@weave_protocol/adapter-opencode 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,88 @@
-# Temporary Holding Version
+# 🛡️ @weave_protocol/adapter-opencode
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> Enforce [WARD.md](https://github.com/Tyox-all/Weave_Protocol/tree/main/ward) in **OpenCode** with a plugin. Every tool call is checked against your policy before it runs, whichever model you're using: Claude, GPT, Gemini, DeepSeek, Kimi, Qwen or a local one.
+
+[![npm](https://img.shields.io/npm/v/@weave_protocol/adapter-opencode?color=000&style=flat-square)](https://www.npmjs.com/package/@weave_protocol/adapter-opencode)
+
+The same WARD.md you use with Claude Code, Antigravity, Microsoft Agent Framework, Gemini CLI and Codex CLI.
+
+## Quick start
+
+Add the plugin to OpenCode's config, either by hand:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["@weave_protocol/adapter-opencode"]
+}
+```
+
+or with the CLI, which edits `~/.config/opencode/opencode.json` for you:
+
+```bash
+npx -p @weave_protocol/adapter-opencode weave-ward-opencode init
+```
+
+Restart OpenCode; it installs the plugin on startup. Add a `WARD.md` to your project (`npx @weave_protocol/ward init`), or a global one at `~/.config/opencode/WARD.md`.
+
+The command is `weave-ward-opencode`, not `weave-opencode`. The `weave-opencode` npm name belongs to W&B Weave's opencode integration, which is a different product.
+
+## What it checks
+
+The plugin runs in OpenCode's `tool.execute.before` hook and uses Ward's shared evaluator (`evaluateToolCall`), so the rules match the other adapters exactly:
+
+| Tool | Checked |
+|---|---|
+| `bash` | `shell_exec`, plus every URL and every absolute or `~` path in the command (relative paths resolve against `workdir`) |
+| `read`, `write`, `edit` | `filePath` (read or write) |
+| `glob`, `grep` | `path` (list or read) |
+| `webfetch` | `url` |
+| `apply_patch` | the files in its `patchText` (`*** Add/Update File` and `*** Move to` are writes, `*** Delete File` is a delete); patch content is never treated as a target |
+| `todowrite`, `question` | the `task_planning` capability |
+| MCP tools (`<server>_<tool>`) and custom tools | by name, plus every path- and URL-named argument |
+
+A blocked call throws, and the agent sees `WARD: <reason>` as the tool error. A call that needs approval is blocked with a reason saying so.
+
+**Policy loading:**
+- **WARD.md is re-read on every call**, so edits take effect without restarting OpenCode.
+- **An invalid WARD.md blocks every call**, so a typo can't silently switch enforcement off.
+- **No WARD.md anywhere means no enforcement.**
+
+WARD.md is looked up in this order:
+1. `$WEAVE_WARD_PATH`
+2. `<project>/WARD.md`
+3. `<project>/.opencode/WARD.md`
+4. `<project>/.weave/WARD.md`
+5. `~/.config/opencode/WARD.md`
+
+## Commands
+
+```bash
+weave-ward-opencode init       # add the plugin to ~/.config/opencode/opencode.json
+weave-ward-opencode disable    # remove it
+weave-ward-opencode status
+weave-ward-opencode test read --input='{"filePath":"secrets/key"}'   # dry run
+```
+
+`init` backs up `opencode.json` and edits it atomically, leaving your other plugins and settings alone. It won't rewrite an `opencode.jsonc` file (it has comments); it tells you what to add instead.
+
+## For plugin authors
+
+The package's main entry default-exports only the plugin, `{ id: "weave-ward", server }`, as OpenCode's loader requires. The helpers are at `@weave_protocol/adapter-opencode/lib`.
+
+## Dashboard
+
+Set `WEAVE_DASHBOARD_URL` (and `WEAVE_API_KEY`) where you run the agent, and each decision is reported to a local [Weave API](https://github.com/Tyox-all/Weave_Protocol/tree/main/api) dashboard (0.2.0+). Only the decision and the tool name are sent, never command or argument contents. Reporting never changes a decision and gives up after 250 ms.
+
+## Verified
+
+Built against OpenCode's [plugin docs](https://opencode.ai/docs/plugins/), plus the plugin loader and tool schemas in OpenCode v1.19.5. 12 fixture tests.
+
+Live-checked in OpenCode 1.19.5 (on Gemini 3.5 Flash-Lite), loaded as a local plugin:
+- a `read` of `secrets/key` was blocked, and the model received `WARD: Denied by filesystem rule …`;
+- a `write` of `TODO.md` outside the allowed folder was blocked, and no file was created;
+- allowed `glob` and `read` calls went through.
+
+## License
+
+Apache-2.0

