@sorenllm/opencode-forge 0.13.0 → 0.14.1

package/README.md

@@ -31,7 +31,18 @@ OpenSpec spec workflows remain a third, separate lane.
 ```
 
 - Plan files: `.opencode/plan/<date>-<slug>.md` in your project, frontmatter
-  state machine `draft → approved → done` (exit: `abandoned`).
+  state machine `draft → approved → done`, exits `abandoned` (plain discard) and
+  `superseded` (`plan_discard {reason, supersede: "<successor path>"}` —
+  the exit for work whose execution moves to another harness, e.g.
+  `.opencode/crew/2026-10-01-....md`, rather than ends). Every terminal
+  transition appends a dated narrative section to the file body in the same
+  write as the status flip: close = each acceptance criterion's
+  pass/evidence; discard/supersede = the reason verbatim (`(none given)`
+  when absent; a supersession also records the successor path). Appended
+  sections are parser-inert — status reads frontmatter only, tick
+  counts read the Task List only — and a superseded plan's Task List
+  stays the frozen decision snapshot: closure IS the supersession, and
+  crew/goal results never tick it.
 - While a plan is in draft, `write` / `edit` / `bash` / `task` are **denied
   at the permission layer** — including your own `allow` config, and for
   every agent in that session (the draft protects shared session state; see
@@ -69,7 +80,17 @@ entirely (the hide is withdrawn in the same stroke). The forge family is
 prompted to route every shell command through `forge_shell` — on hosts that
 ignore injected tools maps the builtin tool stays visible but is refused at
 call time, and the channel mandate is what keeps the model from trying it
-first (the belt refusal remains the backstop). Mixed sessions (Tab
+first (the belt refusal remains the backstop). On such unfiltered hosts the
+fallback belt family is a three-part enumeration of hard refusals at the
+tool layer: a forge-family builtin `shell`/`bash` call is refused with a
+pointer to `forge_shell`; a non-forge agent's call of any forge tool is
+refused with the partition guidance; and a `forge-*` worker (any family
+member whose agent name is not exactly `forge`) calling a harness state tool
+(`plan_*`, `goal_*`, `crew_begin`, `crew_close`) is refused as primary-only.
+That refusal fires before any execution or user confirmation dialog, so a
+worker's state-tool call never reaches a gate, and the error names the way
+out: report findings back to the orchestrating session — the primary forge
+agent alone calls the state tools. Mixed sessions (Tab
 between agents in one session): harness state (plans/goals) stays
 session-bound, tool surfaces follow the current speaker, and the goal loop
 parks instead of driving a non-forge turn. One deliberate exception: a
@@ -419,9 +440,10 @@ discovered by walking up:
 The two layers **merge**: agents combine, and on an id collision the project
 definition wins wholesale (one definition per id — no cross-layer field
 blending). A broken file empties only its own layer/pool (error finding with
-the parse location); everything else still applies. Both layers hot-apply —
-edits, and files appearing or disappearing, take effect at the next config
-hook without a host restart (see the apply-timing table below).
+the parse location); everything else still applies. Both layers re-read at
+every real materialization — host boot, a first config build, or an
+opencode config reload — without a restart; a new session alone does
+not re-read them (see the apply-timing table below).
 
 **Hierarchical pools on a shared host.** Agent frontends (paseo and friends)
 routinely share ONE opencode host process across projects, re-initializing
@@ -531,14 +553,18 @@ A rejected entry costs only itself — its siblings materialize normally.
 > error finding naming the missing half. Fix per entry: add the missing
 > `thoughtLevel`, or delete `model` to make it an Auto worker.
 
-**What applies when** — file truth is hot; only the anchor set is frozen at
-host start:
+**What applies when** — only a real materialization re-reads the pool
+files into the `forge-*` vocabulary; the anchor set itself only ever grows.
