@williambeto/ai-workflow 2.9.1 → 2.9.3

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 ## [unreleased]
 
+## [2.9.3] - 2026-07-16
+
+### 🐛 Bug Fixes
+
+- Restore scoped specialist delegation for every core AIWK agent without
+  reintroducing `bash` or `edit` approval prompts
+- Allow Atlas to reach both workflow agents and all registered specialists
+  while preventing specialists from delegating recursively
+- Set OpenCode's bounded subagent depth to two so workflow agents delegated by
+  Atlas can still consult one specialist
+- Detect stale or incomplete specialist routing through `ai-workflow doctor`
+
+### 🧪 Testing
+
+- Cover the complete six-caller by twenty-specialist routing matrix
+- Verify upgrades from permission-free `2.9.2` configurations and reject
+  recursive specialist delegation
+- Exercise Atlas to workflow-agent to specialist routing in a real OpenCode
+  runtime smoke test
+
+## [2.9.2] - 2026-07-16
+
+### 🐛 Bug Fixes
+
+- Stop injecting agent-level `deny` and `ask` permissions into consumer
+  `opencode.jsonc` files, preserving the consumer's OpenCode permission defaults
+- Keep agent ownership and routing boundaries in AIWK instructions without
+  causing repeated per-project approval prompts
+
+### 🧪 Testing
+
+- Add regression coverage that rejects generated AIWK agent permission
+  overrides while preserving the managed agent registry
+
 ## [2.9.1] - 2026-07-15
 
