@snarkipus/opencode-beads 1.0.1 → 1.0.2

package/README.md

@@ -9,7 +9,7 @@
 
 `@snarkipus/opencode-beads` is a maintained OpenCode adapter that gives OpenCode 2 the integration `bd setup claude` gives Claude Code: `bd prime` workflow context on every request, refreshed after compaction and when a session resumes, plus a bounded task agent that completes one Bead per invocation. It does not replace Beads: the installed `bd` CLI remains authoritative for issues, project initialization, skills, migrations, backups, and Dolt synchronization.
 
-The project originated as [Josh Thomas's `opencode-beads`](https://github.com/joshuadavidthomas/opencode-beads) and continues under the MIT license. This fork is maintained by Matt Jackson. It vendors nothing from upstream Beads; instead, every Beads release is checked against the `bd` behavior the plugin relies on (see [Tracking upstream Beads](#tracking-upstream-beads)).
+This is an independent project maintained by Matt Jackson under the MIT license. It began as a fork of [Josh Thomas's `opencode-beads`](https://github.com/joshuadavidthomas/opencode-beads), and the original work remains credited to its author. 1.0 rebuilt the plugin for OpenCode 2, and development now continues here independently. It vendors nothing from upstream Beads; instead, every Beads release is checked against the `bd` behavior the plugin relies on (see [Tracking upstream Beads](#tracking-upstream-beads)).
 
 ## Design
 
@@ -37,7 +37,7 @@ This plugin requires OpenCode 2 and `bd` 1.3.0 or later.
 
    ```json
    {
-     "plugins": ["@snarkipus/opencode-beads@1.0.1"]
+     "plugins": ["@snarkipus/opencode-beads@1.0.2"]
    }
    ```
 
@@ -53,7 +53,7 @@ Plugin options use the object form:
 {
   "plugins": [
     {
-      "package": "@snarkipus/opencode-beads@1.0.1",
+      "package": "@snarkipus/opencode-beads@1.0.2",
       "options": { "luna": true, "autoMigrate": false }
     }
   ]
@@ -63,7 +63,7 @@ Plugin options use the object form:
 | Option | Default | Effect |
 | --- | --- | --- |
 | `luna` | `false` | Also register the `beads-task-agent-luna` profile. |
-| `stealth` | `false` | Run `bd prime --stealth` (no git operations in the session-close protocol), like `bd setup claude --stealth`. `bd config set no-git-ops true` is the project-level equivalent. |
+| `stealth` | `false` | Add `--stealth` to `bd prime` (no git operations in the session-close protocol), like `bd setup claude --stealth`. `bd config set no-git-ops true` is the project-level equivalent. |
 | `taskAgentSteps` | `100` | Hard cap on task-agent steps per invocation, a backstop for "one bead, then return". `0` removes the cap. |
 | `refreshAfterIdleMinutes` | `30` | Re-run `bd prime` when a session resumes after this much inactivity, as Claude Code does on resume. `0` disables idle refresh. |
 | `autoMigrate` | `false` | Let automatic `bd prime` open a store that may need a schema migration. See [Schema migration guard](#schema-migration-guard). |
@@ -89,7 +89,7 @@ The [Claude Code parity matrix](docs/claude-code-parity.md) records every `bd se
 
 ## Context injection
 
-The plugin runs full `bd prime` in the project directory and attaches its output to each model request through OpenCode's session context hook. The output is cached per session, so prime runs once per session rather than per request. It runs again after compaction (automatic or manual), when a session resumes after `refreshAfterIdleMinutes` of inactivity, and when the plugin reloads, mirroring the `startup`, `resume`, `clear`, and `compact` sources of Claude Code's `SessionStart` hook. Steady work keeps the same text, which keeps provider prompt caches warm. Attached context is not stored in the conversation, so compaction cannot drop it. Prime supplies the canonical current workflow, command guidance, and persistent memories; the plugin adds only compact OpenCode-specific safety and delegation guidance.
+The plugin runs `bd prime --full` in the project directory and attaches its output to each model request through OpenCode's session context hook. The output is cached per session, so prime runs once per session rather than per request. It runs again after compaction (automatic or manual), when a session resumes after `refreshAfterIdleMinutes` of inactivity, and when the plugin reloads, mirroring the `startup`, `resume`, `clear`, and `compact` sources of Claude Code's `SessionStart` hook. Steady work keeps the same text, which keeps provider prompt caches warm. Attached context is not stored in the conversation, so compaction cannot drop it. `--full` matters: without it, `bd` switches to brief MCP reminders whenever Claude Code's settings list a Beads MCP server, and OpenCode has no Beads MCP tool. Prime supplies the canonical current workflow, command guidance, and persistent memories; the plugin adds only compact OpenCode-specific safety and delegation guidance.
 
 While prime is attached, two bd-managed `AGENTS.md` blocks only repeat it: the full-profile section `bd setup opencode` writes, and the Codex section `bd init` writes. The plugin replaces those marked blocks in the outgoing request with a one-line pointer, matching the minimal `CLAUDE.md` pointer Beads uses for Claude Code. `bd init`'s minimal section is left as is. Your `AGENTS.md` file and any text outside those markers are not changed, and nothing is replaced when prime is withheld or unavailable.
 