package/dist/cli.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * weave-ward-opencode CLI
+ *
+ *   weave-ward-opencode init                    Add the plugin to ~/.config/opencode/opencode.json
+ *   weave-ward-opencode disable                 Remove it
+ *   weave-ward-opencode status                  Plugin + active WARD.md
+ *   weave-ward-opencode test <tool> [--input=JSON]   Dry-run a tool call
+ *
+ * (Not "weave-opencode": that npm name belongs to W&B Weave's opencode integration.)
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG"}

package/dist/cli.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * weave-ward-opencode CLI
+ *
+ *   weave-ward-opencode init                    Add the plugin to ~/.config/opencode/opencode.json
+ *   weave-ward-opencode disable                 Remove it
+ *   weave-ward-opencode status                  Plugin + active WARD.md
+ *   weave-ward-opencode test <tool> [--input=JSON]   Dry-run a tool call
+ *
+ * (Not "weave-opencode": that npm name belongs to W&B Weave's opencode integration.)
+ */
+import { installPlugin, removePlugin, isPluginInstalled, readConfig, opencodeJsonPath, PACKAGE } from './config.js';
+import { resolveWard, evaluateCall, opencodeConfigDir } from './policy.js';
+import { join } from 'node:path';
+const tty = process.stderr.isTTY && !process.env.NO_COLOR;
+const c = {
+    reset: tty ? '\x1b[0m' : '', bold: tty ? '\x1b[1m' : '', red: tty ? '\x1b[31m' : '',
+    green: tty ? '\x1b[32m' : '', yellow: tty ? '\x1b[33m' : '', cyan: tty ? '\x1b[36m' : '', gray: tty ? '\x1b[90m' : '',
+};
+const say = (s = '') => console.error(s);
+const option = (args, name) => args.find((a) => a.startsWith(`--${name}=`))?.slice(name.length + 3);
+function help() {
+    say(`\n${c.cyan}${c.bold}🛡️  weave-ward-opencode${c.reset} ${c.gray}WARD.md enforcement for OpenCode${c.reset}\n`);
+    say(`${c.bold}Commands:${c.reset}`);
+    say(`  ${c.cyan}init${c.reset}                              Add the plugin to ${opencodeJsonPath()}`);
+    say(`  ${c.cyan}disable${c.reset}                           Remove it`);
+    say(`  ${c.cyan}status${c.reset}                            Show the plugin and the active WARD.md`);
+    say(`  ${c.cyan}test${c.reset} ${c.gray}<tool> [--input=JSON]${c.reset}        Dry-run a tool call against WARD.md\n`);
+    return 0;
+}
+function safeResolve() {
+    try {
+        return resolveWard(process.cwd());
+    }
+    catch (err) {
+        say(`${c.red}✗${c.reset} ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+function init() {
+    try {
+        installPlugin();
+    }
+    catch (err) {
+        say(`${c.red}✗${c.reset} ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+    say(`${c.green}✓${c.reset} Added "${PACKAGE}" to the plugin list in ${opencodeJsonPath()}`);
+    if (!safeResolve()) {
+        say(`${c.yellow}!${c.reset} No WARD.md found here or at ${join(opencodeConfigDir(), 'WARD.md')}; calls are allowed until you add one.`);
+    }
+    say(`${c.gray}Restart OpenCode; it installs the plugin on startup.${c.reset}`);
+    return 0;
+}
+function disable() {
+    const { removed } = removePlugin();
+    say(removed ? `${c.green}✓${c.reset} Removed the plugin from ${opencodeJsonPath()}` : 'The plugin was not configured.');
+    return 0;
+}
+function status() {
+    const installed = isPluginInstalled(readConfig());
+    say(`Plugin:   ${installed ? `${c.green}configured${c.reset}` : `${c.yellow}not configured${c.reset}`} (${opencodeJsonPath()})`);
+    const ward = safeResolve();
+    say(`WARD.md:  ${ward ? ward.source : `${c.yellow}none found${c.reset}`}`);
+    return installed && ward ? 0 : 1;
+}
+function test(args) {
+    const tool = args.find((a) => !a.startsWith('--'));
+    if (!tool) {
+        say('Usage: weave-ward-opencode test <tool> [--input=JSON]');
+        return 2;
+    }
+    const ward = safeResolve();
+    if (!ward) {
+        say('No WARD.md found; nothing to test against.');
+        return 2;
+    }
+    const result = evaluateCall(ward.policy, tool, JSON.parse(option(args, 'input') ?? '{}'), process.cwd());
+    const color = result.decision === 'allow' ? c.green : result.decision === 'deny' ? c.red : c.yellow;
+    say(`${color}${result.decision}${c.reset} ${tool}`);
+    for (const r of result.reasons)