 ### 🐛 Bug Fixes

package/bin/ai-workflow.js

@@ -761,6 +761,58 @@ var SUBAGENTS = {
   "Technical-Leader": { description: "Capability only: analyze technical decisions, architecture, and trade-offs", skill: "technical-leadership" },
   "UI-UX-Engineer": { description: "Capability only: review usability and interface clarity", skill: "ui-ux-design" }
 };
+var CORE_AGENT_NAMES = Object.freeze(Object.keys(AGENTS));
+var SPECIALIST_AGENT_NAMES = Object.freeze(Object.keys(SUBAGENTS));
+var MIN_SUBAGENT_DEPTH = 2;
+function inspectSpecialistRoutingConfig(opencodeConfig) {
+  const errors = [];
+  const warnings = [];
+  const agents = opencodeConfig?.agent ?? {};
+  if (typeof opencodeConfig?.subagent_depth !== "number" || opencodeConfig.subagent_depth < MIN_SUBAGENT_DEPTH) {
+    errors.push(`OpenCode subagent_depth must be at least ${MIN_SUBAGENT_DEPTH} for workflow-agent to specialist routing`);
+  }
+  for (const specialist of SPECIALIST_AGENT_NAMES) {
+    if (agents[specialist]?.mode !== "subagent") {
+      errors.push(`specialist missing or not configured as subagent: ${specialist}`);
+    }
+    if (agents[specialist]?.permission?.task !== void 0) {
+      errors.push(`specialist must not delegate recursively: ${specialist}`);
+    }
+  }
+  for (const caller of CORE_AGENT_NAMES) {
+    const taskPermissions = agents[caller]?.permission?.task;
+    if (!taskPermissions || typeof taskPermissions !== "object" || Array.isArray(taskPermissions)) {
+      errors.push(`core agent lacks explicit specialist task routing: ${caller}`);
+      continue;
+    }
+    if (taskPermissions["*"] !== "deny") {
+      errors.push(`core agent task routing must deny unspecified targets: ${caller}`);
+    }
+    if (Object.values(taskPermissions).includes("ask")) {
+      errors.push(`core agent task routing must not request approval: ${caller}`);
+    }
+    const blockedSpecialists = SPECIALIST_AGENT_NAMES.filter((specialist) => taskPermissions[specialist] !== "allow");
+    if (blockedSpecialists.length > 0) {
+      errors.push(`core agent cannot reach all specialists: ${caller} (${blockedSpecialists.join(", ")})`);
+    }
+    const otherCoreAgents = CORE_AGENT_NAMES.filter((name) => name !== caller);
+    if (caller === "Atlas") {
+      const blockedCoreAgents = otherCoreAgents.filter((name) => taskPermissions[name] !== "allow");
+      if (blockedCoreAgents.length > 0) {
+        errors.push(`Atlas cannot reach all workflow agents: ${blockedCoreAgents.join(", ")}`);
+      }
+    } else {
+      const recursiveCoreAgents = otherCoreAgents.filter((name) => taskPermissions[name] === "allow");
+      if (recursiveCoreAgents.length > 0) {
+        errors.push(`non-Atlas core agent can recursively delegate workflow ownership: ${caller} (${recursiveCoreAgents.join(", ")})`);
+      }
+    }
+  }
+  if (opencodeConfig?.permission?.task !== void 0) {
+    warnings.push("consumer-level permission.task may override AIWK specialist routing or enable recursive delegation");
+  }
+  return { valid: errors.length === 0, errors, warnings };
+}
 var COMMANDS = {
   atlas: { description: "Decide safest next step and delegate to the appropriate workflow or agent", agent: "Atlas" },
   run: { description: "Execute the master orchestration pipeline (Gates, SDD, Implementation, Validation, Healing)", agent: "Atlas" },
@@ -779,13 +831,14 @@ var COMMANDS = {
 };
 function buildManagedConfig() {
   const agent = {};
-  const coreTaskPermissions = Object.fromEntries([
+  const specialistTaskPermissions = Object.fromEntries([
     ["*", "deny"],
-    ...Object.keys(AGENTS).filter((name) => name !== "Atlas").map((name) => [name, "allow"])
+    ...SPECIALIST_AGENT_NAMES.map((name) => [name, "allow"])
   ]);
-  const capabilityTaskPermissions = Object.fromEntries([
+  const atlasTaskPermissions = Object.fromEntries([
     ["*", "deny"],
-    ...Object.keys(SUBAGENTS).map((name) => [name, "allow"])
+    ...CORE_AGENT_NAMES.filter((name) => name !== "Atlas").map((name) => [name, "allow"]),
+    ...SPECIALIST_AGENT_NAMES.map((name) => [name, "allow"])
   ]);
   for (const [name, def] of Object.entries(AGENTS)) {
     agent[name] = {
@@ -793,9 +846,7 @@ function buildManagedConfig() {
       description: def.description,
       prompt: `{file:./.ai-workflow/opencode/agents/${name.toLowerCase()}.md}`,
       permission: {
-        ...name === "Atlas" ? { edit: "deny", bash: "ask" } : {},
-        ...name === "Astra" ? { edit: "allow" } : {},
-        task: name === "Atlas" ? coreTaskPermissions : capabilityTaskPermissions
+        task: name === "Atlas" ? atlasTaskPermissions : specialistTaskPermissions
       }
     };
   }
@@ -803,12 +854,7 @@ function buildManagedConfig() {
     agent[name] = {
       mode: "subagent",
       description: def.description,
-      prompt: `{file:./.ai-workflow/opencode/skills/${def.skill}/SKILL.md}`,
-      permission: {
-        edit: "deny",
-        bash: "ask",
-        task: { "*": "deny" }
-      }
+      prompt: `{file:./.ai-workflow/opencode/skills/${def.skill}/SKILL.md}`
     };
   }
   const command = {};
@@ -822,6 +868,7 @@ function buildManagedConfig() {
   return {
     $schema: "https://opencode.ai/config.json",
     default_agent: "Atlas",
+    subagent_depth: MIN_SUBAGENT_DEPTH,
     agent,
     skills: {
       paths: ["./.ai-workflow/opencode/skills"]
@@ -857,6 +904,7 @@ async function mergeOpencodeConfig(cwd, { force = false, backupRoot = ".ai-workf
   const next = {
     ...currentWithoutLegacy,
     $schema: current.$schema ?? managed.$schema,
+    subagent_depth: typeof current.subagent_depth === "number" ? Math.max(current.subagent_depth, managed.subagent_depth) : managed.subagent_depth,
     ...managed.mcp ? {
       mcp: {
         ...current.mcp ?? {},
@@ -2006,6 +2054,18 @@ async function checkOpencodeJson(cwd, state) {
         console.log(`FAIL opencode agent entries missing: ${missingAgents.join(", ")}`);
       }
     }
+    const specialistRouting = inspectSpecialistRoutingConfig(opencodeConfig);
+    if (specialistRouting.valid) {
+      console.log(`PASS OpenCode specialist routing available (${CORE_AGENT_NAMES.length} callers, ${SPECIALIST_AGENT_NAMES.length} specialists)`);
+    } else {
+      state.hasWarning = true;
+      for (const error of specialistRouting.errors) console.log(`WARN ${error}`);
+      console.log("WARN specialist routing is stale or incomplete; rerun `ai-workflow init --yes --no-install`");
+    }
+    for (const warning of specialistRouting.warnings) {
+      state.hasWarning = true;
+      console.log(`WARN ${warning}`);
+    }
   } catch {
     state.hasFailure = true;
     console.log("FAIL opencode.jsonc is not valid JSONC");