@soleur/opencode 3.354.3 → 3.354.4

package/opencode/INSTRUCTIONS.md

@@ -120,11 +120,13 @@ harness shares with the guard scripts' own input contract.
 `--apply` consumes, and no OpenCode surface can both rewrite the command and ask in the same
 decision (ADR-264). So `plugins/soleur/scripts/lib/operator-script.sh`'s `soleur_op_stage_gate`
 finds no receipt and exits **75** (`SOLEUR_BOOTSTRAP_APPROVAL_REQUIRED`). The typed-`yes`
-fallback is gated on `-t 0`/`-t 1` **and** `soleur_op_in_agent_harness`, which recognises only
-`CLAUDECODE`/`CLAUDE_CODE_ENTRYPOINT` — neither is set under OpenCode — so that arm is open
-here whenever the spawned shell has a tty, and a terminal confirmation from an agent is not
-evidence of a person. **No receipt can be minted on this harness**, so a staged `--apply`
-refuses rather than approving. Nothing is approved silently.
+fallback is gated on `-t 0`/`-t 1` **and** `! soleur_op_in_agent_harness`, which recognises
+`OPENCODE` (alongside `CLAUDECODE`/`CLAUDE_CODE_ENTRYPOINT`), so that arm is closed here too:
+direct `shell` calls have no tty (`fd 0/1/2` are pipes, measured on OpenCode 2.1.2), and even if
+a child allocates a pseudo-terminal (`script`, `python pty`), `OPENCODE` keeps the fallback
+refused because a terminal inside an agent harness is not evidence of a person. **No receipt can
+be minted on this harness**, so a staged `--apply` refuses rather than approving. Nothing is
+approved silently.
 
 A degraded hook decision — a shell call whose `workdir` could not be correlated, or a runtime
 with no `tool.execute.before` surface — is announced on stderr **and** written to the event log

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soleur/opencode",
-  "version": "3.354.3",
+  "version": "3.354.4",
   "description": "Soleur AI organization plugin for OpenCode",
   "type": "module",
   "bin": {

package/scripts/lib/operator-script.sh

@@ -703,12 +703,13 @@ soleur_op_barrier() {
 
 # soleur_op_in_agent_harness
 #   True when this process runs under an agent harness (Claude Code sets CLAUDECODE
-#   and CLAUDE_CODE_ENTRYPOINT in every tool call's environment). A typed `yes` on a
-#   pseudo-terminal is accepted only when this is false. HONEST LIMIT: an agent that
-#   deliberately unsets these names and opens a pty defeats it; that is the
-#   hijacked-agent case the receipt threshold already excludes (ADR-264).
+#   and CLAUDE_CODE_ENTRYPOINT, and OpenCode sets OPENCODE, in every tool call's
+#   environment). A typed `yes` on a pseudo-terminal is accepted only when this is
+#   false. HONEST LIMIT: an agent that deliberately unsets these names and opens a
+#   pty defeats it; that is the hijacked-agent case the receipt threshold already
+#   excludes (ADR-264).
 soleur_op_in_agent_harness() {
-  [[ -n "${CLAUDECODE:-}" || -n "${CLAUDE_CODE_ENTRYPOINT:-}" ]]
+  [[ -n "${CLAUDECODE:-}" || -n "${CLAUDE_CODE_ENTRYPOINT:-}" || -n "${OPENCODE:-}" ]]
 }
 
