jorgex-stack 1.9.0 → 1.9.2

package/README.md

@@ -106,7 +106,7 @@ Programmatic mode does **not** provide:
 
 ### Pi runtime
 
-Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. This adoption targets the exact published package **`jorgex-pi@0.7.0`** and keeps Pi out of the adapter/component manifest and model map. The Stack release that consumes it must pin `npm:jorgex-pi@0.7.0` in `src/lib/pi-runtime.ts`; this section does not claim that a user installation or `main` has already consumed it.
+Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. This PR03 candidate targets the exact published package **`jorgex-pi@0.8.0`** and keeps Pi out of the adapter/component manifest and model map. PR03 pins that candidate in `src/lib/pi-runtime.ts` without changing `package.json`; the published Stack 1.9.0 release still recognizes `npm:jorgex-pi@0.7.0`, so this section does not claim that `main` or an end-user installation has consumed Pi 0.8.0.
 
 ```bash
 pnpm dlx jorgex-stack install --agents pi
@@ -116,9 +116,11 @@ pnpm dlx jorgex-stack sync --agents pi
 pnpm dlx jorgex-stack uninstall --agents pi
 ```
 
-Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. For `0.7.0`, the frozen tarball is `89125185` bytes; the URL is derived from the version and the authoritative size/SHA-256/SHA-512 pin remains in `src/lib/pi-runtime.ts` rather than being duplicated here. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The managed Pi package entry is the exact object `{ "source": "npm:jorgex-pi@0.7.0", "skills": [], "prompts": [] }`; filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
+Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. For `0.8.0`, the frozen tarball is `89128340` bytes; the URL is derived from the version and the authoritative size/SHA-256/SHA-512 pin remains in `src/lib/pi-runtime.ts` rather than being duplicated here. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The managed Pi package entry is the exact object `{ "source": "npm:jorgex-pi@0.8.0", "skills": [], "prompts": [] }`; filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
 
-The published artifact has three separate provenance anchors: the release checkout and tarball producer is `41b41b7a49617b59c7eb72bdedaa75455b362496`; the SLSA workflow run is `33481871250` on ref `main`, with resolved dependencies at the same commit `41b41b7...` (manual `0.7.0`, with no bump commit); and the Stack parity source is `1327d8dbe68e4118272a74a06c44a731bb346efa`. Registry metadata has no `gitHead`. The npm attestation binds the exact tarball SHA-512 to workflow run `33481871250`; README does not treat registry metadata as a separate source identity.
+The published Pi 0.8.0 direct-package snapshot adds `work-audit`: the snapshot grows from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grows from **16 to 17 skills**. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration.
+
+The published artifact has two separate provenance anchors: the release checkout and tarball producer is `9f999747df3e335947a61d38e581555367973b09` (`main`, release `0.8.0`); and the Stack parity source is `11e7666ea4e40bde1de8bc434610747eb797ab9c`. Registry metadata has no `gitHead`; README does not invent a separate source identity, attestation or signature.
 
 Install, sync and uninstall back up every managed file before changing it and are idempotent. `doctor` reports package and projection drift without repairing it. Uninstall removes only receipt-owned package/projection state, retains shared files also owned by another runtime, and preserves user content outside marked sections. Engram remains user-owned and is never removed; the receipts only carry the verified executable hand-off required by the package.
 
@@ -126,7 +128,7 @@ The package owns Pi's native primary-model projection: `openai-codex/gpt-5.6-sol
 
 Engram remains mandatory and user-owned. An existing binary is preserved. Interactive install may offer the native `brew`/`go`/release channel with explicit confirmation; `--yes` and non-TTY installs fail with a remedy when Engram is absent. The database and memories are never updated or deleted, and uninstall never deletes the Engram binary. Under `--target-dir`, Stack accepts only `<target>/bin/engram`, isolates Pi/Home/XDG/AppData/temp/npm-cache paths inside the target, and never consults the host Engram or Pi configuration.
 