+        say(`  ${c.gray}${r}${c.reset}`);
+    return result.decision === 'allow' ? 0 : 1;
+}
+const [cmd, ...rest] = process.argv.slice(2);
+const code = cmd === 'init' ? init()
+    : cmd === 'disable' || cmd === 'uninstall' ? disable()
+        : cmd === 'status' ? status()
+            : cmd === 'test' ? test(rest)
+                : help();
+process.exit(code);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,GAAG;IACR,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IACnF,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;CACtH,CAAC;AACF,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzC,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEtH,SAAS,IAAI;IACX,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,mCAAmC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACpH,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,mDAAmD,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACtG,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,sCAAsC,CAAC,CAAC;IACxE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,oEAAoE,CAAC,CAAC;IACrG,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,KAAK,+CAA+C,CAAC,CAAC;IACvH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,IAAI,CAAC;QACH,aAAa,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,WAAW,OAAO,2BAA2B,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,gCAAgC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAC1I,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO;IACd,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;IACnC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,4BAA4B,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;IACxH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM;IACb,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,aAAa,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,iBAAiB,CAAC,CAAC,KAAK,EAAE,KAAK,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3E,OAAO,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,IAAI,CAAC,IAAc;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,uDAAuD,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpG,GAAG,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7C,MAAM,IAAI,GACR,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;IACvB,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE;QACtD,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE;YAC7B,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7B,CAAC,CAAC,IAAI,EAAE,CAAC;AACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Add or remove the plugin in OpenCode's global opencode.json
+ * ($XDG_CONFIG_HOME/opencode/opencode.json, default ~/.config/opencode).
+ * OpenCode installs npm plugins listed there on startup.
+ *
+ * Safety rules:
+ *  - Back up opencode.json before changing it, and write atomically
+ *  - Idempotent: init twice leaves one entry
+ *  - Other plugins and settings are untouched
+ *  - opencode.jsonc (JSON with comments) is never rewritten: we'd lose the
+ *    comments, so init says what to add instead
+ */
+export declare const PACKAGE = "@weave_protocol/adapter-opencode";
+export declare function opencodeJsonPath(): string;
+export declare function opencodeJsoncPath(): string;
+export interface OpencodeConfig {
+    $schema?: string;
+    plugin?: Array<string | [string, unknown]>;
+    [other: string]: unknown;
+}
+export declare function readConfig(path?: string): OpencodeConfig;
+export declare function writeConfig(config: OpencodeConfig, path?: string): void;
+export declare function isPluginInstalled(config?: OpencodeConfig): boolean;
+/** Add the plugin to opencode.json. Throws if only an opencode.jsonc exists. */
+export declare function installPlugin(spec?: string): OpencodeConfig;
+export declare function removePlugin(): {
+    removed: number;
+    config: OpencodeConfig;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,eAAO,MAAM,OAAO,qCAAqC,CAAC;AAE1D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,wBAAgB,UAAU,CAAC,IAAI,SAAqB,GAAG,cAAc,CASpE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,SAAqB,GAAG,IAAI,CAMnF;AAQD,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,cAA6B,GAAG,OAAO,CAEhF;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,IAAI,SAAU,GAAG,cAAc,CAS5D;AAED,wBAAgB,YAAY,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAW1E"}

package/dist/config.js

@@ -0,0 +1,74 @@
+/**
+ * Add or remove the plugin in OpenCode's global opencode.json
+ * ($XDG_CONFIG_HOME/opencode/opencode.json, default ~/.config/opencode).
+ * OpenCode installs npm plugins listed there on startup.
+ *
+ * Safety rules:
+ *  - Back up opencode.json before changing it, and write atomically
+ *  - Idempotent: init twice leaves one entry
+ *  - Other plugins and settings are untouched
+ *  - opencode.jsonc (JSON with comments) is never rewritten: we'd lose the
+ *    comments, so init says what to add instead
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, copyFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { opencodeConfigDir } from './policy.js';
+export const PACKAGE = '@weave_protocol/adapter-opencode';
+export function opencodeJsonPath() {
+    return join(opencodeConfigDir(), 'opencode.json');
+}
+export function opencodeJsoncPath() {
+    return join(opencodeConfigDir(), 'opencode.jsonc');
+}
+export function readConfig(path = opencodeJsonPath()) {
+    if (!existsSync(path))
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`Failed to parse ${path}; fix the JSON or move it aside and re-run. ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export function writeConfig(config, path = opencodeJsonPath()) {
+    mkdirSync(dirname(path), { recursive: true });
+    if (existsSync(path))
+        copyFileSync(path, `${path}.weave-backup`);
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(config, null, 2) + '\n', 'utf8');
+    renameSync(tmp, path);
+}
+const entryName = (e) => (Array.isArray(e) ? e[0] : e);
+const isOurs = (e) => {
+    const name = entryName(e);
+    return name === PACKAGE || name.startsWith(`${PACKAGE}@`);
+};
+export function isPluginInstalled(config = readConfig()) {
+    return (config.plugin ?? []).some(isOurs);
+}
+/** Add the plugin to opencode.json. Throws if only an opencode.jsonc exists. */
+export function installPlugin(spec = PACKAGE) {
+    if (!existsSync(opencodeJsonPath()) && existsSync(opencodeJsoncPath())) {
+        throw new Error(`${opencodeJsoncPath()} has comments we won't rewrite. Add "${spec}" to its "plugin" list by hand.`);
+    }
+    const config = readConfig();
+    config.$schema ??= 'https://opencode.ai/config.json';
+    config.plugin = [...(config.plugin ?? []).filter((e) => !isOurs(e)), spec];
+    writeConfig(config);
+    return config;
+}
+export function removePlugin() {
+    const config = readConfig();
+    const before = config.plugin ?? [];
+    const after = before.filter((e) => !isOurs(e));
+    const removed = before.length - after.length;
+    if (removed > 0) {
+        if (after.length)
+            config.plugin = after;
+        else
+            delete config.plugin;
+        writeConfig(config);
+    }
+    return { removed, config };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,OAAO,GAAG,kCAAkC,CAAC;AAE1D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACrD,CAAC;AAQD,MAAM,UAAU,UAAU,CAAC,IAAI,GAAG,gBAAgB,EAAE;IAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAmB,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,+CAA+C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAsB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAA6B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,MAAM,MAAM,GAAG,CAAC,CAA6B,EAAE,EAAE;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,MAAM,GAAmB,UAAU,EAAE;IACrE,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO;IAC1C,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,iBAAiB,EAAE,wCAAwC,IAAI,iCAAiC,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,OAAO,KAAK,iCAAiC,CAAC;IACrD,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3E,WAAW,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;;YACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QAC1B,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @weave_protocol/adapter-opencode — the OpenCode plugin.
+ *
+ * Add the package to the "plugin" list in opencode.json (weave-ward-opencode
+ * init does this) and every tool call is checked against WARD.md in
+ * tool.execute.before; a blocked call throws, and the agent sees the reason.
+ *
+ * This entry default-exports only the plugin (OpenCode's v1 plugin format:
+ * { id, server }). Helpers live at "@weave_protocol/adapter-opencode/lib".
+ *
+ * WARD.md is read on every call, so policy edits apply without a restart.
+ * An invalid WARD.md blocks every call rather than switching enforcement off.
+ */
+interface PluginInput {
+    directory?: string;
+    worktree?: string;
+}
+interface ToolBefore {
+    tool: string;
+    sessionID?: string;
+    callID?: string;
+}
+declare const WardPlugin: ({ directory, worktree }: PluginInput) => Promise<{
+    'tool.execute.before': (input: ToolBefore, output: {
+        args?: unknown;
+    }) => Promise<void>;
+}>;
+declare const _default: {
+    id: string;
+    server: typeof WardPlugin;
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,UAAU,WAAW;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,QAAA,MAAM,UAAU,4BAAmC,WAAW;mCAGrB,UAAU,UAAU;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;EAe9E,CAAC;;IAEe,EAAE;IAAgB,MAAM"}

