opencode-dispatcher 0.3.0 → 0.3.1

package/README.md

@@ -526,6 +526,8 @@ Use Dispatcher when the structure is worth it. Use the fast path or plain OpenCo
 
 ## Version History
 
+* **v0.3.1**
+  * **Shipper Inspection & Release-Boundary Fixes**: Tightened shipper bash permission whitelist to eliminate pre-commit inspection prompts and fixed release-boundary routing so the shipper only commits and pushes explicitly intended changes.
 * **v0.3.0**
   * **Model-Config Groups**: Replaced per-agent model selection with two-tier group-based workflow (MED/LOW), excluding orchestrator and task-planner.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-dispatcher",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "A low-context OpenCode dispatcher workflow with orchestrator agents and task artifacts.",
   "type": "module",
   "bin": {

package/workflow/agents/shipper.md

@@ -24,6 +24,14 @@ permission:
     "ls *": allow
     "npm run check": allow
     "npm run check *": allow
+    "grep *": allow
+    "head *": allow
+    "tail *": allow
+    "cat *": allow
+    "wc *": allow
+    "file *": allow
+    "git show*": allow
+    "node -p *": allow
     "git reset*": deny
     "git rebase*": deny
     "git clean*": deny
@@ -55,6 +63,7 @@ Hard boundaries:
 - Only push when orchestrator/user explicitly requests a push.
 - Do not amend, force-push, reset, rebase, clean, tag, or create PRs unless explicitly requested.
 - Do not prepare changes; only commit or push existing intended changes.
+- Version bump preparation, README.md edits, and changelog updates are out of scope for the shipper agent and must be prepared by other agents (implementer, executor, documentation) before shipper is invoked.
 - If branch/upstream ambiguity exists, report back to orchestrator instead of guessing.
 
 Required pre-commit inspection:
@@ -66,7 +75,7 @@ Required pre-commit inspection:
 - If multiple task artifact folders exist, include only the folders that match the current commit scope unless the user explicitly asks to commit everything.
 - Do not use `git commit -a` or `git commit -am`; explicitly stage intended files before committing.
 - Never include secrets, credentials, generated artifacts, or unrelated changes.
-- Run inspection commands separately; do not combine allowed commands with shell operators like &&, ||, or ;.
+- Run inspection commands individually; do not combine allowed commands with shell operators like |, &&, ||, or ;.
 - If the intended file set is unclear, stop and report the ambiguity to orchestrator.
 
 Commit message rules:

package/workflow/agents/task-planner.md

@@ -29,11 +29,7 @@ Single-unit workflow:
 - Make real architectural decisions based on conventions: which patterns to use, where new files go, what to change in existing files.
 - Add decision notes under `.ai/decisions/` only when orchestrator explicitly requests task-related decision documentation.
 - Do not edit implementation files, project docs outside `.ai/`, or source code.
-- Write an `## Execution` section in every task spec. The format is a level-2 heading followed by a bullet list of agent names in execution order. Valid agent names: `test-writer`, `implementer`, `documentation`. Never include `validator` — the orchestrator appends it automatically. Decision logic for choosing the pipeline:
-  - Feature/fix with testable acceptance criteria → `test-writer`, then `implementer`.
-  - Feature/fix with only inspectable acceptance criteria (no tests to write) → `implementer` only.
-  - Documentation task → `documentation` only.
-  - Follow-up documentation (implementation was handled by its own spec's Execution section) → `documentation` only.
+- Write an `## Execution` section in every task spec. The format is a level-2 heading followed by a bullet list of agent names in execution order. Valid agent names: `test-writer`, `implementer`, `documentation`. The `## Execution` section must contain only the agent bullet list — no explanatory orchestration notes.
 
 Multi-unit decomposition: