@sorenllm/opencode-forge 0.14.0 → 0.15.0

package/README.md

@@ -43,11 +43,13 @@ OpenSpec spec workflows remain a third, separate lane.
   counts read the Task List only — and a superseded plan's Task List
   stays the frozen decision snapshot: closure IS the supersession, and
   crew/goal results never tick it.
-- While a plan is in draft, `write` / `edit` / `bash` / `task` are **denied
-  at the permission layer** — including your own `allow` config, and for
-  every agent in that session (the draft protects shared session state; see
-  Agent partition below). The only exits are approval and discard. This is
-  deliberate; see Design stance.
+- While a plan is in draft, `write` / `edit` / `bash` are **denied at the
+  permission layer** — including your own `allow` config, and for every agent
+  in that session (the draft protects shared session state; see Agent
+  partition below) — and `task` is **shape-gated**: dispatch to an
+  effective-readonly forge scout passes, every other target is denied (see
+  Design stance). The only exits are approval and discard. This is deliberate;
+  see Design stance.
 - `plan_approve` / `plan_close` are pinned to a confirmation dialog: the
   model can never flip the state itself.
 - Goal files: `.opencode/goal/<date>-<slug>.md`, state machine
@@ -80,7 +82,17 @@ entirely (the hide is withdrawn in the same stroke). The forge family is
 prompted to route every shell command through `forge_shell` — on hosts that
 ignore injected tools maps the builtin tool stays visible but is refused at
 call time, and the channel mandate is what keeps the model from trying it
-first (the belt refusal remains the backstop). Mixed sessions (Tab
+first (the belt refusal remains the backstop). On such unfiltered hosts the
+fallback belt family is a three-part enumeration of hard refusals at the
+tool layer: a forge-family builtin `shell`/`bash` call is refused with a
+pointer to `forge_shell`; a non-forge agent's call of any forge tool is
+refused with the partition guidance; and a `forge-*` worker (any family
+member whose agent name is not exactly `forge`) calling a harness state tool
+(`plan_*`, `goal_*`, `crew_begin`, `crew_close`) is refused as primary-only.
+That refusal fires before any execution or user confirmation dialog, so a
+worker's state-tool call never reaches a gate, and the error names the way
+out: report findings back to the orchestrating session — the primary forge
+agent alone calls the state tools. Mixed sessions (Tab
 between agents in one session): harness state (plans/goals) stays
 session-bound, tool surfaces follow the current speaker, and the goal loop
 parks instead of driving a non-forge turn. One deliberate exception: a
@@ -488,7 +500,7 @@ out of a materialized id.
     // PINNED worker: model + thoughtLevel form an ATOMIC PAIR — set BOTH
     "research": {
       "model": "zai-coding-plan/glm-5.3", // exact "provider/model" string
-      "thoughtLevel": "low",              // none/low/medium/high/max or a native level name
+      "thoughtLevel": "low",              // none/minimal/low/medium/high/xhigh/max, or any word — write lowercase
       // "prompt": "short role description — explicit prompts fully override the built-ins (only research/review ids have them; any other id without a prompt gets a generic one-liner)",
       // "shape": "write",   // default readonly denies write/edit/bash
       // "permission": { "bash": "deny" } // optional override; "task" is ALWAYS denied
@@ -562,8 +574,10 @@ Say "dispatch a subagent..." in a forge session and the model picks from the
 task tool vocabulary: a configured `forge-*` agent whose description matches
 runs on its pinned brain; if none matches, forge is instructed to say so
 plainly and fall back to the native task channel. During a plan draft the
-native `task` tool is already denied by the plan harness — no plugin-side
-rule needed.
+`task` tool is gated by the dispatch target's effective readonly shape:
+readonly scout dispatch passes as reconnaissance (breadth evidence without
+burning the planning session's context), write-shaped workers and native
+agents are denied with the dispatchable roster and the two exits.
 
 **Known pitfall — keyless endpoints × readonly agents**: free/keyless
 providers can return a deterministic EMPTY response for any toolset-reduced
@@ -573,18 +587,42 @@ attributable task failure; the mitigation is unchanged — use
 
 ### The thoughtLevel word
 
-One word per agent: the canonical `none | low | medium | high | max`, or the
-model's native level name verbatim (e.g. Qwen's `XHigh`). Injection rides the
-`chat.params` hook keyed by agent name, translated per provider family:
-effort-style (OpenAI-compatible) receives `reasoningEffort = <word>`;
-budget-style (Anthropic-style) receives a published thinking tier
-(`low → 8192`, `medium → 16384`, `high → 24576`, `max → 32768`,
-`none → off`); toggle-style (zai/GLM) receives thinking on/off. Rules:
-verbatim-first, no interpolation, unknown family injects nothing. A word the
-model does not natively offer injects NOTHING and records one finding naming
-both vocabularies — the session is never broken by a config word. A
-session's depth is frozen at its first request (editing forge.json
-mid-session never rewrites a running session).
+One word per agent: the canonical seven-word dictionary
+`none | minimal | low | medium | high | xhigh | max`, or any native level
+name. **Write lowercase**: the value is normalized at the config boundary
+(trimmed and lowercased), so `High` and `XHigh` behave exactly as `high` and
+`xhigh`; normalization that changes what you wrote records one warn finding.
+Native casing on the wire is the catalog's business, never yours. Injection
+rides the `chat.params` hook keyed by agent name. The wire shape comes from
+data, not guessing: a model the models.dev catalog knows by
+`reasoning_options` is translated per that catalog shape (effort word list /
+toggle / token budget); a catalog-silent model falls back to the
+provider-prefix family; a provider absent from both is treated as an effort
+**word channel** by default (custom relays and unknown endpoints — the most
+universal shape). Adaptive-era Anthropic models (major > 4 or 4.7+) receive
+the effort word directly instead of a budget number, on the empirically
+verified `effort` option key (the host transports it as the adaptive-era
+native `output_config: {effort: <word>}` wire shape; a `reasoningEffort`
+key is silently dropped by anthropic transports). **The dictionary is a
+dictionary, never a whitelist**: a word matching neither the dictionary nor
+the model's ladder passes through VERBATIM on word-shaped channels
+(`reasoningEffort = <word>`, or `effort = <word>` on the adaptive channel),
+disclosed as unverified — the provider is the
+final judge, and a provider-side rejection surfaces as the request's own
+error. Ladder matching is case-insensitive and emits the catalog's native
+casing (`xhigh` in, `XHigh` out when the catalog says so). **The only dead
+ends are the two shapes with no word channel**: budget-style (legacy
+Anthropic-style) models have a published thinking tier instead
+(`minimal → 1024` — the Anthropic API hard floor, the only cross-project
+consensus number; `low → 8192`, `medium → 16384`, `high → 24576`,
+`xhigh → 28672` — a half step between high and max; `max → 32768`;
+`none → off`. **This tier table is this plugin's selection — there is no
+community-standard tier table**), and pure toggle endpoints (zai/GLM: a level
+word has no toggle counterpart) — there the plugin injects nothing and
+records one bounded finding naming both vocabularies. No interpolation
+anywhere; the session is never broken by a config word. A session's depth is
+frozen at its first request (editing forge.json mid-session never rewrites a
+running session).
 
 ## Crew workflow (`/crew`)
 
@@ -752,6 +790,28 @@ read/grep/glob; if you genuinely need a shell command to decide the plan,
 approve the plan first (revising after approval is allowed via a new `/plan`).
 The escape hatches are `plan_approve` and `/plan discard`, by design.
 