-The transition from `jorgex-pi@0.6.1` to `jorgex-pi@0.7.0` is not in-place. Each Stack release recognizes only the Pi receipt for its exact pin. The published Stack **`jorgex-stack@1.7.5`** is the corroborated release that recognizes `npm:jorgex-pi@0.6.1`; use it explicitly, never `latest`, to clean an old `0.6.1` receipt before installing `jorgex-stack@1.8.1`, which recognizes `0.7.0`. Rollback is symmetric: first use `jorgex-stack@1.8.1` to clean the present `0.7.0` receipt, then `jorgex-stack@1.7.5` to restore `0.6.1`. The earlier `0.4.0`/`jorgex-stack@1.7.1` pairing is historical context only, not part of this transition. Never edit receipts or hashes and never delete `HOME`, Engram, or another runtime's projection to force trust. The exact examples and failure behavior are in [docs/references/pi-runtime.md](docs/references/pi-runtime.md); the commands there are documentation, not commands executed by this adoption.
+The transition from `jorgex-pi@0.7.0` to `jorgex-pi@0.8.0` is not in-place. Each Stack release recognizes only the Pi receipt for its exact pin. The published Stack **`jorgex-stack@1.9.0`** is the corroborated release that still recognizes `npm:jorgex-pi@0.7.0`. PR03 does not change `package.json`; after the merge, the workflow will publish the first free patch in `1.9.x`, expected to be `1.9.1`. T15 must verify the final published version and its recognition of `npm:jorgex-pi@0.8.0` before it is used for a real installation. Use exact versions, never `latest`, and never edit receipts or hashes or delete `HOME`, Engram, or another runtime's projection to force trust. The examples are in `docs/references/pi-runtime.md`; they are documentation, not commands executed by this adoption.
 
 The 24-hour npm maturity rule applies only to real managed installation or consumption of the new Pi package. Development, PR validation, merge and Stack publication may proceed immediately against the exact verified artifact; installing it on a real user scope before 24 hours requires Jorge's explicit exception.
 

package/dist/cli.js

@@ -5142,16 +5142,16 @@ import { createHash } from "crypto";
 var PI_RUNTIME_CANDIDATE = {
   package: {
     name: "jorgex-pi",
-    version: "0.7.0",
-    source: "npm:jorgex-pi@0.7.0"
+    version: "0.8.0",
+    source: "npm:jorgex-pi@0.8.0"
   },
   provenance: {
-    commit: "41b41b7a49617b59c7eb72bdedaa75455b362496"
+    commit: "9f999747df3e335947a61d38e581555367973b09"
   },
   tarball: {
-    bytes: 89125185,
-    sha256: "4db392a68187a05a530e6d5ac4c45f834aab5972201edc9ef86da547981109e5",
-    sha512: "fb5fdcf15463f3dab36be9b2e6cb55b7397831fe8a172972666a0d6d146ba5e26e70b74e2962dc2702b4ae6ee025094291597c910f967dd924c5a51bd0cc655b"
+    bytes: 89128340,
+    sha256: "b001f9dea23669b7211af228df6ea6442bcd90a9a928aa1a47c3e7132966f989",
+    sha512: "a591bf223e2d48ddecc89341253dc0ac41a6f843796c04ca62f47dc7587b3ec9afafdffba63e52fe99f833aec5ac0b34926eaf3c26f2755003bbf8e6891f6bd9"
   },
   pi: {
     testedVersions: ["0.84.2"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",

package/stack/plugins/opencode/worktree.ts

@@ -16,6 +16,32 @@ interface ScriptResult {
   scriptPath: string;
 }
 
+const logToOpenCode = async (
+  client: unknown,
+  level: "warn" | "error",
+  message: string,
+  extra?: unknown,
+) => {
+  if (typeof client !== "object" || client === null) return;
+  const app = (client as { app?: unknown }).app;
+  if (typeof app !== "object" || app === null) return;
+  const log = (app as { log?: unknown }).log;
+  if (typeof log !== "function") return;
+
+  const safeExtra =
+    extra instanceof Error
+      ? { message: extra.message, stack: extra.stack }
+      : extra;
+
+  try {
+    await log.call(app, {
+      body: { service: "hooks", level, message, extra: safeExtra },
+    });
+  } catch {
+    // Logging must not break the OpenCode TUI hook.
+  }
+};
+
 const isAbsolutePath = (value: string) =>
   /^[a-zA-Z]:[\\/]/.test(value) || value.startsWith("/");
 
