leos-agent 6.1.1 → 6.3.0

package/config/models.json

@@ -1,7 +1,257 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
+  "capabilities": [
+    {
+      "key": "policyInjection",
+      "label": "Policy injection",
+      "modes": [
+        "hook",
+        "config-file",
+        "tool-result",
+        "none"
+      ],
+      "values": {
+        "claude": {
+          "mode": "hook",
+          "note": "`SessionStart` hook, on every startup / resume / clear / compact"
+        },
+        "codex": {
+          "mode": "hook",
+          "note": "`SessionStart` hook, on every startup / resume / clear / compact"
+        },
+        "cursor": {
+          "mode": "hook",
+          "note": "`sessionStart` hook, every session"
+        },
+        "hermes": {
+          "mode": "tool-result",
+          "note": "rides the session's first tool result — so a session that runs no tool gets none; read `leo:using-leo` if the policy is not already in your context"
+        },
+        "opencode": {
+          "mode": "config-file",
+          "note": "`config.instructions`, with a system-prompt transform as backstop"
+        }
+      }
+    },
+    {
+      "key": "subagentSpawn",
+      "label": "Subagent spawn",
+      "modes": [
+        "native-agent",
+        "generic-prompt",
+        "delegate-task"
+      ],
+      "values": {
+        "claude": {
+          "mode": "native-agent",
+          "note": "spawn the named native agent; its generated frontmatter pins the model"
+        },
+        "codex": {
+          "mode": "generic-prompt",
+          "note": "generic subagent with `roles/<role>.md` pasted in"
+        },
+        "cursor": {
+          "mode": "native-agent",
+          "note": "plugin agent from the generated Cursor agents directory"
+        },
+        "hermes": {
+          "mode": "delegate-task",
+          "note": "native `delegate_task`, canonical role prompt pasted in"
+        },
+        "opencode": {
+          "mode": "native-agent",
+          "note": "registered agent from `agents.json`, spawned via the task tool"
+        }
+      }
+    },
+    {
+      "key": "perSpawnModel",
+      "label": "Per-spawn model",
+      "modes": [
+        "yes",
+        "no"
+      ],
+      "values": {
+        "claude": {
+          "mode": "yes",
+          "note": "yes — the agent's own frontmatter"
+        },
+        "codex": {
+          "mode": "yes",
+          "note": "yes — pass `model` and `reasoning_effort` explicitly; a user or `AGENTS.md` override still wins"
+        },
+        "cursor": {
+          "mode": "no",
+          "note": "no — agents are `model: inherit`; select the tier's model in the UI before a homogeneous batch"
+        },
+        "hermes": {
+          "mode": "no",
+          "note": "no — one `delegation.model` for every child, so batch homogeneous Kimi or GLM work and switch it between batches"
+        },
+        "opencode": {
+          "mode": "no",
+          "note": "no — each agent always runs its registered model, so `reviewer` never downscales on a trivial diff"
+        }
+      }
+    },
+    {
+      "key": "readOnlyRoles",
+      "label": "Read-only roles",
+      "modes": [
+        "tools",
+        "frontmatter",
+        "permission",
+        "prompt"
+      ],
+      "values": {
+        "claude": {
+          "mode": "tools",
+          "note": "harness-enforced — the tool allowlist omits Write and Edit"
+        },
+        "codex": {
+          "mode": "prompt",
+          "note": "prompt only — a convention, never a guarantee; never route work here that depends on it"
+        },
+        "cursor": {
+          "mode": "frontmatter",
+          "note": "harness-enforced — generated `readonly: true`"
+        },
+        "hermes": {
+          "mode": "prompt",
+          "note": "prompt only — a convention, never a guarantee; never route work here that depends on it"
+        },
+        "opencode": {
+          "mode": "permission",
+          "note": "harness-enforced — generated `permission.edit: deny`, refused by OpenCode itself"
+        }
+      }
+    },
+    {
+      "key": "worktrees",
+      "label": "Worktrees",
+      "modes": [
+        "native-tool",
+        "raw-git"
+      ],
+      "values": {
+        "claude": {
+          "mode": "native-tool",
+          "note": "`EnterWorktree` / `ExitWorktree`, session-tracked and auto-cleaned; pair every Enter with an Exit"
+        },
+        "codex": {
+          "mode": "raw-git",
+          "note": "no native tool — raw `git worktree` at `.claude/worktrees/<name>`"