+One carve-out, keyed on the target rather than the tool: during a draft the
+`task` tool is gated by the dispatch target's **effective readonly shape**. A
+dispatch to a forge worker whose shape is not `write` AND whose permission
+overrides do not lift `write`/`edit`/`bash` off `deny` (`ask` counts as
+lifted — fail-closed) passes as a reconnaissance dispatch: readonly scouts
+may be spawned both before and during the draft, so breadth
+evidence-gathering does not burn the planning session's context. Every other
+target — write-shaped workers, native agents, absent or unresolvable targets
+(including resume calls that carry no target) — is denied like any write-class
+tool. The refusal names the currently dispatchable effective-readonly roster,
+points to defining a readonly worker in forge.json when the roster is empty
+(an unconfigured host stays fully denied — same behavior as before, just more
+actionable wording), and names the two exits (`plan_approve`, `/plan
+discard`). Invariant strength is unchanged: the scout's materialized
+permission hard-denies write/edit/bash (and `task`, always — no chained
+spawning), the scout's own session is ambient-bound to the same draft write
+ban, and its `forge_shell` calls ride the same per-call ask gate the primary
+agent faces. The `permission.ask` belt does not follow the exemption: on a
+host configured with `task: "ask"` a draft-phase dispatch is still denied
+(fail-closed degradation by design — the side belt does not resolve target
+shapes).
+
 Separately, the builtin shell is hidden on the forge agent on purpose —
 `forge_shell` is the exec surface there (see Agent partition and the job
 supervisor chapter above). The hide is unconditional: it covers a

package/dist/index.js

@@ -14877,7 +14877,7 @@ function parseIdentity(identity) {
     return null;
   return { provider: identity.slice(0, slash), model: identity.slice(slash + 1) };
 }
-function nativeLadder(catalog, identity) {
+function modelDepthShape(catalog, identity) {
   if (!catalog)
     return null;
   const parsed = parseIdentity(identity);
@@ -14886,8 +14886,13 @@ function nativeLadder(catalog, identity) {
   const entry = catalog.providers?.[parsed.provider]?.models?.[parsed.model];
   if (!entry)
     return null;
-  const options = entry.reasoningOptions;
-  return Array.isArray(options) ? [...options] : null;
+  if (entry.reasoningShape === "toggle")
+    return { shape: "toggle" };
+  if (entry.reasoningShape === "budget_tokens")
+    return { shape: "budget_tokens" };
+  if (entry.reasoningShape === "effort")
+    return { shape: "effort", ladder: entry.reasoningOptions ? [...entry.reasoningOptions] : [] };
+  return null;
 }
 function modelsDevCacheDir(base) {
   return join5(base ?? join5(tmpdir2(), "opencode-forge"), "models-dev");
@@ -14906,6 +14911,16 @@ function namedLevels(rows) {
   }
   return out;
 }
+function shapeOf(rows) {
+  for (const r of rows) {
+    if (r && typeof r === "object") {
+      const t = r.type;
+      if (t === "effort" || t === "toggle" || t === "budget_tokens")
+        return t;
+    }
+  }
+  return;
+}
 function reduceModelsDev(raw) {
   const catalog = { providers: {} };
   const providers = raw?.constructor === Object ? raw : null;
@@ -14918,10 +14933,13 @@ function reduceModelsDev(raw) {
     const out = { models: {} };
     for (const [modelID, model] of Object.entries(models)) {
       const m = model;
-      const options = Array.isArray(m.reasoning_options) ? namedLevels(m.reasoning_options) : undefined;
+      const rows = Array.isArray(m.reasoning_options) ? m.reasoning_options : undefined;
+      const shape = rows !== undefined ? shapeOf(rows) : undefined;
+      const options = rows !== undefined && shape === "effort" ? namedLevels(rows) : undefined;
       const cost = m.cost && typeof m.cost === "object" ? m.cost : undefined;
       out.models[modelID] = {
-        ...options ? { reasoningOptions: options } : {},
+        ...shape !== undefined ? { reasoningShape: shape } : {},
+        ...options && options.length > 0 ? { reasoningOptions: options } : {},
         ...cost ? { cost } : {}
       };
     }
@@ -15063,71 +15081,97 @@ function forgeAgentDef(agentId, def) {
     entry.model = def.model;
   return entry;
 }
+function effectiveReadonlyShape(def) {
+  if (def.shape === "write")
+    return false;
+  const perm = def.permission ?? {};
+  for (const t of MUTATING_TOOLS) {
+    const v = perm[t];
+    if (v !== undefined && v !== "deny")
+      return false;
+  }
+  return true;
+}
 
