential. To
+override a repository endpoint for one process, set `DISPATCH_URL` together
+with `DISPATCH_TOKEN` or `DISPATCH_TOKEN_FILE`. `DISPATCH_TOKEN_FILE` (a path
+whose trimmed contents are the token — how the Legion daemon delivers it to a
+pane) wins over every other token source and never falls back when unreadable.
+Omitting `dispatch.serverUrl` while `dispatch.enabled` is true targets
 `http://localhost:8766`, the Go server's listen address. Invalid configuration,
-an invalid URL, or an empty token leaves the twelve tools unavailable and reports
-the source of the error.
+an invalid URL, or an empty token leaves the twelve tools unavailable and
+reports the source of the error.
 
 Owner-scoped calls use either an issue (a native `KEY` or external `owner/repo#n` reference) or
 an unlinked project document (`project` plus its `artifact` slug). A Legion session may omit

package/dist/envoy.js

@@ -29663,6 +29663,7 @@ var DispatchEventSchema = object({
 var IssueEventPayloadSchema = object({
   title: string2().optional(),
   status: string2().optional(),
+  rank: string2().optional(),
   route: string2().nullish()
 });
 var ArtifactCreatedEventPayloadSchema = object({
@@ -31300,10 +31301,25 @@ function resolveDispatchConfig(env, options = {}) {
       return { enabled: false, url: null, token: null, error: file.reason };
     }
   }
-  const merged = {
-    ...userFile.kind === "valid" ? userFile.settings : null,
-    ...repoFile.kind === "valid" ? repoFile.settings : null
-  };
+  const userSettings = userFile.kind === "valid" ? userFile.settings : null;
+  const repoSettings = repoFile.kind === "valid" ? repoFile.settings : null;
+  const merged = { ...userSettings, ...repoSettings };
+  const repoURL = repoSettings?.serverUrl;
+  if (explicitUrl === undefined && merged.enabled === true && repoURL !== undefined) {
+    const token = repoSettings?.token ?? null;
+    if (!token) {
+      return {
+        enabled: false,
+        url: null,
+        token: null,
+        error: "repository dispatch.serverUrl requires dispatch.token from the same .opencode/envoy.json or DISPATCH_URL with DISPATCH_TOKEN"
+      };
+    }
+    const url2 = parsedDispatchUrl(repoURL, "repository dispatch.serverUrl");
+    if (url2.error !== null)
+      return { enabled: false, url: null, token: null, error: url2.error };
+    return { enabled: true, url: url2.url, token, error: null };
+  }
   const rawUrl = explicitUrl !== undefined ? { value: explicitUrl, source: "DISPATCH_URL" } : merged.enabled === true ? { value: merged.serverUrl ?? DEFAULT_SERVER_URL, source: "dispatch.serverUrl" } : null;
   const url2 = rawUrl ? parsedDispatchUrl(rawUrl.value, rawUrl.source) : { url: null, error: null };
   let token;

package/dist/legion.js

@@ -29662,6 +29662,7 @@ var DispatchEventSchema = object({
 var IssueEventPayloadSchema = object({
   title: string2().optional(),
   status: string2().optional(),
+  rank: string2().optional(),
   route: string2().nullish()
 });
 var ArtifactCreatedEventPayloadSchema = object({
@@ -31726,10 +31727,25 @@ function resolveDispatchConfig(env, options = {}) {
       return { enabled: false, url: null, token: null, error: file.reason };
     }
   }
-  const merged = {
-    ...userFile.kind === "valid" ? userFile.settings : null,
-    ...repoFile.kind === "valid" ? repoFile.settings : null
-  };
+  const userSettings = userFile.kind === "valid" ? userFile.settings : null;
+  const repoSettings = repoFile.kind === "valid" ? repoFile.settings : null;
+  const merged = { ...userSettings, ...repoSettings };
+  const repoURL = repoSettings?.serverUrl;
+  if (explicitUrl === undefined && merged.enabled === true && repoURL !== undefined) {
+    const token = repoSettings?.token ?? null;
+    if (!token) {
+      return {
+        enabled: false,
+        url: null,
+        token: null,
+        error: "repository dispatch.serverUrl requires dispatch.token from the same .opencode/envoy.json or DISPATCH_URL with DISPATCH_TOKEN"
+      };
+    }
+    const url2 = parsedDispatchUrl(repoURL, "repository dispatch.serverUrl");
+    if (url2.error !== null)
+      return { enabled: false, url: null, token: null, error: url2.error };
+    return { enabled: true, url: url2.url, token, error: null };
+  }
   const rawUrl = explicitUrl !== undefined ? { value: explicitUrl, source: "DISPATCH_URL" } : merged.enabled === true ? { value: merged.serverUrl ?? DEFAULT_SERVER_URL, source: "dispatch.serverUrl" } : null;
   const url2 = rawUrl ? parsedDispatchUrl(rawUrl.value, rawUrl.source) : { url: null, error: null };
   let token;

package/dist/skills/dispatch/SKILL.md

@@ -29,6 +29,13 @@ vocabulary, and is often on a phone. Write for that person.
 - Before posting, test it: could Sami, reading only this text on his phone, know what he is being
   told or asked? If not, rewrite it. Length is not the problem; density is.
 
+## Agent authentication
+
+Use a personal Dispatch token: a human mints it in Dispatch **Settings → Agent tokens** and supplies
+it to the agent through `dispatch.token` in `~/.config/opencode/envoy.json` or `DISPATCH_TOKEN`.
+The server records the minting human as the owner of that session's writes. `DISPATCH_AGENT_TOKEN`
+is the shared devbox fallback; do not configure it for an individual agent.
+
 ## Writing a spec
 
 A spec has two readers: the human who decides reads the top; the implementer who builds reads the
@@ -65,6 +72,8 @@ exactly one owner to every owner-scoped tool: `issue` for an issue, or `project`
 [References](#references) for the resulting ref shape). On first use, an external issue reference creates its native issue in the
 project configured for that repository in Dispatch Settings, then falls back to `DISPATCH_DEFAULT_PROJECT`.
 
+Issue reads include `rank`, the server-owned ordering key used by project boards; reorder through `PATCH /api/v1/issues/{key}` with neighboring issue keys rather than writing a priority value.
+
 Architects create newly tracked child work with:
 ```ts
 dispatch_issue({ project, title, parent?, external?, spec?, force? })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "1.4.3",
+  "version": "1.6.0",
   "type": "module",
   "omp": {
     "extensions": [