+        },
+        "cursor": {
+          "mode": "raw-git",
+          "note": "no native tool — raw `git worktree` at `.claude/worktrees/<name>`"
+        },
+        "hermes": {
+          "mode": "raw-git",
+          "note": "no native tool — raw `git worktree` at `.claude/worktrees/<name>`"
+        },
+        "opencode": {
+          "mode": "raw-git",
+          "note": "no native tool — raw `git worktree` at `.claude/worktrees/<name>`"
+        }
+      }
+    },
+    {
+      "key": "workflowRunner",
+      "label": "Workflow runner",
+      "modes": [
+        "workflow-tool",
+        "none"
+      ],
+      "values": {
+        "claude": {
+          "mode": "workflow-tool",
+          "note": "the Workflow tool runs `workflows/cost-tiered-fix.js` by `scriptPath`"
+        },
+        "codex": {
+          "mode": "none",
+          "note": "none — fan out by hand and keep the ledger in `<plugin-root>/scripts/state.py`"
+        },
+        "cursor": {
+          "mode": "none",
+          "note": "none — fan out by hand and keep the ledger in `<plugin-root>/scripts/state.py`"
+        },
+        "hermes": {
+          "mode": "none",
+          "note": "none — fan out by hand and keep the ledger in `<plugin-root>/scripts/state.py`"
+        },
+        "opencode": {
+          "mode": "none",
+          "note": "no runner — `cost-tiered-fix.js` ships in the package but nothing here executes it; fan out by hand and keep the ledger in `<plugin-root>/scripts/state.py`"
+        }
+      }
+    },
+    {
+      "key": "followUp",
+      "label": "Follow-up to a live agent",
+      "modes": [
+        "tool",
+        "none",
+        "unknown"
+      ],
+      "values": {
+        "claude": {
+          "mode": "tool",
+          "note": "`SendMessage` to the same agent, which keeps the context it already built"
+        },
+        "codex": {
+          "mode": "unknown",
+          "note": "none established — re-dispatch cold with the context restated"
+        },
+        "cursor": {
+          "mode": "unknown",
+          "note": "none established — re-dispatch cold with the context restated"
+        },
+        "hermes": {
+          "mode": "unknown",
+          "note": "none established — re-dispatch cold with the context restated"
+        },
+        "opencode": {
+          "mode": "unknown",
+          "note": "none established — re-dispatch cold with the context restated"
+        }
+      }
+    },
+    {
+      "key": "skillNames",
+      "label": "Skill names",
+      "modes": [
+        "prefixed",
+        "bare"
+      ],
+      "values": {
+        "claude": {
+          "mode": "prefixed",
+          "note": "`leo:<name>`"
+        },
+        "codex": {
+          "mode": "prefixed",
+          "note": "`leo:<name>`"
+        },
+        "cursor": {
+          "mode": "prefixed",
+          "note": "`leo:<name>`"
+        },
+        "hermes": {
+          "mode": "prefixed",
+          "note": "`leo:<name>`"
+        },
+        "opencode": {
+          "mode": "bare",
+          "note": "bare `<name>` — read every `leo:<x>` above as `<x>`"
+        }
+      }
+    }
+  ],
   "skills": {
-    "claudeOnly": ["attach-pr", "resolve-ticket", "review-pr", "watch-review"],
+    "claudeOnly": [
+      "attach-pr"
+    ],
     "exclude": {
       "claude": [],
       "cursor": [],
@@ -10,53 +260,149 @@
       "opencode": []
     },
     "reasons": {
-      "attach-pr": "its entire purpose is Claude Code Desktop's PR-card detector, which no other harness has, and it reaches its resolver through a Claude-only skill-directory placeholder",
-      "resolve-ticket": "needs plugin-path placeholders, a pinned Claude model, and Claude-only subagent, worktree, and question tools",
-      "review-pr": "its whole mechanism is a script reached through a Claude-only skill-directory placeholder, plus a pinned Claude model",
-      "watch-review": "pinned Claude model, and it drives review-pr through Claude Code's own skill-invocation tool"
+      "attach-pr": "its entire product is a side effect in Claude Code Desktop's PR-card detector, which no other harness has — the same commands would run here, succeed, and produce nothing observable"
     }
   },
+  "visual": {
+    "claude": "the Browser pane (start or attach a preview, then take a screenshot), an attached Chrome, or the iOS Simulator control tool; some arrive only after a tool search, so an empty tool list is not proof of absence",
+    "codex": "the bundled browser plugin, else computer-use, else Playwright driven from the shell",
