opencode-harness-kit 0.1.0 → 0.2.0

package/GLOBAL.md

@@ -54,7 +54,7 @@ to avoid this.
 
 ## Never
 
-- `git push`, publish, or open a pull request. A human does that.
+- Ask before `git push`, publish, or opening a pull request. Publishing is a human decision.
 - Commit a secret. If you find one, report it; do not move it.
 - Read or write `.env`, `.npmrc`, `.netrc`, `.git-credentials`. The guard
   blocks these and will keep blocking them.

package/README.md

@@ -1,6 +1,6 @@
 # opencode-harness-kit
 
-[![CI](https://github.com/crytobot459/space-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/crytobot459/space-harness/actions/workflows/ci.yml)
+[![CI](https://github.com/pham-canh/space-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/pham-canh/space-harness/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/opencode-harness-kit.svg)](https://www.npmjs.com/package/opencode-harness-kit)
 
 A harness kit for [OpenCode](https://opencode.ai) that is **model-agnostic by
@@ -15,10 +15,15 @@ your side — `npx` only downloads the published kit. Prefer git? The same three
 steps from a checkout (see [Install](#install)):
 
 ```bash
-git clone https://github.com/crytobot459/space-harness.git
+git clone https://github.com/pham-canh/space-harness.git
 ./bin/oc-harness.mjs init
 ```
 
+![demo: init and verify in one go](docs/demo/demo.gif)
+
+Regenerate it any time with `python3 docs/demo/render.py` (needs ffmpeg); the
+frames are drawn from real CLI output, not typed by hand.
+
 The three steps `init` runs, spelled out for when you want to know what
 happened (prefix with `npx` or `./bin/oc-harness.mjs` to taste):
 
@@ -114,17 +119,53 @@ on install. It is not hidden, it is labelled.
 | profile | context | top effort | retention |
 |---|---|---|---|
 | `space-bunny-free` (default) | 1,048,576 | `max` | zero-retention |
+| `muse-split-free` | 1,048,576 | `max` | **may train** |
 | `x-preview-f-free` | 1,000,000 | `max` | zero-retention |
 | `longcat-2.5-preview-free` | 1,000,000 | — | zero-retention |
 | `deepseek-v4-flash-free` | 200,000 | `max` | zero-retention |
 | `muse-spark-1.3-contributor-free` | 1,048,576 | `xhigh` | **may train** |
 
+### Split profiles
+
+A profile normally puts one model behind every role. `roleModels` is the way to
+split that, for when the best free model and the highest-output model are not the
+same model:
+
+```jsonc
+"model": "space-bunny-free",          // base: every role not named below
+"roleModels": {
+  "plan":     { "model": "muse-spark-1.3-contributor-free", "levels": ["minimal","low","medium","high","xhigh"] },
+  "build":    { "model": "muse-spark-1.3-contributor-free", "levels": ["minimal","low","medium","high","xhigh"] },
+  "locate":   { "model": "space-bunny-free", "levels": ["low","medium","high","xhigh","max"] }
+}
+```
+
+Three things fall out of this that are easy to get wrong, so they are enforced:
+
+- **`levels` is required when the model differs.** Effort is resolved against the
+  levels of the model the role actually runs on. `plan` asking for `max` on a
+  model that stops at `xhigh` lands on `xhigh`, instead of writing a `max` variant
+  the model has no meaning for.
+- **Retention is the least private model in the file, not the base one.** A base
+  of `zero-retention` with a `may-train` role is a `may-train` profile. The
+  generated header prints that, with the model responsible, and so do
+  `oc-harness use` and `oc-harness show`.
+- **Each role's output cap is its own.** A split role inherits the limits of the
+  model it names, so a `build` on a 131,072-token model cannot spend the base's
+  524,288.
+
+`muse-split-free` is the shipped example, and it is deliberately not the default:
+three of its five roles run on Muse Spark, a Meta contributor-tier endpoint whose
+provider may train on your prompts. Install it for public or throwaway
+repositories.