 // src/dispatch-depth.ts
-var META_DEPTHS = ["none", "low", "medium", "high", "max"];
+var META_DEPTHS = ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
 var BUDGET_TIERS = {
+  minimal: 1024,
   low: 8192,
   medium: 16384,
   high: 24576,
+  xhigh: 28672,
   max: 32768
 };
-function noMapping(depth, family, nativeVocabulary, metaAvailable) {
+function noMapping(depth, channel, shapeVocabulary) {
   return {
     kind: "no-mapping",
-    family,
-    message: `depth "${depth}" has no native counterpart on this model — the plugin never interpolates. Native levels: ${nativeVocabulary.join(", ") || "(none named)"}. Meta words this model accepts: ${metaAvailable.join(", ") || "(none)"}.`,
-    nativeVocabulary,
-    metaAvailable
+    channel,
+    message: `depth "${depth}" has no channel on this shape (${channel} — the endpoint cannot express it). Shape vocabulary: ${shapeVocabulary.join(", ") || "(none)"}. Dictionary words: ${META_DEPTHS.join(", ")}. The plugin never interpolates; fix the pinned thoughtLevel or the model's wire shape.`,
+    shapeVocabulary,
+    dictionary: [...META_DEPTHS]
   };
 }
-function translateDepth(depth, family, ladder) {
-  if (family === "unknown") {
-    return { kind: "not-injected", family, disclose: "not injected (unknown provider shape)" };
-  }
-  if (family === "anthropic") {
-    if (depth === "none")
-      return { kind: "off", family, disclose: "canonical none → native thinking:off" };
-    const budget = BUDGET_TIERS[depth];
-    if (budget !== undefined) {
-      return { kind: "tiered", family, budgetTokens: budget, disclose: `canonical ${depth} → native thinking budget:${budget}` };
-    }
-    return noMapping(depth, family, [], [...META_DEPTHS]);
-  }
-  if (family === "zai") {
-    if (depth === "none")
-      return { kind: "off", family, disclose: "canonical none → native thinking:off" };
-    if (META_DEPTHS.includes(depth)) {
-      return { kind: "toggle-on", family, disclose: `canonical ${depth} → native thinking:on (this provider shape takes a toggle, not a level)` };
+function ladderWord(ladder, depth) {
+  if (ladder === null)
+    return null;
+  for (const w of ladder)
+    if (w.toLowerCase() === depth)
+      return w;
+  return null;
+}
+function translateDepth(depth, channel) {
+  const d = depth.trim().toLowerCase();
+  if (channel.kind === "effort" || channel.kind === "adaptive-effort") {
+    const native = channel.kind === "effort" ? ladderWord(channel.ladder, d) : null;
+    if (native !== null) {
+      return {
+        kind: "verbatim",
+        channel: channel.kind,
+        word: native,
+        confirmed: true,
+        disclose: `canonical ${d} → native "${native}" (catalog-confirmed)`
+      };
     }
-    return noMapping(depth, family, ["thinking on/off"], [...META_DEPTHS]);
+    const why = channel.kind === "effort" && channel.ladder !== null ? `catalog ladder does not list "${d}"` : "no catalog ladder for this endpoint";
+    return {
+      kind: "verbatim",
+      channel: channel.kind,
+      word: d,
+      confirmed: false,
+      disclose: `verbatim (unverified — ${why}; the provider judges)`
+    };
   }
-  const native = ladder ?? null;
-  if (native !== null && native.includes(depth)) {
-    return { kind: "verbatim", family: "openai", word: depth, disclose: META_DEPTHS.includes(depth) ? "verbatim" : `verbatim (native word "${depth}")` };
+  if (channel.kind === "toggle") {
+    if (d === "none")
+      return { kind: "off", channel: "toggle", disclose: "canonical none → native thinking:off" };
+    return noMapping(d, "toggle", ["none (thinking on/off only)"]);
   }
-  if (native !== null && native.length > 0 && META_DEPTHS.includes(depth)) {
-    return noMapping(depth, family, native, META_DEPTHS.filter((w) => native.includes(w)));
+  if (d === "none")
+    return { kind: "off", channel: "budget", disclose: "canonical none → native thinking:off" };
+  const budget = BUDGET_TIERS[d];
+  if (budget !== undefined) {
+    return { kind: "tiered", channel: "budget", budgetTokens: budget, disclose: `canonical ${d} → native thinking budget:${budget}` };
   }
-  return { kind: "verbatim", family: "openai", word: depth, disclose: `verbatim (unverified — ${native === null ? "catalog does not know this model" : `catalog ladder does not list "${depth}"`}; the provider judges)` };
+  return noMapping(d, "budget", ["none", ...Object.keys(BUDGET_TIERS)]);
 }
 function applyDepthTranslation(options, t) {
   if (t.kind === "verbatim") {
-    options.reasoningEffort = t.word;
+    if (t.channel === "adaptive-effort") {
+      options.effort = t.word;
+    } else {
+      options.reasoningEffort = t.word;
+    }
   } else if (t.kind === "tiered") {
     options.thinking = { type: "enabled", budget_tokens: t.budgetTokens };
   } else if (t.kind === "off") {
     options.thinking = { type: "disabled" };
-  } else if (t.kind === "toggle-on") {
-    options.thinking = { type: "enabled" };
   }
 }
-function resolvePinnedDepth(thoughtLevel, family, ladder) {
-  const t = translateDepth(thoughtLevel, family, ladder);
+function resolvePinnedDepth(thoughtLevel, channel) {
+  const t = translateDepth(thoughtLevel, channel);
   if (t.kind === "no-mapping")
     return { translation: null, findingMessage: t.message };
-  if (t.kind === "not-injected")
-    return { translation: null };
   return { translation: t };
 }
 