+    "cursor": "Browser Preview against a running dev server, else a Playwright server if one is registered",
+    "hermes": "no built-in renderer; Playwright driven from the shell is the only rung, and only when the project already depends on it",
+    "opencode": "no built-in renderer; a registered Playwright server or the Playwright CLI"
+  },
+  "memoryTarget": {
+    "claude": "the per-user `CLAUDE.md` in the Claude config directory",
+    "codex": "the per-user `AGENTS.md` in the Codex home directory",
+    "cursor": "a generated rules file in the per-user Cursor rules directory",
+    "hermes": "`SOUL.md` in the Hermes home, and only once `leo:setup enable hermes-memory` turns it on — that file is the agent's own identity prompt, so it is never written to unasked and never created",
+    "opencode": "the per-user `AGENTS.md` in the OpenCode config directory"
+  },
   "roles": {
-    "expert": "fable",
-    "planner": "opus",
-    "investigator": "opus",
-    "reviewer": "opus",
-    "implementer": "sonnet",
-    "executor": "haiku",
-    "explore": "haiku"
+    "expert": {
+      "tier": "fable",
+      "access": "read-only"
+    },
+    "planner": {
+      "tier": "opus",
+      "access": "read-only"
+    },
+    "investigator": {
+      "tier": "opus",
+      "access": "read-only"
+    },
+    "reviewer": {
+      "tier": "opus",
+      "access": "read-only"
+    },
+    "implementer": {
+      "tier": "sonnet",
+      "access": "write"
+    },
+    "executor": {
+      "tier": "haiku",
+      "access": "write"
+    },
+    "explore": {
+      "tier": "haiku",
+      "access": "read-only"
+    }
   },
   "harnesses": {
     "claude": {
-      "fable": { "model": "fable", "effort": "max" },
-      "opus": { "model": "opus" },
-      "sonnet": { "model": "sonnet" },
-      "haiku": { "model": "haiku" }
+      "title": "Claude Code",
+      "fable": {
+        "model": "fable",
+        "effort": "max"
+      },
+      "opus": {
+        "model": "opus"
+      },
+      "sonnet": {
+        "model": "sonnet"
+      },
+      "haiku": {
+        "model": "haiku"
+      }
     },
     "cursor": {
-      "fable": { "model": "GPT-5.6 Sol" },
-      "opus": { "model": "Grok 4.5" },
-      "sonnet": { "model": "Grok 4.5" },
-      "haiku": { "model": "Composer 2.5" }
+      "title": "Cursor",
+      "fable": {
+        "model": "GPT-5.6 Sol"
+      },
+      "opus": {
+        "model": "Grok 4.5"
+      },
+      "sonnet": {
+        "model": "Grok 4.5"
+      },
+      "haiku": {
+        "model": "Composer 2.5"
+      }
     },
     "codex": {
-      "fable": { "model": "gpt-5.6-sol", "effort": "max" },
-      "opus": { "model": "gpt-5.6-sol", "effort": "high" },
-      "sonnet": { "model": "gpt-5.6-terra", "effort": "medium" },
-      "haiku": { "model": "gpt-5.6-luna", "effort": "low" }
+      "title": "Codex",
+      "fable": {
+        "model": "gpt-5.6-sol",
+        "effort": "max"
+      },
+      "opus": {
+        "model": "gpt-5.6-sol",
+        "effort": "high"
+      },
+      "sonnet": {
+        "model": "gpt-5.6-terra",
+        "effort": "medium"
+      },
+      "haiku": {
+        "model": "gpt-5.6-luna",
+        "effort": "low"
+      }
     },
     "hermes": {
+      "title": "Hermes",
       "provider": "openrouter",
-      "fable": { "model": "moonshotai/kimi-k3" },
-      "opus": { "model": "moonshotai/kimi-k3" },
-      "sonnet": { "model": "z-ai/glm-5.2" },
-      "haiku": { "model": "z-ai/glm-5.2" }
+      "fable": {
+        "model": "moonshotai/kimi-k3"
+      },
+      "opus": {
+        "model": "moonshotai/kimi-k3"
+      },
+      "sonnet": {
+        "model": "z-ai/glm-5.2"
+      },
+      "haiku": {
+        "model": "z-ai/glm-5.2"
+      }
     },
     "opencode": {
+      "title": "OpenCode",
       "provider": "openrouter",
-      "fable": { "model": "moonshotai/kimi-k3" },
-      "opus": { "model": "moonshotai/kimi-k3" },
-      "sonnet": { "model": "z-ai/glm-5.2" },
-      "haiku": { "model": "z-ai/glm-5.2" }
+      "absentTiers": [
+        "fable"
+      ],
+      "adapter": {
+        "readOnlyPermission": {
+          "edit": "deny"
+        },
+        "writeBashDeny": [
+          "rm -rf ~",
+          "rm -rf ~/*",
+          "rm -rf /",
+          "rm -rf /*"
+        ]
+      },
+      "fable": {
+        "model": "moonshotai/kimi-k3"
+      },
+      "opus": {
+        "model": "moonshotai/kimi-k3"
+      },
+      "sonnet": {
+        "model": "z-ai/glm-5.2"
+      },
+      "haiku": {
+        "model": "z-ai/glm-5.2"
+      }
     }
   }
 }