@@ -121,7 +121,7 @@ Its prompt and description are owned by this project. Upstream Beads ships a tas
 
 OpenCode lets the plugin enforce parts of that contract, beyond what Claude Code's hooks can do:
 
-- **No automatic commit, push, or sync.** The task agents' permissions require approval (`ask`) for `git commit`, `git push`, `bd dolt push`, `bd dolt pull`, and `bd sync`, on top of OpenCode's defaults. Compound commands are checked per command. A non-interactive run rejects them. Set the agent's `permissions` in OpenCode configuration to replace these rules.
+- **No automatic commit, push, or sync.** The task agents' permissions require approval (`ask`) for `git commit`, `git push`, `bd dolt push`, `bd dolt pull`, and `bd sync`, on top of OpenCode's defaults. Global options before the subcommand (`git -C dir push`, `bd --json dolt push`) are covered too, and compound commands are checked per command. This is a guardrail against routine sync, not a sandbox: scripts and aliases can still run these commands. A non-interactive run rejects them. Set the agent's `permissions` in OpenCode configuration to replace these rules.
 - **Step cap.** `taskAgentSteps` (default 100) limits a worker invocation; on its final step OpenCode removes tools and asks for a summary.
 - **Context in the worker.** The worker runs in its own child session and receives `bd prime` there too; Claude Code's `SessionStart` hooks do not reach subagents.
 - **Beads state across compaction.** Compaction requests in sessions with Beads context ask the summarizer to keep bead IDs, claim and status changes, discovered follow-ups, blockers, and pending validation.
@@ -138,7 +138,7 @@ Luna requires access to `openai/gpt-6-luna` and its `max` variant in your OpenCo
 
 The package vendors nothing from upstream. It depends on the installed `bd` CLI at runtime: `bd prime` supplies the current workflow, and the schema migration guard enforces the supported `bd` range.
 
-[`scripts/bd-contract.ts`](scripts/bd-contract.ts) checks a real `bd` against everything the plugin relies on: version parsing, `bd where --json`, the `.beads/.local_version` behavior the guard depends on (written by `bd init`, untouched by `bd prime`, refreshed by `bd migrate schema`), and every command the task-agent prompt names. CI runs it against the validated release from `package.json` (`beads.validated`). The scheduled `beads-contract` workflow runs it daily against the latest stable Beads release, and fails if that release breaks the contract or is newer than the validated one. When a new release appears, review its upgrade notes, then update `beads.validated` and the compatibility table. The [artifact policy](docs/beads-artifact-policy.md) records why upstream artifacts are not vendored.
+[`scripts/bd-contract.ts`](scripts/bd-contract.ts) checks a real `bd` against everything the plugin relies on: version parsing, `bd where --json`, the `.beads/.local_version` behavior the guard depends on (written by `bd init`, untouched by `bd prime`, refreshed by `bd migrate schema`), that `bd prime --full` keeps the full workflow when Claude Code has a Beads MCP server, and every command the task-agent prompt names. CI runs it against the validated release from `package.json` (`beads.validated`). The scheduled `beads-contract` workflow runs it daily against the latest stable Beads release, and fails if that release breaks the contract or is newer than the validated one. When a new release appears, review its upgrade notes, then update `beads.validated` and the compatibility table. The [artifact policy](docs/beads-artifact-policy.md) records why upstream artifacts are not vendored.
 
 ## Compatibility
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snarkipus/opencode-beads",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "type": "module",
   "description": "A maintained OpenCode V2 integration for the Beads issue tracker: bd prime context injection with a schema-migration guard, and a bounded task agent.",
   "author": "Matt Jackson",

package/src/agents.ts

@@ -14,14 +14,22 @@ export const DEFAULT_TASK_AGENT_STEPS = 100;
 /**
  * Enforce the no-automatic-commit/push/sync policy with OpenCode permissions rather than prompt
  * text alone. Appended after OpenCode's defaults, so these `ask` rules win; compound commands are
- * checked per command, so `cd x && git push` is caught too.
+ * checked per command, so `cd x && git push` is caught too. Each subcommand has a second rule for
+ * global options before it (`git -C dir push`, `bd --json dolt push`). That also asks for a few
+ * harmless commands such as `git log --grep push`; asking too often is the safe direction. This is
+ * a guardrail against routine sync, not a sandbox: wrappers, aliases, and scripts still bypass it.
  */
 export const TASK_AGENT_PERMISSIONS = [
   { action: "shell", resource: "git commit *", effect: "ask" },
+  { action: "shell", resource: "git * commit *", effect: "ask" },
   { action: "shell", resource: "git push *", effect: "ask" },
+  { action: "shell", resource: "git * push *", effect: "ask" },
   { action: "shell", resource: "bd dolt push *", effect: "ask" },
+  { action: "shell", resource: "bd * dolt push *", effect: "ask" },
   { action: "shell", resource: "bd dolt pull *", effect: "ask" },
+  { action: "shell", resource: "bd * dolt pull *", effect: "ask" },
   { action: "shell", resource: "bd sync *", effect: "ask" },
+  { action: "shell", resource: "bd * sync *", effect: "ask" },
 ] as const;
 