@@ -15420,6 +15464,11 @@ function validateAgentSet(raw) {
     if (entry.thoughtLevel !== undefined) {
       if (nonEmptyString(entry.thoughtLevel)) {
         thoughtLevel = entry.thoughtLevel.trim();
+        const normalized = thoughtLevel.toLowerCase();
+        if (normalized !== thoughtLevel) {
+          findings.push({ level: "warn", code: "thoughtlevel-normalized", message: `${label}.thoughtLevel "${thoughtLevel}" normalized to "${normalized}" (config is lowercase; the catalog decides wire casing)` });
+        }
+        thoughtLevel = normalized;
       } else {
         findings.push({ level: "warn", code: "thoughtlevel-invalid", message: `${label}.thoughtLevel must be a non-empty string — field ignored (counts as absent for the model/thoughtLevel pair)` });
       }
@@ -15824,6 +15873,7 @@ var FORGE_STATE_TOOLS = [
 var FORGE_EXEC_TOOLS = ["forge_shell", "forge_jobs"];
 var FORGE_ALL_TOOLS = [...FORGE_STATE_TOOLS, ...FORGE_EXEC_TOOLS];
 var FORGE_TOOL_SET = new Set(FORGE_ALL_TOOLS);
+var FORGE_STATE_TOOL_SET = new Set(FORGE_STATE_TOOLS);
 var NATIVE_PARTITION_FALLBACKS = ["build", "plan", "general", "explore"];
 var FORGE_PROMPT = `You are forge — the single general-purpose coding agent. You handle every task directly: exploration, planning, implementation, and verification. There is no agent switching.
 