@@ -43,6 +69,22 @@ const resolveProjectPath = (directory: string, target?: string) => {
 const isPlainObject = (value: unknown): value is Record<string, unknown> =>
   typeof value === "object" && value !== null && !Array.isArray(value);
 
+const validateConfig = (config: Record<string, unknown>) => {
+  for (const field of ["setupScript", "docsReminderScript", "pathContains"]) {
+    if (field in config && typeof config[field] !== "string") {
+      return `Worktree config field "${field}" must be a string.`;
+    }
+  }
+
+  if (
+    "reminderLines" in config &&
+    (!Array.isArray(config.reminderLines) ||
+      !config.reminderLines.every((line) => typeof line === "string"))
+  ) {
+    return 'Worktree config field "reminderLines" must be an array of strings.';
+  }
+};
+
 const getPayloadWorktreePath = (payload: unknown) => {
   if (!isPlainObject(payload)) return undefined;
 
@@ -142,15 +184,14 @@ const runScript = async (
   }
 
   if (!command) {
-    await client.app.log({
-      body: {
-        service: "hooks",
-        level: "warn",
-        message: "Unsupported worktree hook script extension",
-        extra: { script, scriptPath },
-      },
-    });
-    return { exitCode: 0, stdout: "", stderr: "", script, scriptPath };
+    const stderr = `Unsupported worktree hook script extension for ${scriptPath}.`;
+    await logToOpenCode(
+      client,
+      "warn",
+      "Unsupported worktree hook script extension",
+      { script, scriptPath },
+    );
+    return { exitCode: 1, stdout: "", stderr, script, scriptPath };
   }
 
   try {
@@ -173,35 +214,26 @@ const runScript = async (
     ]);
 
     if (exitCode !== 0) {
-      await client.app.log({
-        body: {
-          service: "hooks",
-          level: "error",
-          message: "Worktree hook script execution failed",
-          extra: {
-            script,
-            scriptPath,
-            exitCode,
-            stderr: stderr.trim(),
-            stdout: stdout.trim(),
-          },
+      await logToOpenCode(
+        client,
+        "error",
+        "Worktree hook script execution failed",
+        {
+          script,
+          scriptPath,
+          exitCode,
+          stderr: stderr.trim(),
+          stdout: stdout.trim(),
         },
-      });
+      );
     }
 
     return { exitCode, stdout, stderr, script, scriptPath };
   } catch (error) {
-    await client.app.log({
-      body: {
-        service: "hooks",
-        level: "error",
-        message: "Worktree hook script execution failed",
-        extra: {
-          script,
-          scriptPath,
-          error: error instanceof Error ? error.message : String(error),
-        },
-      },
+    await logToOpenCode(client, "error", "Worktree hook script execution failed", {
+      script,
+      scriptPath,
+      error: error instanceof Error ? error.message : String(error),
     });
     return {
       exitCode: 1,
@@ -285,28 +317,67 @@ const getCommandCwd = (args: Record<string, unknown>, directory: string) => {
 const replaceToken = (value: string, token: string, replacement: string) =>
   value.split(token).join(replacement);
 
+const isMissingFileError = (error: unknown) => {
+  const code =
+    typeof error === "object" && error !== null && "code" in error
+      ? (error as { code?: unknown }).code
+      : undefined;
+  return (
+    code === "ENOENT" ||
+    (error instanceof Error && /not found|no such file/i.test(error.message))
+  );
+};
+
 export const WorktreePlugin: Plugin = async ({ $, client, directory }) => {
   let config: WorktreePluginConfig = {
-    setupScript: "scripts/setup-worktree.ps1",
     pathContains: "worktrees/",
     reminderLines: [],
   };
+  let configError: string | undefined;
 