+
 ## Commands
 
 ```
 oc-harness list       profiles with retention and caveats
 oc-harness use <id>   compile a profile into ~/.config/opencode/opencode.jsonc
 oc-harness show <id>  resolved effort, derived numbers, fallback queue
+oc-harness use <id> --dryrun   print what would be written, write nothing
 oc-harness install    symlink the plugin, agents, skills and GLOBAL.md
 oc-harness verify     check the install against the profile; non-zero on drift
 oc-harness agents     report agents the effort tiering does not reach
@@ -235,8 +276,10 @@ Your numbers stay on your machine; only the script is in the repo.
 it was handed. It splits on shell separators, honours quotes so that a `;`
 inside a string is an argument rather than a second command, strips `env`,
 `sudo` and `git -C` before matching, and follows `sh -c "..."` into its payload.
-So `cd repo && git push`, `sudo rm -rf /` and `bash -c "git push"` are all
-caught, while `git log --grep push` and `git push origin my-feature-f` are not.
+So `cd repo && rm -rf /`, `sudo rm -rf /` and `bash -c "rm -rf /"` are all
+caught, while `git log --grep push` and `echo push` are not. `git push` is
+not guard-blocked; it falls through to the `*` ask permission so opencode
+prompts for human approval before publishing.
 Writes are scoped to the project directory, with the OS temp directory as the
 one exception GLOBAL.md allows.
 
@@ -295,7 +338,7 @@ identically:
 
 ```bash
 pkg install nodejs git
-git clone https://github.com/crytobot459/space-harness.git
+git clone https://github.com/pham-canh/space-harness.git
 ./space-harness/bin/oc-harness.mjs init
 ```
 

package/agents/build.md

@@ -50,7 +50,7 @@ You implement one task from a plan. One. Not the whole plan.
   cannot complete the task, say so before writing a partial one.
 - Never widen the change. A drive-by refactor in the same file is a separate
   task; do not report it as part of this one.
-- Never `git push`, never publish, never open a pull request. Committing is
+- Ask before `git push`, publish, or opening a pull request. Committing is
   allowed but only when the task asked for it.
 - Never fabricate a passing result. A failing test reported honestly is worth
   more than a green one you did not get.

package/bin/oc-harness.mjs

@@ -27,6 +27,8 @@ import {
   profilePath,
   pruneThreshold,
   reservedTokens,
+  effectiveRetention,
+  roleSplitModels,
   resolveDefaultVariant,
   resolveRoles,
   ProfileError,
@@ -146,7 +148,20 @@ function cmdShow(id) {
   row("attachment", p.supports?.attachment ? "yes" : stamp("no"))
   row("reserved", reservedTokens(p).toLocaleString("en-US"))
   row("prune at", pruneThreshold(p).toLocaleString("en-US"))
-  row("retention", p.retention === "zero-retention" ? green(p.retention) : yellow(p.retention))
+  // Effective, not the base model's: a split profile's base can be
+  // zero-retention while the roles that matter are not.
+  const eff = effectiveRetention(p)
+  row("retention", eff.retention === "zero-retention" ? green(eff.retention) : yellow(eff.retention))
+  if (eff.retention !== p.retention) {
+    console.log(`  ${"".padEnd(20)} ${stamp(`base ${p.model} is ${p.retention}, but ${eff.worst} makes the whole profile ${eff.retention}`)}`)
+  }
+  if (roleSplitModels(p).length) {
+    console.log(`\n  ${bold("role models")}`)
+    for (const s of roleSplitModels(p)) {
+      const cap = s.limits ? `  out ${s.limits.output.toLocaleString("en-US")}` : ""
+      console.log(`  ${s.role.padEnd(20)} ${s.model}${cap}`)
+    }
+  }
 
   console.log(`\n  ${bold("role effort")}`)
   for (const [role, level] of Object.entries(plan.roles)) {
@@ -563,7 +578,14 @@ function configDrift(p, actual) {
       out.push(`agent.${role} missing`)
       continue
     }
-    if (agent.model !== want) out.push(`agent.${role}.model ${agent.model} -> ${want}`)
+    // A role's expected model is the one roleModels declares for it, falling
+    // back to the base. Comparing every agent against `want` would report
+    // drift on every split role forever, which trains the user to ignore the
+    // one command that exists to catch a moved `build`.