package/dist/index.js

@@ -0,0 +1,39 @@
+/**
+ * @weave_protocol/adapter-opencode — the OpenCode plugin.
+ *
+ * Add the package to the "plugin" list in opencode.json (weave-ward-opencode
+ * init does this) and every tool call is checked against WARD.md in
+ * tool.execute.before; a blocked call throws, and the agent sees the reason.
+ *
+ * This entry default-exports only the plugin (OpenCode's v1 plugin format:
+ * { id, server }). Helpers live at "@weave_protocol/adapter-opencode/lib".
+ *
+ * WARD.md is read on every call, so policy edits apply without a restart.
+ * An invalid WARD.md blocks every call rather than switching enforcement off.
+ */
+import { reportEvent } from '@weave_protocol/ward';
+import { resolveWard, evaluateCall, blockMessage } from './policy.js';
+const WardPlugin = async ({ directory, worktree }) => {
+    const dir = directory || worktree || process.cwd();
+    return {
+        'tool.execute.before': async (input, output) => {
+            let ward;
+            try {
+                ward = resolveWard(dir);
+            }
+            catch (err) {
+                throw new Error(`WARD policy could not be loaded: ${err instanceof Error ? err.message : String(err)}. Fix WARD.md to continue.`);
+            }
+            if (!ward)
+                return;
+            const result = evaluateCall(ward.policy, input.tool, output.args, dir);
+            // Dashboard reporting (only when WEAVE_DASHBOARD_URL is set; never blocks)
+            void reportEvent({ surface: 'opencode', decision: result.decision, subject: input.tool, reason: result.reasons[0] });
+            const message = blockMessage(result, ward.source);
+            if (message)
+                throw new Error(message);
+        },
+    };
+};
+export default { id: 'weave-ward', server: WardPlugin };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAatE,MAAM,UAAU,GAAG,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAe,EAAE,EAAE;IAChE,MAAM,GAAG,GAAG,SAAS,IAAI,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,KAAiB,EAAE,MAA0B,EAAE,EAAE;YAC7E,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YACpI,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACvE,2EAA2E;YAC3E,KAAK,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrH,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC"}