   try {
     const configPath = `${directory}/.opencode/worktree.json`;
-    const content = await (globalThis as any).Bun.file(configPath).text();
-    config = {
-      ...config,
-      ...JSON.parse(content),
-    };
-  } catch {
-    // Optional project config
+    const configFile = (globalThis as any).Bun.file(configPath);
+    if (
+      typeof configFile.exists === "function" &&
+      !(await configFile.exists())
+    ) {
+      // Optional project config.
+    } else {
+      const parsed = JSON.parse(await configFile.text()) as unknown;
+      if (!isPlainObject(parsed)) {
+        configError = "Worktree config must be a JSON object.";
+      } else {
+        configError = validateConfig(parsed);
+        if (!configError) {
+          config = { ...config, ...(parsed as WorktreePluginConfig) };
+        }
+      }
+    }
+  } catch (error) {
+    if (!isMissingFileError(error)) {
+      const couldNotParse = error instanceof SyntaxError;
+      configError = couldNotParse
+        ? "Worktree config could not be parsed as JSON."
+        : "Worktree config could not be read.";
+      await logToOpenCode(
+        client,
+        "warn",
+        couldNotParse
+          ? "Worktree config could not be parsed"
+          : "Worktree config could not be read",
+        error,
+      );
+    }
   }
 
   return {
     "tool.execute.after": async (input: any, output: any) => {
       try {
         const tool = (input.tool || "").toLowerCase();
+        const args = input.args || {};
+        const command = args.command || "";
+
         const payload = {
           event: "tool.execute.after",
           directory,
@@ -315,6 +386,11 @@ export const WorktreePlugin: Plugin = async ({ $, client, directory }) => {
         };
 
         if (tool === "enterworktree") {
+          if (configError) {
+            appendToolOutput(output, [configError]);
+            return;
+          }
+
           const docsReminderScript = resolveProjectPath(
             directory,
             config.docsReminderScript,
@@ -337,8 +413,6 @@ export const WorktreePlugin: Plugin = async ({ $, client, directory }) => {
 
         if (tool !== "bash") return;
 
-        const args = input.args || {};
-        const command = args.command || "";
         const commandLower = command.toLowerCase();
         const pathContains = toSlashes(
           config.pathContains || "worktrees/",
@@ -366,12 +440,24 @@ export const WorktreePlugin: Plugin = async ({ $, client, directory }) => {
           `worktrees/${worktreeName}`,
         );
 
-        if (!samePath(absoluteWorktreePath, expectedWorktreePath)) {
+        const isCanonicalPath = samePath(
+          absoluteWorktreePath,
+          expectedWorktreePath,
+        );
+        if (!isCanonicalPath) {
           appendToolOutput(output, [
             `Worktree path is not canonical: ${absoluteWorktreePath}`,
             `Use the project-local path instead: ${expectedWorktreePath}`,
             "Canonical rule: <project-root>/worktrees/<canonical-name> or <project-root>/worktrees/<canonical-name>-prNN.",
           ]);
+        }
+
+        if (configError) {
+          appendToolOutput(output, [configError]);
+          return;
+        }
+
+        if (!isCanonicalPath) {
           return;
         }
 
@@ -430,15 +516,16 @@ export const WorktreePlugin: Plugin = async ({ $, client, directory }) => {
           appendToolOutput(output, [banner]);
         }
       } catch (error) {
-        await client.app.log({
-          body: {
-            service: "hooks",
-            level: "error",
-            message: "Worktree plugin execution failed",
-            extra: {
-              error: error instanceof Error ? error.message : String(error),
-            },
-          },
+        const details = truncateMessage(
+          error instanceof Error ? error.message : String(error),
+        );
+        appendToolOutput(output, [
+          "Worktree plugin could not process this worktree command.",
+          "Run `git rev-parse --show-toplevel` from the project root and retry.",
+          ...(details ? [`Details: ${details}`] : []),
+        ]);
+        await logToOpenCode(client, "error", "Worktree plugin execution failed", {
+          error: error instanceof Error ? error.message : String(error),
         });
       }
     },