+Materialization triggers (2026-10-01 live finding): host boot (a freshly
+started CLI process reads the files as they are), the FIRST config build
+for a directory on this host, and opencode config file reloads. A NEW
+session on a long-lived shared host (serve-type) does NOT re-materialize:
 
 | change | needs a host restart? |
 | --- | --- |
-| `thoughtLevel` on an existing agent | no (applies to NEW sessions of that agent; running sessions keep their frozen depth) |
-| agent added / removed / edited, any pool file created or deleted | no restart — applies at the next config hook (materialization re-runs there; the crew gate and depth lookups always resolve fresh) |
-| a NEW directory joining the host (another project's session on the shared host) | no restart — the re-initialization itself adds the anchor and its pools |
+| `thoughtLevel` on an existing agent | no (applies to NEW sessions of that agent; running sessions keep their frozen depth) — depth lookups resolve the pool files fresh at every dispatch, independent of materialization |
+| agent added / removed / edited, any pool file created or deleted | no restart — but not at the next session either: the materialized `forge-*` set rebuilds only at the next REAL materialization (host boot, opencode config reload, or a first config build); on a long-lived shared host pool changes wait for that rebuild or a restart. The crew gate and depth lookups resolve the pool files fresh regardless |
+| a NEW directory joining the host (the first session of another project on the shared host) | no restart — that first config build itself re-initializes the plugin and appends the anchor and its pools (append-only; existing pools never flip) |
 
 ### Dispatching
 
@@ -580,12 +606,21 @@ requires a plan. The flow:
 
 1. **Register** the declared plan: `crew_begin {objective, subtasks}` — one
    titled subtask each, optionally naming the intended `forge-*` agent.
+   When the macro contract descends from a plan artifact, pass its path as
+   the optional `lineage` argument — recorded as a first-class `lineage:`
+   line in the crew record header and disclosed in the registration output
+   (explicit argument only; never inferred from a recently discarded plan).
    Registration enters a **PENDING** crew: execution has not started. The
-   registration output confirms the roster **grouped by pool with its
-   origins** (which forge.json families the dispatchable set materialized
-   from, the primary marked), points at the crew record file, presents the
-   three execution-mode choices, and stops the turn. Reconnaissance task
-   calls are free BEFORE registration.
+   registration output LEADS with the crew record path line (same
+   first-block prominence as the plan tools' `Plan created:`) and the
+   PENDING pause text instructs the model to relay that path to the user
+   alongside the choice — so you can verify the record really landed on
+   disk (an earlier output order buried the path line, and the model
+   reliably drops what it buries — leading with it is the fix). The
+   output then confirms the roster **grouped by pool with its origins**
+   (which forge.json families the dispatchable set materialized from, the
+   primary marked), presents the three execution-mode choices, and stops
+   the turn. Reconnaissance task calls are free BEFORE registration.
 2. **The pause is mechanical**: while the crew pends, every `task` dispatch is
    refused by an interception belt. The user chooses:
    - **supervised waves now** — `crew_begin {execution: "waves"}` lifts the
@@ -645,9 +680,11 @@ session AI do it — the latter only on your explicit go-ahead in that
 conversation, through the normal visible write path (when the AI writes a
 sub-pool file it also proposes a short stable `pool` namespace so ids
 survive directory renames). This is the plugin's only configuration
-invitation. Saved files apply at the next config hook — no restart needed;
-on a shared host, opening a session in a new workspace adds that anchor and
-its pools automatically.
+invitation. Saved files apply at the next real materialization — no
+restart needed; on a shared host, the first session in a NEW workspace adds
+that anchor and its pools automatically (a new session in an existing
+workspace does not re-read the files — see the apply-timing table
+above).