+    const wantRole = `${p.provider}/${p.roleModels?.[role]?.model ?? p.model}`
+    if (agent.model !== wantRole) {
+      out.push(`agent.${role}.model ${agent.model} -> ${wantRole}`)
+    }
     if (agent.variant !== (level ?? undefined)) {
       out.push(`agent.${role}.variant ${agent.variant ?? "(none)"} -> ${level ?? "(none)"}`)
     }
@@ -620,6 +642,15 @@ async function cmdUse(id) {
     return
   }
 
+  // A flag that is accepted and then ignored is worse than one that errors:
+  // `--dryrun` used to write the real config anyway.
+  if (has("--dryrun")) {
+    console.log(`\n  ${stamp("dry run, nothing written")}`)
+    console.log(`  ${stamp(`would write ${CONFIG_FILE}`)}`)
+    summary(p)
+    return
+  }
+
   mkdirSync(dirname(CONFIG_FILE), { recursive: true })
   if (existsSync(CONFIG_FILE) && !has("--yes")) {
     // The config is the user's file once written. A backup is made either
@@ -632,11 +663,28 @@ async function cmdUse(id) {
   }
   writeFileSync(CONFIG_FILE, out)
   console.log(`\n  ${green("✓")} wrote ${CONFIG_FILE}`)
+  summary(p)
+  console.log(`\n  ${stamp("verify with: opencode debug config")}\n`)
+}
+
+/** What the profile puts behind the user, including a split and real retention. */
+function summary(p) {
+  const eff = effectiveRetention(p)
+  const splits = roleSplitModels(p)
   console.log(`  ${stamp(`model      ${p.provider}/${p.model}`)}`)
   console.log(`  ${stamp(`effort     ${resolveDefaultVariant(p) ?? "(not tunable)"}`)}`)
   console.log(`  ${stamp(`roles      ${Object.entries(resolveRoles(p)).map(([k, v]) => `${k}=${v ?? "-"}`).join(" ")}`)}`)
+  if (splits.length) {
+    // Without this the split is invisible until someone opens the file, which
+    // is too late to be told which roles send prompts to a provider that trains.
+    console.log(`  ${stamp(`split      ${splits.map((s) => `${s.role}=${s.model}`).join(" ")}`)}`)
+    console.log(`  ${stamp(`           ${splits.map((s) => s.limits ? `${s.role} out ${s.limits.output.toLocaleString("en-US")}` : null).filter(Boolean).join("  ")}`)}`)
+  }
+  console.log(`  ${stamp(`retention  ${eff.retention}${eff.retention === "may-train" ? "  <-- prompts may train a model" : ""}`)}`)
+  if (splits.length && eff.retention !== p.retention) {
+    console.log(`  ${stamp(`           base ${p.model} is ${p.retention}, but ${eff.worst} makes the whole profile ${eff.retention}`)}`)
+  }
   console.log(`  ${stamp(`reserved   ${reservedTokens(p).toLocaleString("en-US")} tokens`)}`)
-  console.log(`\n  ${stamp("verify with: opencode debug config")}\n`)
 }
 
 /** opencode.jsonc is JSONC, so strip comments before parsing. */

package/dist/index.js

@@ -140,26 +140,6 @@ function tokenize(segment) {
 var ENV_ASSIGN = /^[A-Za-z_][A-Za-z0-9_]*=/;
 var GIT_WRAPPERS = /* @__PURE__ */ new Set(["env", "sudo", "doas", "nohup", "time", "command", "exec", "xargs"]);
 var WRAPPER_VALUE_FLAGS = /* @__PURE__ */ new Set(["-u", "--user", "-g", "--group", "-I", "-P", "-n", "-a", "-d"]);
-var GIT_VALUE_FLAGS = /* @__PURE__ */ new Set([
-  "-C",
-  "-c",
-  "--git-dir",
-  "--work-tree",
-  "--namespace",
-  "--super-prefix",
-  "--exec-path",
-  "--config-env"
-]);
-var GIT_GLOBAL_FLAGS = /* @__PURE__ */ new Set([
-  "--bare",
-  "--no-pager",
-  "--paginate",
-  "--no-replace-objects",
-  "--no-optional-locks",
-  "--literal-pathspecs",
-  "--glob-pathspecs",
-  "--icase-pathspecs"
-]);
 function skipPrefixes(tokens) {
   let i = 0;
   for (; ; ) {