package/dist/lib.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Helpers behind the OpenCode plugin ("@weave_protocol/adapter-opencode/lib").
+ * The package's main entry exports only the plugin, as OpenCode requires.
+ */
+export { TOOL_MAPPINGS, opencodeConfigDir, resolveWard, evaluateCall, blockMessage } from './policy.js';
+export type { ResolvedWard, WardDecision } from './policy.js';
+export { patchTargets } from './patch.js';
+export type { PatchTargets } from './patch.js';
+export { PACKAGE, opencodeJsonPath, opencodeJsoncPath, readConfig, writeConfig, installPlugin, removePlugin, isPluginInstalled, } from './config.js';
+export type { OpencodeConfig } from './config.js';
+//# sourceMappingURL=lib.d.ts.map

package/dist/lib.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxG,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/lib.js

@@ -0,0 +1,8 @@
+/**
+ * Helpers behind the OpenCode plugin ("@weave_protocol/adapter-opencode/lib").
+ * The package's main entry exports only the plugin, as OpenCode requires.
+ */
+export { TOOL_MAPPINGS, opencodeConfigDir, resolveWard, evaluateCall, blockMessage } from './policy.js';
+export { patchTargets } from './patch.js';
+export { PACKAGE, opencodeJsonPath, opencodeJsoncPath, readConfig, writeConfig, installPlugin, removePlugin, isPluginInstalled, } from './config.js';
+//# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExG,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC"}

package/dist/patch.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The files an OpenCode apply_patch touches (its patchText). The patch
+ * format, shared with Codex, marks each file:
+ *
+ *   *** Add File: <path>       new file      → write
+ *   *** Update File: <path>    edit in place → write
+ *   *** Move to: <path>        rename target → write
+ *   *** Delete File: <path>    removal       → delete
+ *
+ * Paths are relative to the session cwd unless absolute.
+ */
+export interface PatchTargets {
+    writes: string[];
+    deletes: string[];
+}
+export declare function patchTargets(patch: string): PatchTargets;
+//# sourceMappingURL=patch.d.ts.map

package/dist/patch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../src/patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAID,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CASxD"}

package/dist/patch.js

@@ -0,0 +1,24 @@
+/**
+ * The files an OpenCode apply_patch touches (its patchText). The patch
+ * format, shared with Codex, marks each file:
+ *
+ *   *** Add File: <path>       new file      → write
+ *   *** Update File: <path>    edit in place → write
+ *   *** Move to: <path>        rename target → write
+ *   *** Delete File: <path>    removal       → delete
+ *
+ * Paths are relative to the session cwd unless absolute.
+ */
+const MARKER = /^\*\*\* (Add File|Update File|Move to|Delete File):\s*(.+?)\s*$/;
+export function patchTargets(patch) {
+    const writes = [];
+    const deletes = [];
+    for (const line of patch.split(/\r?\n/)) {
+        const m = MARKER.exec(line);
+        if (!m)
+            continue;
+        (m[1] === 'Delete File' ? deletes : writes).push(m[2]);
+    }
+    return { writes, deletes };
+}
+//# sourceMappingURL=patch.js.map