 /** Routing for the opt-in Luna profile, `provider/model#variant` in OpenCode terms. */

package/src/guidance.ts

@@ -1,5 +1,5 @@
 /**
- * Fork-owned guidance for OpenCode: the shared context layer and the bounded task-agent prompt.
+ * Project-owned guidance for OpenCode: the shared context layer and the bounded task-agent prompt.
  *
  * Upstream Beads ships its task agent only for Claude Code, as an autonomous multi-task loop. This
  * adapter deliberately diverges (one bead per invocation), so the prompt and description live here.
@@ -11,7 +11,7 @@ export const BEADS_TASK_AGENT_DESCRIPTION =
 
 const BEADS_HOST_GUIDANCE = `## CLI Safety
 
-There is no native \`bd\` or Beads MCP tool in OpenCode. Run \`bd\` through \`bash\`.
+There is no native \`bd\` or Beads MCP tool in OpenCode. Run \`bd\` through the \`shell\` tool.
 Treat the injected \`bd prime\` output as the canonical workflow reference. Use \`bd --help\` to discover commands, \`bd <command> --help\` for current syntax, and \`--json\` when structured output improves reliability. Distinguish command failures from output parsing failures.
 
 Run relevant validation before closing an issue. Do not commit, push, or run Dolt synchronization automatically; do so only when current instructions or repository policy explicitly require it.`;
@@ -20,10 +20,10 @@ const BEADS_DELEGATION_GUIDANCE = `## Delegation
 
 Delegate multi-command Beads work and issue-graph analysis to the \`beads-task-agent\` subagent through the \`subagent\` tool; perform only single atomic operations directly.`;
 
-/** Fork-owned system prompt for the bounded one-bead task agent. */
+/** Project-owned system prompt for the bounded one-bead task agent. */
 export const BEADS_TASK_AGENT_PROMPT = `## Beads Task Agent
 
-Full \`bd prime\` workflow context is injected with each request. Use \`bd\` via \`bash\`; rerun prime if context is missing or stale.
+Full \`bd prime\` workflow context is injected with each request. Use \`bd\` via the \`shell\` tool; rerun prime if context is missing or stale.
 
 For status or graph analysis, never claim, update, close, or modify a bead. Return the analysis and stop.
 

package/src/host.ts

@@ -20,7 +20,7 @@ export type HostContext = Pick<Plugin.Context, "location" | "options" | "event">
 export interface HostDependencies {
   /** Override process-backed Beads calls, mainly for tests. */
   runtime?: Partial<Pick<ContextRuntime, "guard" | "prime">>;
-  /** Override the `bd prime` runner (receives extra flags such as `--stealth`). */
+  /** Override the `bd prime` runner (receives `--full`, plus `--stealth` when enabled). */
   runPrime?: (directory: string, flags: readonly string[]) => Promise<string>;
   /** Override the bounded `bd` runner used by the store guard. */
   bd?: (directory: string, args: readonly string[]) => Promise<string>;
@@ -47,8 +47,10 @@ export async function setupBeads(
 ): Promise<() => void> {
   const directory = ctx.location.directory;
   const autoMigrate = ctx.options?.autoMigrate === true;
-  // Mirrors `bd setup claude --stealth`: prime without git operations in the session-close protocol.
-  const stealth = ctx.options?.stealth === true;
+  // `--full` defeats bd's MCP detection, which reads Claude Code's settings and would otherwise
+  // shrink prime to MCP reminders; OpenCode has no Beads MCP tool. `--stealth` mirrors
+  // `bd setup claude --stealth`: prime without git operations in the session-close protocol.
+  const primeFlags = ctx.options?.stealth === true ? ["--full", "--stealth"] : ["--full"];
   const now = deps.now ?? Date.now;
   const warn = deps.warn ?? ((message: string) => console.warn(message));
   const diagnosticIntervalMs = deps.diagnosticIntervalMs ?? DEFAULT_DIAGNOSTIC_INTERVAL_MS;
@@ -59,7 +61,7 @@ export async function setupBeads(
     guard: deps.runtime?.guard ?? ((cwd) => checkBeadsStore(cwd, guardRuntime, { autoMigrate })),
     prime:
       deps.runtime?.prime ??
-      ((cwd) => (deps.runPrime ?? ((dir, flags) => runBdPrime(dir, {}, flags)))(cwd, stealth ? ["--stealth"] : [])),
+      ((cwd) => (deps.runPrime ?? ((dir, flags) => runBdPrime(dir, {}, flags)))(cwd, primeFlags)),
     async agentMode(agentID): Promise<AgentMode | undefined> {
       const response = await ctx.agent.get({ agentID });
       return response.data.mode;