 
 ### Debris note
 

package/dist/index.js

@@ -12346,12 +12346,13 @@ class PlanError extends Error {
     this.name = "PlanError";
   }
 }
-var TERMINAL = ["done", "abandoned"];
+var TERMINAL = ["done", "abandoned", "superseded"];
 var LEGAL_TRANSITIONS = {
-  draft: ["approved", "abandoned"],
-  approved: ["done", "abandoned"],
+  draft: ["approved", "abandoned", "superseded"],
+  approved: ["done", "abandoned", "superseded"],
   done: [],
-  abandoned: []
+  abandoned: [],
+  superseded: []
 };
 var SECTION_ORDER = [
   "Goal",
@@ -12499,6 +12500,7 @@ function matchSectionHeader(line) {
 }
 function splitSections(body) {
   const sections = new Map;
+  const claimed = new Set;
   let current = null;
   const buf = [];
   const flush = () => {
@@ -12509,12 +12511,14 @@ function splitSections(body) {
   };
   for (const line of body.split(/\r?\n/)) {
     const header = matchSectionHeader(line);
-    if (header !== null) {
-      flush();
-      current = header;
-    } else if (current !== null) {
-      buf.push(line);
+    if (header === null || claimed.has(header)) {
+      if (current !== null)
+        buf.push(line);
+      continue;
     }
+    flush();
+    claimed.add(header);
+    current = header;
   }
   flush();
   return sections;
@@ -12525,7 +12529,7 @@ var ACCEPT_RE = /^\s*(\d+)[.、)]\s*(.+)$/;
 function parsePlan(text) {
   const { fm, body } = parseFrontmatter(text);
   const status = fm.status ?? "draft";
-  if (!["draft", "approved", "done", "abandoned"].includes(status)) {
+  if (!["draft", "approved", "done", "abandoned", "superseded"].includes(status)) {
     throw new PlanError(`Unknown plan status: ${fm.status}`);
   }
   const sections = splitSections(body);
@@ -12612,11 +12616,35 @@ function transitionStatus(text, to, now) {
   if (from === to)
     throw new PlanError(`Plan is already ${to}`);
   if (!canTransition(from, to)) {
-    throw new PlanError(`Illegal status transition: ${from} -> ${to} (legal path: draft -> approved -> done; draft/approved -> abandoned)`);
+    throw new PlanError(`Illegal status transition: ${from} -> ${to} (legal path: draft -> approved -> done; draft/approved -> abandoned/superseded)`);
   }
   const next = text.replace(/^status:.*$/m, `status: ${to}`);
   return setUpdated(next, now);
 }
+function appendTerminalSection(text, kind, opts = {}, now = new Date().toISOString()) {
+  if (!["closed", "abandoned", "superseded"].includes(kind)) {
+    throw new PlanError(`Unknown terminal section kind: ${kind}`);
+  }
+  const lines = [`## ${now} — ${kind}`, ""];
+  const reason = (opts.reason ?? "").trim();
+  lines.push(`reason: ${reason.length > 0 ? reason : "(none given)"}`);
+  const successor = (opts.successor ?? "").trim();
+  if (successor.length > 0)
+    lines.push(`successor: ${successor}`);
+  if (opts.checks && opts.checks.length > 0) {
+    lines.push("checks:");
+    for (const c of opts.checks) {
+      lines.push(`- ${c.pass ? "PASS" : "FAIL"} — ${c.criterion.trim()}`);
+      lines.push(`  evidence: ${c.evidence.trim() || "(none)"}`);
+    }
+  }
+  const base = text.replace(/\r?\n$/, "");
+  return `${base}
+
+${lines.join(`
+`)}
+`;
+}
 function progressOf(doc2) {
   return { total: doc2.tasks.length, done: doc2.tasks.filter((t) => t.done).length };
 }
@@ -15796,6 +15824,7 @@ var FORGE_STATE_TOOLS = [
 var FORGE_EXEC_TOOLS = ["forge_shell", "forge_jobs"];
 var FORGE_ALL_TOOLS = [...FORGE_STATE_TOOLS, ...FORGE_EXEC_TOOLS];
 var FORGE_TOOL_SET = new Set(FORGE_ALL_TOOLS);
+var FORGE_STATE_TOOL_SET = new Set(FORGE_STATE_TOOLS);
 var NATIVE_PARTITION_FALLBACKS = ["build", "plan", "general", "explore"];
 var FORGE_PROMPT = `You are forge — the single general-purpose coding agent. You handle every task directly: exploration, planning, implementation, and verification. There is no agent switching.