 # soleur_op_ack_or_die <prompt>                       [class 2]

package/scripts/sync-opencode-adapter.ts

@@ -307,11 +307,13 @@ function instructions(): string {
     "`--apply` consumes, and no OpenCode surface can both rewrite the command and ask in the same",
     "decision (ADR-264). So `plugins/soleur/scripts/lib/operator-script.sh`'s `soleur_op_stage_gate`",
     "finds no receipt and exits **75** (`SOLEUR_BOOTSTRAP_APPROVAL_REQUIRED`). The typed-`yes`",
-    "fallback is gated on `-t 0`/`-t 1` **and** `soleur_op_in_agent_harness`, which recognises only",
-    "`CLAUDECODE`/`CLAUDE_CODE_ENTRYPOINT` — neither is set under OpenCode — so that arm is open",
-    "here whenever the spawned shell has a tty, and a terminal confirmation from an agent is not",
-    "evidence of a person. **No receipt can be minted on this harness**, so a staged `--apply`",
-    "refuses rather than approving. Nothing is approved silently.",
+    "fallback is gated on `-t 0`/`-t 1` **and** `! soleur_op_in_agent_harness`, which recognises",
+    "`OPENCODE` (alongside `CLAUDECODE`/`CLAUDE_CODE_ENTRYPOINT`), so that arm is closed here too:",
+    "direct `shell` calls have no tty (`fd 0/1/2` are pipes, measured on OpenCode 2.1.2), and even if",
+    "a child allocates a pseudo-terminal (`script`, `python pty`), `OPENCODE` keeps the fallback",
+    "refused because a terminal inside an agent harness is not evidence of a person. **No receipt can",
+    "be minted on this harness**, so a staged `--apply` refuses rather than approving. Nothing is",
+    "approved silently.",
     "",
     "A degraded hook decision — a shell call whose `workdir` could not be correlated, or a runtime",
     "with no `tool.execute.before` surface — is announced on stderr **and** written to the event log",

package/skills/operator-bootstrap/SKILL.md

@@ -64,11 +64,13 @@ bash SCRIPT --stage NAME --apply --plan-digest D [--rotate-token]   the approved
 - `--apply --plan-digest D` performs the write. The script **recomputes** the plan and compares the
   digest, so what runs is what was shown; a mismatch exits 75 `SOLEUR_BOOTSTRAP_PLAN_DRIFT` with
   nothing written.
-- The **receipt**: a plugin PreToolUse hook (`plugins/soleur/hooks/operator-stage-approval.sh`) mints
-  a one-time record when the harness shows the person the exact command, and rewrites the command to
-  carry `SOLEUR_APPROVAL_NONCE`. The script consumes the record before its first write. An
-  environment variable or a flag set by the agent is never an approval. No valid receipt: exit 75,
-  nothing written.
+- The **receipt** (Claude Code interactive only): a plugin PreToolUse hook
+  (`plugins/soleur/hooks/operator-stage-approval.sh`) mints a one-time record when the harness shows
+  the person the exact command, and rewrites the command to carry `SOLEUR_APPROVAL_NONCE`. The script
+  consumes the record before its first write. An environment variable or a flag set by the agent is
+  never an approval. On harnesses without that hook (OpenCode, Codex, Devin cloud, Grok) and on the
+  web app, no receipt can be minted: `--apply` exits 75 (`SOLEUR_BOOTSTRAP_APPROVAL_REQUIRED`) with
+  nothing written (see **Surfaces** below).
 - **Keep the `.env` beside the script.** "Satisfied" and `verify` read the recorded slugs there (it is
   gitignored). A fresh checkout without it turns a satisfied stage into a rotation plan and makes
   `verify` report a healthy vendor state as failed: run `verify` from the checkout that ran the stages.
@@ -244,7 +246,7 @@ state `SOLEUR_BOOTSTRAP_APPROVAL_PENDING stage=<s>` in your reply (headless only
 and approves at the prompt. There is no variable, setting or file that approves it; never suggest one.
 `bypassPermissions`, `dontAsk` and auto modes: the hook denies. The script itself accepts a typed `yes`
 only from a person at their own terminal with no agent harness around it, so never allocate a
-pseudo-terminal to answer it. Harnesses without the hook (Codex,
+pseudo-terminal to answer it. Harnesses without the hook (OpenCode, Codex,
 Devin cloud, Grok) and the web app: the script exits 75 and writes nothing; say "this surface cannot
 make production changes yet" and **never** tell the person to open a terminal (the web approval
 adapter is #9388; per-harness adapters are #9389).