@sorenllm/opencode-forge 0.14.0 → 0.14.1

package/README.md

@@ -80,7 +80,17 @@ entirely (the hide is withdrawn in the same stroke). The forge family is
 prompted to route every shell command through `forge_shell` — on hosts that
 ignore injected tools maps the builtin tool stays visible but is refused at
 call time, and the channel mandate is what keeps the model from trying it
-first (the belt refusal remains the backstop). Mixed sessions (Tab
+first (the belt refusal remains the backstop). On such unfiltered hosts the
+fallback belt family is a three-part enumeration of hard refusals at the
+tool layer: a forge-family builtin `shell`/`bash` call is refused with a
+pointer to `forge_shell`; a non-forge agent's call of any forge tool is
+refused with the partition guidance; and a `forge-*` worker (any family
+member whose agent name is not exactly `forge`) calling a harness state tool
+(`plan_*`, `goal_*`, `crew_begin`, `crew_close`) is refused as primary-only.
+That refusal fires before any execution or user confirmation dialog, so a
+worker's state-tool call never reaches a gate, and the error names the way
+out: report findings back to the orchestrating session — the primary forge
+agent alone calls the state tools. Mixed sessions (Tab
 between agents in one session): harness state (plans/goals) stays
 session-bound, tool surfaces follow the current speaker, and the goal loop
 parks instead of driving a non-forge turn. One deliberate exception: a

package/dist/index.js

@@ -15824,6 +15824,7 @@ var FORGE_STATE_TOOLS = [
 var FORGE_EXEC_TOOLS = ["forge_shell", "forge_jobs"];
 var FORGE_ALL_TOOLS = [...FORGE_STATE_TOOLS, ...FORGE_EXEC_TOOLS];
 var FORGE_TOOL_SET = new Set(FORGE_ALL_TOOLS);
+var FORGE_STATE_TOOL_SET = new Set(FORGE_STATE_TOOLS);
 var NATIVE_PARTITION_FALLBACKS = ["build", "plan", "general", "explore"];
 var FORGE_PROMPT = `You are forge — the single general-purpose coding agent. You handle every task directly: exploration, planning, implementation, and verification. There is no agent switching.
 
@@ -17598,6 +17599,9 @@ var server = async (input, options) => {
           if (isForgeFamilyAgent(speaker) && (input2.tool === "shell" || input2.tool === "bash") && !jobsKeepBuiltinShell && jobStage() < 2) {
             throw new Error(`[forge:partition] Builtin shell refused: the forge family executes through forge_shell (jobs.keepBuiltinShell or jobs.mode: "native" restores the builtin shell). Re-issue the command through forge_shell.`);
           }
+          if (isForgeFamilyAgent(speaker) && speaker.toLowerCase() !== FORGE_AGENT && FORGE_STATE_TOOL_SET.has(input2.tool)) {
+            throw new Error(`[forge:partition] Tool refused: "${input2.tool}" is a harness state tool reserved for the primary forge agent; "${speaker}" is a forge worker. Report your findings back to the orchestrating session — the primary agent calls ${input2.tool} at the gate.`);
+          }
         }
       }
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sorenllm/opencode-forge",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Single general-purpose forge agent for opencode: static worker subagents defined in forge.json (pinned model + thoughtLevel pair, or an Auto worker inheriting the parent model; dispatched through the native task tool — TUI-visible), a plan harness (file-backed plans with approve/close confirmation gates and a hard draft write-ban), a goal harness (autonomous, host-verified objectives), a /crew orchestration command (declared-plan waves with an evidence-checked close gate), a job supervisor (forge_shell with exit-bound completion, idle/success early return, background jobs with poll/log/kill/handoff), and a builtin-shell hang watchdog.",
   "type": "module",
   "main": "./dist/index.js",