@@ -190,26 +170,6 @@ function stripPrefixes(segment) {
   if (slash !== -1) rest[0] = rest[0].slice(slash + 1);
   return rest.join(" ");
 }
-function gitSubcommand(segment) {
-  const tokens = tokenize(segment);
-  let i = skipPrefixes(tokens);
-  if (i >= tokens.length) return null;
-  if (!/(^|[\\/])git(\.exe)?$/i.test(tokens[i])) return null;
-  i++;
-  while (i < tokens.length) {
-    const flag = tokens[i];
-    if (GIT_VALUE_FLAGS.has(flag)) {
-      i += 2;
-      continue;
-    }
-    if (/^--[A-Za-z][\w-]*=/.test(flag) || GIT_GLOBAL_FLAGS.has(flag)) {
-      i++;
-      continue;
-    }
-    break;
-  }
-  return tokens[i] ?? null;
-}
 var SHELL_BIN = /(^|[\\/])(sh|bash|zsh|dash|ksh)(\.exe)?$/i;
 var MAX_SHELL_DEPTH = 2;
 function shellPayload(segment) {
@@ -240,21 +200,9 @@ var BASH_RULES = [
     test: /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|python[0-9.]*)\b/i,
     why: "downloads and executes a script in one step"
   },
-  {
-    name: "git push with force",
-    scope: "segment",
-    // A dry run publishes nothing, so it is not the thing being gated.
-    check: (seg) => gitSubcommand(seg) === "push" && tokenize(seg).some((w) => w === "--force" || w === "-f" || w.startsWith("--force")),
-    why: "overwrites published history"
-  },
-  {
-    name: "git push",
-    scope: "segment",
-    // Flags are matched as whole words: a `-f` in `my-feature-f` is a branch
-    // name, not a force flag.
-    check: (seg) => gitSubcommand(seg) === "push" && !tokenize(seg).some((w) => w === "--dry-run" || w === "-n"),
-    why: "publishing is a human decision"
-  },
+  // `git push` is ask-gated via permissions (`*` ask in the generated
+  // config), not guard-blocked. Publishing needs human approval, but the
+  // guard lets it through so opencode can prompt first.
   {
     name: "recursive delete",
     scope: "segment",
@@ -453,6 +401,31 @@ function validate(p, path = "<memory>") {
       `${where}: effort.reserveShare must be between 0 and 0.5`
     );
   }
+  for (const [role, rm] of Object.entries(p.roleModels ?? {})) {
+    if (!SPLITTABLE_ROLES.includes(role)) {
+      throw new ProfileError(
+        `${where}: roleModels.${role} is not one of ${SPLITTABLE_ROLES.join(", ")}`
+      );
+    }
+    if (!(role in (p.roles ?? {}))) {
+      throw new ProfileError(
+        `${where}: roleModels.${role} has no matching entry in roles, so it would never apply`
+      );
+    }
+    if (!rm?.model || typeof rm.model !== "string") {
+      throw new ProfileError(`${where}: roleModels.${role} needs a model`);
+    }
+    if (rm.levels !== void 0 && !Array.isArray(rm.levels)) {
+      throw new ProfileError(
+        `${where}: roleModels.${role}.levels must be an array`
+      );
+    }
+    if (!retentionFor(rm.model)) {
+      throw new ProfileError(
+        `${where}: roleModels.${role} names ${rm.model}, which has no retention.yml entry`
+      );
+    }
+  }
 }
 var CANON = ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
 function resolveEffort(levels, requested) {
@@ -476,27 +449,116 @@ function resolveEffort(levels, requested) {
   }
   return best ?? levels[levels.length - 1] ?? null;
 }
+function resolveRoleModel(p, role) {
+  const rm = p.roleModels?.[role];
+  if (!rm) return null;
+  return { model: rm.model, levels: rm.levels ?? [] };
+}
+function levelsForRole(p, role) {
+  const rm = resolveRoleModel(p, role);
+  if (rm) return rm.levels;
+  return p.effort?.levels ?? [];
+}