 
@@ -15819,7 +15848,7 @@ var PLAN_COMMAND_TEMPLATE = [
   "Route on the argument above (decide silently; do not recite this routing text to the user):",
   "- Argument empty: for every non-terminal plan (status draft or approved) in the directory above, read its frontmatter and task checkboxes, then report to the user: path, status, progress (x/y ticked). Ask whether to resume one or start something new.",
   '- Argument "resume": pick the most recently updated non-terminal plan, summarize its remaining unticked tasks to the user in one short list, then continue executing it — tick each task the moment it is done (plan_tick). If none exists, say so.',
-  '- Argument "discard": call the plan_discard tool, then tell the user the plan was abandoned and writes are restored.',
+  '- Argument "discard": call the plan_discard tool with a short reason, then tell the user the plan was abandoned and writes are restored. If the work is NOT ending but moving to another harness — crew orchestration (/crew) or a goal contract (/goal) — pass supersede with the successor artifact path (e.g. ".opencode/crew/2026-10-01-....md") so the plan is marked superseded instead, with the successor recorded in the plan file.',
   "- Any other argument: treat it as the task goal — you are now in planning mode for this goal. Follow the plan discipline below end to end.",
   "",
   "## Plan discipline",
@@ -15832,7 +15861,7 @@ var PLAN_COMMAND_TEMPLATE = [
   "4. Execution (tick as you go): work tasks in order; call plan_tick with the task number immediately after EACH task's work is actually done — never batch ticks, never tick ahead of reality (tick timestamps are an audit trail). If the plan turns out wrong mid-execution, do not silently improvise: tell the user what changed and either finish the affected task or ask about revising (/plan with the same goal re-enters planning).",
   "5. Completion (plan_close): when all tasks are ticked, self-check EVERY acceptance criterion with concrete evidence (file:line, command output, test result), then call plan_close with one check per criterion, pass/fail honest — a failing check refuses the close, and that is the design working, not an inconvenience. The user confirms closure in a dialog.",
   "",
-  "Boundaries: /plan discard abandons the plan (terminal, file kept as history, writes restored); /plan resume continues an unfinished plan from its remaining tasks. Work expected to span multiple sessions or days of multi-file change is spec work (e.g. OpenSpec), not plan work — say so once and let the user choose.",
+  "Boundaries: /plan discard abandons the plan (terminal, file kept as history, writes restored) — pass supersede (the successor artifact path) when the work moves to crew/goal rather than ends, marking it superseded; /plan resume continues an unfinished plan from its remaining tasks. Work expected to span multiple sessions or days of multi-file change is spec work (e.g. OpenSpec), not plan work — say so once and let the user choose.",
   ""
 ].join(`
 `);
@@ -15943,13 +15972,14 @@ function crewRecordPathFor(worktree, objective) {
     name = `${date5}-${slug}-${n++}.md`;
   return join6(dir, name);
 }
-function writeCrewRecord(path, objective, anchor, subtasks) {
+function writeCrewRecord(path, objective, anchor, subtasks, lineage) {
   mkdirSync5(join6(path, ".."), { recursive: true });
   writeFileSync5(path, [
     `# Crew Record: ${objective}`,
     "",
     `- registered: ${nowIso()}`,
     `- anchor: ${anchor}`,
+    ...lineage ? [`- lineage: ${lineage}`] : [],
     "",
     `## Declared plan (${subtasks.length})`,
     ...subtasks.map((s, i) => `${i + 1}. ${s.title}${s.agent ? ` → ${s.agent}` : ""}`),
@@ -15979,6 +16009,7 @@ function governingGoalFor(sessionID) {
 function crewPendingChoiceLines() {
   return [
     "[forge:crew] The crew is PENDING — execution has NOT started. Present the execution-mode choice to the user and END YOUR TURN (every task dispatch is refused while the crew pends):",
+    `RELAY FIRST: tell the user the crew record path (it leads this output) alongside this choice — the record is on disk from the registration moment, and the user must hear it.`,
     `  1. supervised waves NOW — when the user says go, call crew_begin {execution: "waves"} and run the wave discipline;`,