package/hooks/session-start.py

@@ -72,6 +72,20 @@ def _breadcrumb(exc):
         pass
 
 
+def _memory_block(root):
+    """Refresh the store, project it, and return the index for this project.
+
+    Imported rather than spawned: this hook has a 10-second budget and a
+    subprocess would spend a chunk of it on interpreter startup alone.
+    """
+    scripts = os.path.join(root, "scripts")
+    if scripts not in sys.path:
+        sys.path.insert(0, scripts)
+    import memory
+
+    return memory.session(os.getcwd())
+
+
 def main():
     try:
         root = _root()
@@ -98,6 +112,19 @@ def main():
 
         wrapped = "<leo-policy>\n" + body + "\n</leo-policy>"
 
+        # Memory rides in its own envelope, appended after substitution: it is
+        # data, not policy, and keeping the two separable lets each be measured
+        # against the budget on its own. The nested handler is load-bearing —
+        # the outer one drops the entire policy, and a broken memory store must
+        # never cost the session its operating instructions.
+        try:
+            memory_block = _memory_block(root)
+        except Exception as exc:
+            _breadcrumb(exc)
+            memory_block = ""
+        if memory_block:
+            wrapped += "\n\n<leo-memory>\n" + memory_block.rstrip("\n") + "\n</leo-memory>"
+
         if harness == "cursor":
             output = {"additional_context": wrapped}
         else:

package/package.json

@@ -1,14 +1,28 @@
 {
   "name": "leos-agent",
-  "version": "6.1.1",
+  "version": "6.3.0",
   "description": "Leo's agent operating policy: cost-tiered routing, subagent roles, review gates, guardrails.",
   "type": "module",
   "main": "adapters/opencode/plugin.js",
-  "exports": { ".": "./adapters/opencode/plugin.js" },
+  "exports": {
+    ".": "./adapters/opencode/plugin.js"
+  },
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/foxhatleo/leos-agent.git" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/foxhatleo/leos-agent.git"
+  },
   "homepage": "https://github.com/foxhatleo/leos-agent",
-  "files": ["adapters/", "config/", "hooks/", "roles/", "scripts/", "skills/", "workflows/", "settings.json"],
+  "files": [
+    "adapters/",
+    "config/",
+    "hooks/",
+    "roles/",
+    "scripts/",
+    "skills/",
+    "workflows/",
+    "settings.json"
+  ],
   "scripts": {
     "//prepack": "A `files` whitelist overrides .npmignore for directory entries, so local test runs leak __pycache__/*.pyc into the tarball. Clear them before packing.",
     "prepack": "find . -name __pycache__ -type d -prune -exec rm -rf {} +"