 function resolveRoles(p) {
-  const levels = p.effort?.levels ?? [];
   const out = (
     /** @type {Record<string, string | null>} */
     {}
   );
   for (const [role, want] of Object.entries(p.roles ?? {})) {
-    out[role] = resolveEffort(levels, want);
+    out[role] = resolveEffort(levelsForRole(p, role), want);
   }
   return out;
 }
 function resolveDefaultVariant(p) {
   return resolveEffort(p.effort?.levels ?? [], p.effort?.default ?? null);
 }
+var SPLITTABLE_ROLES = ["plan", "build", "reviewer", "locate", "verify"];
+function inputCap(p) {
+  let cap = p.limits.input ?? p.limits.context;
+  for (const s of roleSplitModels(p)) {
+    const other = s.limits?.input ?? s.limits?.context;
+    if (typeof other === "number" && other > cap) cap = other;
+  }
+  return cap;
+}
 function reservedTokens(p) {
-  const input = p.limits.input ?? p.limits.context;
   const share = p.effort?.reserveShare ?? 0.12;
-  return Math.max(8e3, Math.round(input * share));
+  return Math.max(8e3, Math.round(inputCap(p) * share));
 }
 function pruneThreshold(p) {
-  return (p.limits.input ?? p.limits.context) - reservedTokens(p);
+  return inputCap(p) - reservedTokens(p);
+}
+function loadRetention() {
+  const file = join(ROOT, "retention.yml");
+  if (!existsSync(file)) return {};
+  const out = (
+    /** @type {Record<string, any>} */
+    {}
+  );
+  const lines = readFileSync(file, "utf8").split("\n");
+  let current = null;
+  let i = 0;
+  while (i < lines.length) {
+    const raw = lines[i];
+    const line = raw.trim();
+    const indent = raw.length - raw.trimStart().length;
+    if (!line || line.startsWith("#")) {
+      i++;
+      continue;
+    }
+    if (indent === 2 && line.endsWith(":")) {
+      const key = line.slice(0, -1).trim();
+      current = key.includes("/") ? key : `opencode/${key}`;
+      out[current] = { retention: "unknown" };
+      i++;
+      continue;
+    }
+    if (!current) {
+      i++;
+      continue;
+    }
+    const field = line.match(/^(retention|verified|source|note):\s*(.*)$/);
+    if (field) {
+      const name = field[1];
+      const rest = field[2].trim();
+      if (/^[>|][-+]?$/.test(rest)) {
+        const parts = [];
+        let j = i + 1;
+        for (; j < lines.length; j++) {
+          const l = lines[j];
+          if (!l.trim()) {
+            parts.push("");
+            continue;
+          }
+          if (l.length - l.trimStart().length <= indent) break;
+          parts.push(l.trim());
+        }
+        out[current][name] = parts.join(" ").replace(/\s+/g, " ").trim();
+        i = j;
+        continue;
+      }
+      out[current][name] = rest.replace(/^["']|["']$/g, "");
+      i++;
+      continue;
+    }
+    i++;
+  }
+  return out;
+}
+function retentionFor(id) {
+  const table = loadRetention();
+  return table[id] ?? table[id.includes("/") ? id : `opencode/${id}`];
+}
+function roleSplitModels(p) {
+  return Object.entries(p.roleModels ?? {}).map(([role, rm]) => {
+    let limits = null;
+    try {
+      limits = loadProfile(rm.model)?.limits ?? null;
+    } catch {
+      limits = null;
+    }
+    return { role, model: rm.model, levels: rm.levels ?? [], limits };
+  });
 }
 function configFilePath() {
   const dir = process.env.OPENCODE_CONFIG_DIR ?? join(process.env.HOME ?? "", ".config", "opencode");

package/docs/demo/render.py

@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+"""Render the space-harness demo video from REAL CLI output.