     `  2. convert to a goal contract — call crew_begin {execution: "goal"} (the crew ends as a conversion record; no extra dialog here), then draft goal_write with arm=true folding the declared subtasks into criteria/checks — the arm dialog is the user's gate;`,
     `  3. standby — no call; the crew waits until armed or abandoned.`
@@ -16283,28 +16314,40 @@ var planCloseTool = tool({
 Fix the implementation and retry, or revise the plan first.`);
     }
     await gate(context.ask, "plan_close", `Close plan: ${active.doc.goal}`);
-    writeFileSync5(active.path, transitionStatus(readFileSync8(active.path, "utf8"), "done", nowIso()));
+    const closedAt = nowIso();
+    const closed = appendTerminalSection(transitionStatus(readFileSync8(active.path, "utf8"), "done", closedAt), "closed", { reason: "completion gate passed (user confirmed)", checks: args.checks }, closedAt);
+    writeFileSync5(active.path, closed);
     context.metadata({ title: `Plan done: ${active.doc.goal}` });
     return {
       title: "plan done",
-      output: `Plan completed and closed (done): ${relFrom(state.worktree, active.path)}. All ${args.checks.length} self-checks passed.`
+      output: `Plan completed and closed (done): ${relFrom(state.worktree, active.path)}. All ${args.checks.length} self-checks passed. Terminal section "## ${closedAt} — closed" appended with the per-criterion verdicts.`
     };
   }
 });
 var planDiscardTool = tool({
-  description: "Abandon the session's active plan (draft/approved -> abandoned) and lift the draft write ban. Terminal: the file stays in .opencode/plan/ as history. Invoke via /plan discard or directly when the user cancels the task.",
+  description: "Abandon the session's active plan (draft/approved -> abandoned) and lift the draft write ban. Pass `supersede` (the successor artifact's path or identifier, e.g. a .opencode/crew/ or .opencode/goal/ file) when the work is not ending but moving to another harness (crew orchestration, a goal contract): the plan then becomes superseded instead of abandoned, with the successor recorded. Either way a dated terminal section carrying the reason verbatim (a missing reason lands as `reason: (none given)`) is appended to the file in the SAME write as the status flip, and the file stays in .opencode/plan/ as history. Invoke via /plan discard or directly when the user cancels the task.",
   args: {
-    reason: tool.schema.string().optional().describe("Short reason recorded in the reply")
+    reason: tool.schema.string().optional().describe("Short reason recorded in the reply and in the appended terminal section, verbatim"),
+    supersede: tool.schema.string().optional().describe("Successor artifact's path or identifier (crew record, goal contract, ...); when present the plan becomes superseded instead of abandoned and this value is persisted as the successor reference")
   },
-  execute: async (_args, context) => {
+  execute: async (args, context) => {
     const state = ensureSession(context.sessionID, worktreeFor(context));
     const active = resolveActivePlan(state);
     if (!active)
       throw new PlanError("No plan to abandon in this workspace.");
-    writeFileSync5(active.path, transitionStatus(readFileSync8(active.path, "utf8"), "abandoned", nowIso()));
+    const successor = (args.supersede ?? "").trim();
+    const superseding = successor.length > 0;
+    const target = superseding ? "superseded" : "abandoned";
+    const exitedAt = nowIso();
+    const next = appendTerminalSection(transitionStatus(readFileSync8(active.path, "utf8"), target, exitedAt), superseding ? "superseded" : "abandoned", { reason: args.reason, ...superseding ? { successor } : {} }, exitedAt);
+    writeFileSync5(active.path, next);
     state.planPath = undefined;
-    context.metadata({ title: `Plan abandoned: ${active.doc.goal}` });
-    return { title: "plan abandoned", output: `Plan abandoned: ${relFrom(state.worktree, active.path)}. Write operations are restored.` };
+    const section = `## ${exitedAt} — ${target}`;
+    context.metadata({ title: superseding ? `Plan superseded: ${active.doc.goal}` : `Plan abandoned: ${active.doc.goal}` });
+    return {
+      title: superseding ? "plan superseded" : "plan abandoned",
+      output: superseding ? `Plan superseded (not abandoned): ${relFrom(state.worktree, active.path)}. Terminal section "${section}" appended (successor: ${successor}). Write operations are restored.` : `Plan abandoned: ${relFrom(state.worktree, active.path)}. Terminal section "${section}" appended. Write operations are restored.`