@@ -15854,7 +15904,7 @@ var PLAN_COMMAND_TEMPLATE = [
   "",
   "Plans are short-horizon, single-task-goal documents (.opencode/plan/<date>-<slug>.md). The harness enforces the hard parts (draft write-ban, approval/close dialogs); you supply the engineering judgment. Never edit or create plan files by hand — every change goes through the plan_* tools.",
   "",
-  "1. Reconnaissance and alignment (read-only): explore with read/grep/glob only — all write tools, bash, and subagents are DENIED while a draft exists; do not attempt them, do not ask the user to bypass. Gather concrete evidence with file:line references (verified findings, not guesses). If the goal is ambiguous or leaves meaningful choices open (scope, approach, acceptance), settle them with the user FIRST — 1-3 focused questions — and only write the draft once the shape is agreed; never plan against assumptions the user could settle in one line.",
+  "1. Reconnaissance and alignment (read-only): explore with read/grep/glob, and dispatch readonly-shape forge scouts (task tool) for breadth evidence — reconnaissance dispatch to effective-readonly workers keeps this session's context lean and is allowed both BEFORE and DURING the draft. All write tools and bash are DENIED while a draft exists, and so is dispatching write-shaped workers or native agents; do not attempt them, do not ask the user to bypass. Gather concrete evidence with file:line references (verified findings, not guesses). If the goal is ambiguous or leaves meaningful choices open (scope, approach, acceptance), settle them with the user FIRST — 1-3 focused questions — and only write the draft once the shape is agreed; never plan against assumptions the user could settle in one line.",
   "2. Draft (plan_write): call plan_write with structured fields; the tool renders and validates the fixed sections, so a malformed plan cannot exist. Quality bar: goal = one line, the outcome not the activity; context = verified findings with file:line evidence, including what you ruled out and why; approach = the chosen approach AND at least one rejected alternative with the reason (a plan with no considered alternative is a guess); tasks = 3-8 concrete, independently verifiable steps, each doable in one sitting ('improve the code' is invalid; 'extract the timeout constant into config.ts and default it to 3000' is valid); risks = what could break, blast radius, rollback path; acceptance = criteria verifiable by a command, a file, or an observable behavior (vague criteria will fail the close); nonGoals = explicit out-of-scope items. To revise after feedback, call plan_write again — while in draft it overwrites the same file.",
   `3. User review, then approval (plan_approve): after plan_write, present the plan in chat — goal, chosen approach with one line why, the numbered task list, the acceptance criteria — then STOP: end your turn and wait. The user owns the review, at their own pace: feedback → revise with plan_write, re-present, and wait again; rejection → /plan discard (or re-plan together); explicit go-ahead (e.g. "execute", "批准", "looks good") → call plan_approve — its confirmation dialog is the final hard gate, and the user's Allow starts execution. Never call plan_approve in the same turn that presents a draft, and never implement before approval succeeds.`,
   "4. Execution (tick as you go): work tasks in order; call plan_tick with the task number immediately after EACH task's work is actually done — never batch ticks, never tick ahead of reality (tick timestamps are an audit trail). If the plan turns out wrong mid-execution, do not silently improvise: tell the user what changed and either finish the affected task or ask about revising (/plan with the same goal re-enters planning).",
@@ -16031,6 +16081,34 @@ function dispatchProviderFamily(providerID) {
     return "zai";
   return null;
 }
+function isAdaptiveAnthropic(modelID) {
+  const id = modelID.toLowerCase();
+  const m = /^claude-(?:(?:opus|sonnet|haiku)[-.])?(\d+)(?:[.-](\d+))?/.exec(id);
+  if (!m)
+    return false;
+  const major = Number(m[1]);
+  const minor = m[2] !== undefined ? Number(m[2]) : 0;
+  return major > 4 || major === 4 && minor >= 7;
+}
+function resolveDepthChannel(providerID, modelID) {
+  const shape = modelDepthShape(modelsDevCatalog, `${providerID}/${modelID}`);
+  if (shape) {
+    if (shape.shape === "effort")
+      return { kind: "effort", ladder: shape.ladder };
+    if (shape.shape === "toggle")
+      return { kind: "toggle" };
+    return { kind: "budget" };
+  }
+  const family = dispatchProviderFamily(providerID);
+  if (family === "openai")
+    return { kind: "effort", ladder: null };
+  if (family === "zai")
+    return { kind: "toggle" };
+  if (family === "anthropic") {
+    return isAdaptiveAnthropic(modelID) ? { kind: "adaptive-effort" } : { kind: "budget" };
+  }