+
+Nothing here is typed by hand: the script runs `init` and `verify` against a
+throwaway config dir, captures what the CLI actually prints, and draws that.
+The only cosmetic edit is replacing the random tmp path with
+~/.config/opencode so the frames stay readable.
+"""
+import os
+import re
+import subprocess
+import sys
+import tempfile
+
+from PIL import Image, ImageDraw, ImageFont
+
+REPO = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))  # docs/demo/render.py -> repo root
+ROOT = REPO
+BIN = ["node", os.path.join(ROOT, "bin", "oc-harness.mjs")]
+W, H = 1280, 720
+FPS = 15
+FONT = ImageFont.truetype("/System/Library/Fonts/Menlo.ttc", 22)
+LINE_H = 34
+TOP = 40
+LEFT = 48
+BG = (13, 17, 23)
+WHITE = (230, 237, 243)
+GREEN = (63, 185, 80)
+DIM = (139, 148, 158)
+YELLOW = (210, 153, 34)
+RED = (248, 81, 73)
+
+ANSI = re.compile(r"\x1b\[(\d+)m")
+
+
+def run_clip(args, cfg):
+    env = dict(os.environ, OPENCODE_CONFIG_DIR=cfg)
+    p = subprocess.run(BIN + args, capture_output=True, text=True, env=env, cwd=ROOT)
+    assert p.returncode == 0, p.stderr[-2000:]
+    out = (p.stdout + p.stderr).replace(cfg, "~/.config/opencode")
+    return [ln.rstrip() for ln in out.splitlines()]
+
+
+def spans(line):
+    """Split an ANSI-coloured line into (text, colour) runs."""
+    runs, cur, buf = [], WHITE, ""
+    pos = 0
+    for m in ANSI.finditer(line):
+        if m.start() > pos:
+            buf += line[pos : m.start()]
+        code = m.group(1)
+        if buf:
+            runs.append((buf, cur))
+            buf = ""
+        cur = {"0": WHITE, "1": WHITE, "2": DIM, "31": RED, "32": GREEN, "33": YELLOW}.get(code, WHITE)
+        pos = m.end()
+    if pos < len(line):
+        buf += line[pos:]
+    if buf:
+        runs.append((buf, cur))
+    return runs or [("", WHITE)]
+
+
+def draw_terminal(draw, lines, prompt="$ "):
+    draw.rectangle([0, 0, W, H], fill=BG)
+    maxl = (H - TOP) // LINE_H
+    if len(lines) > maxl:
+        head = [lines[0]] if lines[0][0] == "cmd" else []
+        lines = head + [ln for ln in lines if ln[0] != "cmd"][-(maxl - len(head)) :]
+    y = TOP
+    for kind, payload in lines:
+        if y > H - LINE_H:
+            break
+        if kind == "cmd":
+            draw.text((LEFT, y), prompt, font=FONT, fill=GREEN)
+            x = LEFT + draw.textlength(prompt, font=FONT)
+            for text, colour in spans(payload):
+                draw.text((x, y), text, font=FONT, fill=colour)
+                x += draw.textlength(text, font=FONT)
+        elif kind == "card":
+            text, colour = payload
+            draw.text((LEFT, y), text, font=FONT, fill=colour)
+        else:
+            x = LEFT
+            for text, colour in spans(payload):
+                draw.text((x, y), text, font=FONT, fill=colour)
+                x += draw.textlength(text, font=FONT)
+        y += LINE_H
+
+
+def frames_for_command(cmd, output):
+    frames = []
+    typed = ""
+    for ch in cmd:
+        typed += ch
+        frames.append([("cmd", typed)])
+    for i in range(0, len(output), 2):
+        frames.append([("cmd", cmd)] + [("out", ln) for ln in output[: i + 2]])
+    full = [("cmd", cmd)] + [("out", ln) for ln in output]
+    frames.extend([full] * (2 * FPS))
+    return frames
+
+
+def card(lines, hold=2):
+    return [[("card", ln) for ln in lines]] * (hold * FPS)
+
+
+def main(out_dir):