+    };
   }
 });
 function goalDirOf(worktree) {
@@ -16826,7 +16869,7 @@ function crewOrchestrationTemplate(resolution) {
     "",
     "You are entering CREW ORCHESTRATION discipline for this session (single subject: do not switch agents). The macro contract above the crew may come from an approved plan, a spec change, or inline text — the discipline is identical in all three cases and never requires a plan. Follow it exactly:",
     "",
-    "1. REGISTER: call `crew_begin` with the objective AND the declared subtask plan (subtasks[]: one {title} per subtask, optionally naming the intended forge-* agent). Reconnaissance BEFORE registration is free (task calls included). If crew_begin refuses (a crew is already active here, or a plan draft is active), STOP and tell the user why — never start a second crew. A wrong plan is fixed by abandoning and re-crewing (crew_close {abandon: true, reason}), never by improvising outside the declared plan.",
+    '1. REGISTER: call `crew_begin` with the objective AND the declared subtask plan (subtasks[]: one {title} per subtask, optionally naming the intended forge-* agent). When the macro contract descends from a plan artifact, pass its path as the optional `lineage` argument (e.g. lineage: ".opencode/plan/2026-10-01-my-plan.md") — the descent is recorded as a first-class line in the crew record header; lineage is never inferred. Reconnaissance BEFORE registration is free (task calls included). If crew_begin refuses (a crew is already active here, or a plan draft is active), STOP and tell the user why — never start a second crew. A wrong plan is fixed by abandoning and re-crewing (crew_close {abandon: true, reason}), never by improvising outside the declared plan.',
     `2. THE PAUSE: registration enters a PENDING crew — execution has NOT started. STOP and present the user the three execution-mode choices (supervised waves now / convert to a goal contract / standby), then END YOUR TURN. Arm per the user's choice: waves → crew_begin {execution: "waves"}; conversion → crew_begin {execution: "goal"} followed by goal_write (arm=true — its dialog is the user's gate) folding the declared subtasks into criteria/checks; standby → no call. EXCEPTION: while a live active goal governs this session, register with execution: "waves" in the SAME call — the crew is born armed (the goal contract already authorized orchestration) and crew_close / abandon stay ask-free under that goal.`,
     "3. WAVES, NEVER FLOODS (armed crews only): execute subtasks in waves of parallel native `task` calls (subagent_type = the matching forge-* agent; a wave's results return within the calling turn). Launch the next wave ONLY after the previous wave's results are in. GUI / computer-use subtasks are mutually exclusive within a wave (the desktop is a singleton resource — at most ONE in flight; non-GUI subtasks still parallelize freely), and GUI walkthroughs use the `computer` tool rather than DIY shell screenshot pipelines.",
     "4. MISSING ROLE: when a subtask needs a role no configured forge-* agent matches, run that subtask through a native task call anyway AND tell the user about the gap — suggest configuring the missing role in forge.json.",
@@ -16844,14 +16887,15 @@ var crewBeginTool = tool({
     subtasks: tool.schema.array(tool.schema.object({
       title: tool.schema.string().describe("Short unique subtask title — the crew_close report must use these exact titles"),
       agent: tool.schema.string().optional().describe("Intended forge-* agent id for this subtask, when one matches")
-    })).describe("The declared subtask plan — decompose the objective into these before any execution; crew_close cross-checks the report against exactly this list")
+    })).describe("The declared subtask plan — decompose the objective into these before any execution; crew_close cross-checks the report against exactly this list"),
+    lineage: tool.schema.string().optional().describe("Free-text origin of the macro contract — e.g. the plan artifact path this crew descends from (.opencode/plan/<date>-<slug>.md). Recorded as a first-class lineage: line in the crew record header and disclosed in the registration output. Explicit argument only — never inferred from recently-terminal plans.")