package/roles/executor.md

@@ -12,4 +12,4 @@ You are a fast, precise executor for mechanical tasks. You are given exact, well
 - Return a terse report: what changed (file paths), what you verified and its result, and `confidence: high | medium | low`.
 - Prefix that report with `status: done | concerns | needs-context | blocked` on its own first line — leo:delegation's four-state contract. The STOP case above is `needs-context` when the missing piece is one the orchestrator holds (an exact path, the intended name, a yes/no) and `blocked` when it is not (the instruction contradicts the code, or a check fails for reasons outside this task). Never guess your way to `done`. `confidence` still reports how sure you are of the edit itself.
 
-Checks follow leo:verification: run fresh, read the actual output, report the evidence — not "should pass." If a supposedly mechanical change turns out to alter runtime behavior, leo:test-first applies; otherwise name the exemption rather than skipping silently.
+Checks follow leo:verification: run fresh, read the actual output, report the evidence — not "should pass." If a supposedly mechanical change turns out to alter runtime behavior, leo:test-first applies; otherwise name the exemption rather than skipping silently. A call into a third-party API follows leo:freshness, and a change that alters what someone sees on screen follows leo:visual-verification.

package/roles/implementer.md

@@ -13,4 +13,4 @@ You are the implementer: you turn an approved plan into working code.
 - Report: files changed (paths), checks run and results, deviations from the plan and why, `confidence: high | medium | low`. Your work will be reviewed at the Opus tier against the plan — flag anything uncertain rather than burying it.
 - Prefix that report with `status: done | concerns | needs-context | blocked` on its own first line — leo:delegation's four-state contract. The stop-and-report cases above map onto it: architectural disagreement with the plan, or the same failure twice, is `blocked`; a missing path, decision, or credential the orchestrator can hand over is `needs-context`; `concerns` is plan executed but something wants a second look. `status` routes the orchestrator, `confidence` says how sure you are of the code — report both, always.
 
-Execution follows leo:executing-plans — checkpoint per batch, one fix-then-re-review cycle, stop-and-report on architectural disagreement rather than pushing through. A behavior change defaults to leo:test-first with that skill's named exemptions; a change with no runtime behavior names the exemption instead of skipping silently. Every "checks pass" claim follows leo:verification — a fresh run, output actually read, not assumed.
+Execution follows leo:executing-plans — checkpoint per batch, one fix-then-re-review cycle, stop-and-report on architectural disagreement rather than pushing through. A behavior change defaults to leo:test-first with that skill's named exemptions; a change with no runtime behavior names the exemption instead of skipping silently. Every "checks pass" claim follows leo:verification — a fresh run, output actually read, not assumed. A third-party surface follows leo:freshness — confirm the shape against the installed package or current docs before the call is written, or name the exemption. A change someone can see follows leo:visual-verification — a render produced after the edit, or the unverified warning instead of a done report.

package/roles/reviewer.md

@@ -19,6 +19,7 @@ What to judge, in order
 5. Checks — were the claimed checks sufficient? Re-run one cheap decisive check if in doubt.
 6. Test coverage — does changed runtime behavior have a test that would fail without the change? Missing coverage is a finding, blocking when the behavior is load-bearing.
 7. Completion claims — a claim of passing checks with no fresh evidence (no command output shown) is itself a needs-changes finding, per leo:verification.
+8. Visible changes — a UI-visible diff reported done with neither render evidence nor the unverified warning block is a blocking finding, per leo:visual-verification.
 8. Secrets — a credential, token, private key, or `.env` value added to a tracked file is always a blocking finding, whether or not the task mentioned it. Check any new config, fixture, test data, or CI file the diff touches.
 Style, naming, and hypothetical refactors are NOT findings.