+    cfg = tempfile.mkdtemp(prefix="demo-")
+    init_out = run_clip(["init", "--profile", "space-bunny-free", "--yes"], cfg)
+    verify_out = run_clip(["verify"], cfg)
+    seq = []
+    seq += card([(("space-harness", WHITE)), (("one command from zero to working", DIM))], hold=2)
+    seq += frames_for_command("npx -y opencode-harness-kit init", [l for l in init_out if l.strip()])
+    seq += frames_for_command("oc-harness verify", [l for l in verify_out if l.strip()])
+    seq += card(
+        [
+            (("done. restart opencode, then ask it something", GREEN)),
+            (("github.com/crytobot459/space-harness", WHITE)),
+            (("free models. verified setup.", DIM)),
+        ],
+        hold=3,
+    )
+    os.makedirs(out_dir, exist_ok=True)
+    frame_dir = tempfile.mkdtemp(prefix="frames-")
+    for i, lines in enumerate(seq):
+        flat = []
+        for kind, payload in lines:
+            flat.append((kind, payload))
+        img = Image.new("RGB", (W, H), BG)
+        draw_terminal(ImageDraw.Draw(img), flat)
+        img.save(os.path.join(frame_dir, f"f{i:04d}.png"))
+    mp4 = os.path.join(out_dir, "demo.mp4")
+    subprocess.run(
+        ["ffmpeg", "-y", "-v", "error", "-framerate", str(FPS), "-i", os.path.join(frame_dir, "f%04d.png"),
+         "-c:v", "libx264", "-pix_fmt", "yuv420p", "-crf", "23", mp4], check=True)
+    gif = os.path.join(out_dir, "demo.gif")
+    subprocess.run(
+        ["ffmpeg", "-y", "-v", "error", "-framerate", "10", "-i", os.path.join(frame_dir, "f%04d.png"),
+         "-vf", "scale=640:-1:flags=lanczos,split[s0][s1];[s0]palettegen=max_colors=64[p];[s1][p]paletteuse",
+         gif], check=True)
+    print(f"wrote {mp4} ({os.path.getsize(mp4)//1024}KB) and {gif} ({os.path.getsize(gif)//1024}KB)")
+
+
+if __name__ == "__main__":
+    main(sys.argv[1] if len(sys.argv) > 1 else os.path.join(ROOT, "docs", "demo"))

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Model-agnostic harness kit for OpenCode: capability profiles, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
+  "homepage": "https://github.com/pham-canh/space-harness#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/crytobot459/space-harness.git"
+    "url": "git+https://github.com/pham-canh/space-harness.git"
+  },
+  "bugs": {
+    "url": "https://github.com/pham-canh/space-harness/issues"
   },
   "type": "module",
   "main": "./dist/index.js",

package/profiles/index.json

@@ -2,6 +2,24 @@
   "$comment": "Profiles verified against live provider metadata. `retention` must come from retention.yml; a model missing there cannot enter this list.",
   "default": "space-bunny-free",
   "profiles": [
+    {
+      "id": "muse-split-free",
+      "file": "profiles/muse-split-free.json",
+      "title": "Muse Spark 1.3 (heavy) + Space Bunny Free (bulk output)",
+      "retention": "may-train",
+      "free": true,
+      "topEffort": "max",
+      "context": 1048576,
+      "default": false,
+      "split": {
+        "plan": "muse-spark-1.3-contributor-free",
+        "build": "muse-spark-1.3-contributor-free",
+        "reviewer": "muse-spark-1.3-contributor-free",
+        "locate": "space-bunny-free",
+        "verify": "space-bunny-free"
+      },
+      "note": "Retention here is the effective one: three roles run on Muse Spark, so the file is may-train even though the base model is zero-retention."