package/dist/patch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.js","sourceRoot":"","sources":["../src/patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,MAAM,MAAM,GAAG,iEAAiE,CAAC;AAEjF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,31 @@
+/**
+ * WARD decisions for OpenCode tool calls, with Ward's shared evaluator.
+ *
+ * Tool and argument names are OpenCode 1.19's (packages/opencode/src/tool):
+ * bash { command, workdir }, read/write/edit { filePath }, glob/grep
+ * { path }, webfetch { url }, apply_patch { patchText }. MCP tools arrive
+ * as <server>_<tool>; Ward checks their path and URL arguments by name.
+ */
+import { type ToolMapping, type WardPolicy } from '@weave_protocol/ward';
+export declare const TOOL_MAPPINGS: Record<string, ToolMapping>;
+export interface ResolvedWard {
+    policy: WardPolicy;
+    source: string;
+}
+export interface WardDecision {
+    decision: 'allow' | 'deny' | 'require_approval';
+    reasons: string[];
+}
+/** OpenCode's global config directory ($XDG_CONFIG_HOME/opencode, default ~/.config/opencode). */
+export declare function opencodeConfigDir(): string;
+/**
+ * WARD.md resolution: $WEAVE_WARD_PATH, then <dir>/WARD.md,
+ * <dir>/.opencode/WARD.md, <dir>/.weave/WARD.md, then the global
+ * ~/.config/opencode/WARD.md. Throws on an invalid policy.
+ */
+export declare function resolveWard(dir: string): ResolvedWard | null;
+/** Decide an OpenCode tool call. */
+export declare function evaluateCall(policy: WardPolicy, tool: string, args: unknown, dir: string): WardDecision;
+/** The error message the agent sees for a blocked call, or null to let it run. */
+export declare function blockMessage(result: WardDecision, source: string): string | null;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAG7G,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAarD,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAmB5D;AAID,oCAAoC;AACpC,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAsBvG;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMhF"}