   },
   execute: async (args, context) => {
     noteToolAgent(context);
     const state = stateForBan(context.sessionID);
     const active = state ? resolveActivePlan(state) : null;
     if (active && active.doc.status === "draft") {
-      throw new Error("[forge:crew] A plan is in draft; crew orchestration is denied during planning. Call plan_approve for user approval, or /plan discard to abandon the plan.");
+      throw new Error("[forge:crew] A plan is in draft; crew orchestration is denied during planning. Three exits: " + "plan_approve puts the plan to user approval (an APPROVED plan does not block /crew — only a draft does); " + "/plan discard abandons the plan outright; " + '/plan discard {supersede: "<successor path or id>"} moves the work into this crew (the plan becomes superseded, the successor recorded).');
     }
     const resolution = resolvePools();
     const hostIds = resolution ? Object.keys(resolution.agents) : [];
@@ -16953,13 +16997,14 @@ var crewBeginTool = tool({
       throw new Error('[forge:crew] execution:"goal" converts an already-registered PENDING crew — register the plan first (no execution), then convert. Under a governing goal, only "waves" one-call arming is legal (the loop already owns the goal).');
     }
     const governed = execution === "waves";
+    const lineage = String(args.lineage ?? "").trim();
     const anchorDir = anchor || hostWorktree;
     let recordPath = null;
     let recordNote = "";
     if (anchorDir) {
       try {
         recordPath = crewRecordPathFor(anchorDir, objectiveText);
-        writeCrewRecord(recordPath, objectiveText, anchorDir, subtasks);
+        writeCrewRecord(recordPath, objectiveText, anchorDir, subtasks, lineage || undefined);
         recordNote = `Crew record (inspectable history; NOT a resume mechanism): ${relFrom(anchorDir, recordPath)}`;
       } catch {
         recordPath = null;
@@ -16985,12 +17030,13 @@ var crewBeginTool = tool({
     if (families.length > 8)
       familyLines.push(`   - …and ${families.length - 8} more pools`);
     const lines = [
+      ...recordNote ? [recordNote] : [],
+      ...lineage ? [`Lineage: ${lineage}`] : [],
       governed ? `[forge:crew] Crew registered UNDER THE GOVERNING GOAL — born armed, never pends. Objective: ${objectiveText}` : `[forge:crew] Crew registered PENDING for this session (execution has NOT started). Objective: ${objectiveText}`,
       `Declared plan (${subtasks.length}):`,
       ...subtasks.map((s, i) => `  ${i + 1}. ${s.title}${s.agent ? ` → ${s.agent}` : ""}`),
       `Dispatchable roster origin — ${families.length} pool${families.length === 1 ? "" : "s"} across the host anchor set${hostAnchors.length > 0 ? ` (anchors: ${hostAnchors.join(", ")})` : ""}:`,
       ...familyLines,
-      ...recordNote ? [recordNote] : [],
       ...disclosure ? [disclosure] : []
     ];
     if (governed) {
@@ -17553,6 +17599,9 @@ var server = async (input, options) => {
           if (isForgeFamilyAgent(speaker) && (input2.tool === "shell" || input2.tool === "bash") && !jobsKeepBuiltinShell && jobStage() < 2) {
             throw new Error(`[forge:partition] Builtin shell refused: the forge family executes through forge_shell (jobs.keepBuiltinShell or jobs.mode: "native" restores the builtin shell). Re-issue the command through forge_shell.`);
           }
+          if (isForgeFamilyAgent(speaker) && speaker.toLowerCase() !== FORGE_AGENT && FORGE_STATE_TOOL_SET.has(input2.tool)) {
+            throw new Error(`[forge:partition] Tool refused: "${input2.tool}" is a harness state tool reserved for the primary forge agent; "${speaker}" is a forge worker. Report your findings back to the orchestrating session — the primary agent calls ${input2.tool} at the gate.`);
+          }
         }
       }
     },

package/package.json

@@ -1,64 +1,64 @@