+  return { kind: "effort", ladder: null };
+}
 var jobsMode = "auto";
 var jobsKeepBuiltinShell = false;
 var jobsSurviveMode = "never";
@@ -17586,7 +17664,25 @@ var server = async (input, options) => {
         const state = stateForBan(input2.sessionID);
         const active = state ? resolveActivePlan(state) : null;
         if (active && active.doc.status === "draft") {
-          throw new Error(`[forge] A plan is in draft; write operations are denied (${input2.tool}). Switch back to the forge agent to present it and complete plan approval (plan_approve), or run /plan discard to abandon the plan.`);
+          if (input2.tool === "task") {
+            const a = output?.args ?? {};
+            const target = typeof a.subagent_type === "string" ? a.subagent_type : typeof a.agent === "string" ? a.agent : undefined;
+            const agentId = target !== undefined && target.toLowerCase().startsWith("forge-") ? target.slice("forge-".length) : undefined;
+            const def = agentId !== undefined ? resolvePools()?.agents[agentId]?.def : undefined;
+            if (def !== undefined && effectiveReadonlyShape(def)) {} else {
+              const roster = [];
+              const pools = resolvePools();
+              if (pools) {
+                for (const [id, entry] of Object.entries(pools.agents))
+                  if (effectiveReadonlyShape(entry.def))
+                    roster.push(`forge-${id}`);
+              }
+              roster.sort();
+              throw new Error(`[forge] A plan is in draft; dispatch is denied for this target. ` + (roster.length > 0 ? `Readonly recon scouts ARE dispatchable during draft: ${roster.join(", ")}. ` : `No readonly worker is configured — define one in forge.json (shape defaults to readonly) to enable draft-phase reconnaissance. `) + `Write-shaped workers and native agents wait for approval (plan_approve); /plan discard to abandon the plan.`);
+            }
+          } else {
+            throw new Error(`[forge] A plan is in draft; write operations are denied (${input2.tool}). Switch back to the forge agent to present it and complete plan approval (plan_approve), or run /plan discard to abandon the plan.`);
+          }
         }
       }
       if (input2.sessionID && typeof input2.tool === "string") {
@@ -17598,6 +17694,9 @@ var server = async (input, options) => {
           if (isForgeFamilyAgent(speaker) && (input2.tool === "shell" || input2.tool === "bash") && !jobsKeepBuiltinShell && jobStage() < 2) {
             throw new Error(`[forge:partition] Builtin shell refused: the forge family executes through forge_shell (jobs.keepBuiltinShell or jobs.mode: "native" restores the builtin shell). Re-issue the command through forge_shell.`);
           }
+          if (isForgeFamilyAgent(speaker) && speaker.toLowerCase() !== FORGE_AGENT && FORGE_STATE_TOOL_SET.has(input2.tool)) {
+            throw new Error(`[forge:partition] Tool refused: "${input2.tool}" is a harness state tool reserved for the primary forge agent; "${speaker}" is a forge worker. Report your findings back to the orchestrating session — the primary agent calls ${input2.tool} at the gate.`);
+          }
         }
       }
     },
@@ -17635,10 +17734,8 @@ var server = async (input, options) => {
         return;
       const providerID = typeof raw.model?.providerID === "string" ? raw.model.providerID : "";
       const modelID = typeof raw.model?.modelID === "string" ? raw.model.modelID : "";
-      const family = dispatchProviderFamily(providerID);
-      if (!family)
-        return;
-      const { translation, findingMessage } = resolvePinnedDepth(def.thoughtLevel, family, nativeLadder(modelsDevCatalog, `${providerID}/${modelID}`));
+      const channel = resolveDepthChannel(providerID, modelID);
+      const { translation, findingMessage } = resolvePinnedDepth(def.thoughtLevel, channel);
       if (!translation) {
         if (findingMessage && !depthFindingNotes.has(agentId)) {
           depthFindingNotes.set(agentId, findingMessage);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sorenllm/opencode-forge",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Single general-purpose forge agent for opencode: static worker subagents defined in forge.json (pinned model + thoughtLevel pair, or an Auto worker inheriting the parent model; dispatched through the native task tool — TUI-visible), a plan harness (file-backed plans with approve/close confirmation gates and a hard draft write-ban), a goal harness (autonomous, host-verified objectives), a /crew orchestration command (declared-plan waves with an evidence-checked close gate), a job supervisor (forge_shell with exit-bound completion, idle/success early return, background jobs with poll/log/kill/handoff), and a builtin-shell hang watchdog.",
   "type": "module",
   "main": "./dist/index.js",