package/dist/policy.js

@@ -0,0 +1,88 @@
+/**
+ * WARD decisions for OpenCode tool calls, with Ward's shared evaluator.
+ *
+ * Tool and argument names are OpenCode 1.19's (packages/opencode/src/tool):
+ * bash { command, workdir }, read/write/edit { filePath }, glob/grep
+ * { path }, webfetch { url }, apply_patch { patchText }. MCP tools arrive
+ * as <server>_<tool>; Ward checks their path and URL arguments by name.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { parseAndValidate, evaluateToolCall } from '@weave_protocol/ward';
+import { patchTargets } from './patch.js';
+export const TOOL_MAPPINGS = {
+    bash: { capability: 'shell_exec', commandField: 'command', pathField: 'workdir', fsOp: 'read' },
+    read: { capability: 'file_read', pathField: 'filePath', fsOp: 'read' },
+    write: { capability: 'file_write', pathField: 'filePath', fsOp: 'write' },
+    edit: { capability: 'file_write', pathField: 'filePath', fsOp: 'write' },
+    glob: { capability: 'file_list', pathField: 'path', fsOp: 'list' },
+    grep: { capability: 'file_read', pathField: 'path', fsOp: 'read' },
+    webfetch: { capability: 'http_request', urlField: 'url' },
+    websearch: { capability: 'web_search' },
+    task: { capability: 'subagent' },
+    skill: { capability: 'skill' },
+    todowrite: { capability: 'task_planning' },
+    question: { capability: 'task_planning' },
+};
+/** OpenCode's global config directory ($XDG_CONFIG_HOME/opencode, default ~/.config/opencode). */
+export function opencodeConfigDir() {
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+}
+/**
+ * WARD.md resolution: $WEAVE_WARD_PATH, then <dir>/WARD.md,
+ * <dir>/.opencode/WARD.md, <dir>/.weave/WARD.md, then the global
+ * ~/.config/opencode/WARD.md. Throws on an invalid policy.
+ */
+export function resolveWard(dir) {
+    const candidates = [
+        process.env.WEAVE_WARD_PATH,
+        dir && join(dir, 'WARD.md'),
+        dir && join(dir, '.opencode', 'WARD.md'),
+        dir && join(dir, '.weave', 'WARD.md'),
+        join(opencodeConfigDir(), 'WARD.md'),
+    ].filter((p) => !!p);
+    for (const path of candidates) {
+        const full = resolve(path);
+        if (!existsSync(full))
+            continue;
+        const result = parseAndValidate(readFileSync(full, 'utf8'));
+        if (!result.valid || !result.policy) {
+            throw new Error(`Invalid WARD.md at ${full}: ${result.errors.map((e) => e.message).join('; ')}`);
+        }
+        return { policy: result.policy, source: full };
+    }
+    return null;
+}
+const RANK = { allow: 0, require_approval: 1, deny: 2 };
+/** Decide an OpenCode tool call. */
+export function evaluateCall(policy, tool, args, dir) {
+    const input = args && typeof args === 'object' && !Array.isArray(args) ? args : {};
+    // apply_patch: the files the patch writes and deletes, not its text
+    if (tool === 'apply_patch') {
+        const { writes, deletes } = patchTargets(String(input.patchText ?? ''));
+        const check = (target, fsOp) => evaluateToolCall(policy, tool, { target }, {
+            cwd: dir,
+            mappings: { apply_patch: { capability: 'file_write', pathField: 'target', fsOp } },
+        });
+        const results = [check(writes, 'write'), ...(deletes.length ? [check(deletes, 'delete')] : [])];
+        const worst = results.reduce((a, b) => (RANK[b.decision] > RANK[a.decision] ? b : a));
+        return { decision: worst.decision, reasons: results.flatMap((r) => r.reasons) };
+    }
+    // bash runs in workdir when one is given
+    const cwd = tool === 'bash' && typeof input.workdir === 'string' && input.workdir
+        ? (isAbsolute(input.workdir) ? input.workdir : join(dir, input.workdir))
+        : dir;
+    const { decision, reasons } = evaluateToolCall(policy, tool, input, { mappings: TOOL_MAPPINGS, cwd });
+    return { decision, reasons };
+}
+/** The error message the agent sees for a blocked call, or null to let it run. */
+export function blockMessage(result, source) {
+    if (result.decision === 'deny')
+        return `WARD: ${result.reasons.join(' | ')} (policy: ${source})`;
+    if (result.decision === 'require_approval') {
+        return `WARD requires approval before this call: ${result.reasons.join(' | ')} (policy: ${source}). Ask the user to approve it or update WARD.md.`;
+    }
+    return null;
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAqC,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAgC;IACxD,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;IAC/F,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;IACtE,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACzE,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACxE,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAClE,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAClE,QAAQ,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE;IACzD,SAAS,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;IACvC,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE;IAChC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;IAC9B,SAAS,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;IAC1C,QAAQ,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;CAC1C,CAAC;AAYF,kGAAkG;AAClG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QAC3B,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC;QACxC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC;QACrC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,CAAC;KACrC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAW,CAAC;AAEjE,oCAAoC;AACpC,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,IAAY,EAAE,IAAa,EAAE,GAAW;IACvF,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhH,oEAAoE;IACpE,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,CAAC,MAAgB,EAAE,IAAwB,EAAE,EAAE,CAC3D,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE;YACzC,GAAG,EAAE,GAAG;YACR,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;SACnF,CAAC,CAAC;QACL,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,yCAAyC;IACzC,MAAM,GAAG,GAAG,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO;QAC/E,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,MAAc;IAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,MAAM,GAAG,CAAC;IACjG,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC3C,OAAO,4CAA4C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,MAAM,kDAAkD,CAAC;IACrJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@weave_protocol/adapter-opencode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Weave Protocol plugin for OpenCode - enforces WARD.md policies on every tool call via tool.execute.before",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "weave-ward-opencode": "dist/cli.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "weave-protocol",
+    "ward",
+    "opencode",
+    "opencode-plugin",
+    "agent-security",
+    "ai-security",
+    "plugin",
+    "harness-adapter",
+    "policy-enforcement",
+    "ward-md"
+  ],
+  "author": "Trent Yoxall",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Tyox-all/Weave_Protocol.git",
+    "directory": "adapter-opencode"
+  },
+  "homepage": "https://github.com/Tyox-all/Weave_Protocol/tree/main/adapter-opencode#readme",
+  "bugs": {
+    "url": "https://github.com/Tyox-all/Weave_Protocol/issues"
+  },
+  "dependencies": {
+    "@weave_protocol/ward": "^0.3.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.6",
+    "typescript": "^7.0.2"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "dist/",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./lib": {
+      "types": "./dist/lib.d.ts",
+      "import": "./dist/lib.js"
+    }
+  }
+}