-{
-  "name": "@sorenllm/opencode-forge",
-  "version": "0.13.0",
-  "description": "Single general-purpose forge agent for opencode: static worker subagents defined in forge.json (pinned model + thoughtLevel pair, or an Auto worker inheriting the parent model; dispatched through the native task tool — TUI-visible), a plan harness (file-backed plans with approve/close confirmation gates and a hard draft write-ban), a goal harness (autonomous, host-verified objectives), a /crew orchestration command (declared-plan waves with an evidence-checked close gate), a job supervisor (forge_shell with exit-bound completion, idle/success early return, background jobs with poll/log/kill/handoff), and a builtin-shell hang watchdog.",
-  "type": "module",
-  "main": "./dist/index.js",
-  "exports": {
-    ".": {
-      "import": "./dist/index.js"
-    },
-    "./server": {
-      "import": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "bundle": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && bun build ./plugin.ts --outfile ./dist/index.js --target node --format esm",
-    "test": "node --test tests/*.test.mjs",
-    "typecheck": "tsc --noEmit"
-  },
-  "keywords": [
-    "opencode",
-    "opencode-plugin",
-    "subagents",
-    "plan",
-    "planning",
-    "workflow",
-    "single-agent",
-    "goal",
-    "crew",
-    "orchestration",
-    "background-jobs",
-    "shell",
-    "watchdog"
-  ],
-  "license": "MIT",
-  "author": "chengsongren",
-  "homepage": "https://github.com/ChengZiiii/opencode-forge#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ChengZiiii/opencode-forge.git"
-  },
-  "bugs": {
-    "url": "https://github.com/ChengZiiii/opencode-forge/issues"
-  },
-  "peerDependencies": {
-    "@opencode-ai/plugin": "^1.18.0"
-  },
-  "devDependencies": {
-    "@opencode-ai/plugin": "^1.18.0",
-    "@types/node": "^22.13.9",
-    "typescript": "^5.8.2"
-  },
-  "engines": {
-    "opencode": "^1.18.0"
-  },
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org/"
-  }
-}
+{
+  "name": "@sorenllm/opencode-forge",
+  "version": "0.14.1",
+  "description": "Single general-purpose forge agent for opencode: static worker subagents defined in forge.json (pinned model + thoughtLevel pair, or an Auto worker inheriting the parent model; dispatched through the native task tool — TUI-visible), a plan harness (file-backed plans with approve/close confirmation gates and a hard draft write-ban), a goal harness (autonomous, host-verified objectives), a /crew orchestration command (declared-plan waves with an evidence-checked close gate), a job supervisor (forge_shell with exit-bound completion, idle/success early return, background jobs with poll/log/kill/handoff), and a builtin-shell hang watchdog.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "bundle": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && bun build ./plugin.ts --outfile ./dist/index.js --target node --format esm",
+    "test": "node --test tests/*.test.mjs",
+    "typecheck": "tsc --noEmit"
+  },
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "subagents",
+    "plan",
+    "planning",
+    "workflow",
+    "single-agent",
+    "goal",
+    "crew",
+    "orchestration",
+    "background-jobs",
+    "shell",
+    "watchdog"
+  ],
+  "license": "MIT",
+  "author": "chengsongren",
+  "homepage": "https://github.com/ChengZiiii/opencode-forge#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ChengZiiii/opencode-forge.git"
+  },
+  "bugs": {
+    "url": "https://github.com/ChengZiiii/opencode-forge/issues"
+  },
+  "peerDependencies": {
+    "@opencode-ai/plugin": "^1.18.0"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "^1.18.0",
+    "@types/node": "^22.13.9",
+    "typescript": "^5.8.2"
+  },
+  "engines": {
+    "opencode": "^1.18.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}