+    },
     {
       "id": "space-bunny-free",
       "file": "profiles/space-bunny-free.json",

package/profiles/muse-split-free.json

@@ -0,0 +1,64 @@
+{
+  "$comment": "Split profile. The heavy reasoning roles run on Muse Spark 1.3 because it is the strongest free model on Zen by a wide margin (Terminal-Bench 2.1 88.8% vs Nemotron 3 Ultra's 56.4%, DeepSWE v1.1 75.4%). The bulk-output roles stay on Space Bunny because its 524,288-token output cap is 4x Muse Spark's 131,072, and scaffolding or migrating many files is where that ceiling is actually felt. `retention` below describes the BASE model only; the config header prints the effective retention, which is may-train because three roles run on Muse Spark.",
+  "id": "muse-split-free",
+  "title": "Muse Spark 1.3 (heavy) + Space Bunny Free (bulk output)",
+  "provider": "opencode",
+  "model": "space-bunny-free",
+  "family": null,
+  "verified": "2026-10-07",
+  "retention": "zero-retention",
+  "notes": "Opt-in split, not a default. Muse Spark is a Meta contributor-tier free endpoint: its provider may train on your prompts and completions. Three of the five roles are therefore may-train even though the base model is zero-retention. Install it only for public or throwaway repositories. Effort requests below are resolved against each role's own model, so plan and reviewer ask for `max` and land on `xhigh`, which is the top Muse Spark offers.",
+  "limits": {
+    "context": 1048576,
+    "input": 524288,
+    "output": 524288
+  },
+  "supports": {
+    "reasoning": true,
+    "temperature": false,
+    "toolCall": true,
+    "structuredOutput": false,
+    "attachment": true
+  },
+  "effort": {
+    "levels": ["low", "medium", "high", "xhigh", "max"],
+    "default": "max",
+    "reserveShare": 0.12
+  },
+  "roles": {
+    "plan": "max",
+    "build": "high",
+    "reviewer": "max",
+    "locate": "low",
+    "verify": "low"
+  },
+  "roleModels": {
+    "plan": {
+      "model": "muse-spark-1.3-contributor-free",
+      "levels": ["minimal", "low", "medium", "high", "xhigh"]
+    },
+    "build": {
+      "model": "muse-spark-1.3-contributor-free",
+      "levels": ["minimal", "low", "medium", "high", "xhigh"]
+    },
+    "reviewer": {
+      "model": "muse-spark-1.3-contributor-free",
+      "levels": ["minimal", "low", "medium", "high", "xhigh"]
+    },
+    "locate": {
+      "model": "space-bunny-free",
+      "levels": ["low", "medium", "high", "xhigh", "max"]
+    },
+    "verify": {
+      "model": "space-bunny-free",
+      "levels": ["low", "medium", "high", "xhigh", "max"]
+    }
+  },
+  "prune": {
+    "enabled": true,
+    "keepRecentToolCalls": 6,
+    "keepRecentTurns": 3,
+    "keepUserMessages": true
+  },
+  "fallback": ["x-preview-f-free", "longcat-2.5-preview-free", "deepseek-v4-flash-free"]
+}

package/profiles/schema.json

@@ -90,6 +90,18 @@
         "verify": { "$ref": "#/definitions/effortRequest" }
       }
     },
+    "roleModels": {
+      "type": "object",
+      "description": "Model per agent role, for a profile that splits the heavy reasoning roles onto a stronger model while the bulk-output roles stay on a high-output one. `model` remains the base: roles not named here, the top-level `model`, and `small_model` all resolve to it.",
+      "additionalProperties": false,
+      "properties": {
+        "plan": { "$ref": "#/definitions/roleModel" },
+        "build": { "$ref": "#/definitions/roleModel" },
+        "reviewer": { "$ref": "#/definitions/roleModel" },
+        "locate": { "$ref": "#/definitions/roleModel" },
+        "verify": { "$ref": "#/definitions/roleModel" }
+      }
+    },
     "prune": {
       "type": "object",
       "additionalProperties": false,
@@ -122,6 +134,23 @@
     }
   },
   "definitions": {
+    "roleModel": {
+      "type": "object",
+      "description": "A model for one role, plus the effort levels that model actually offers. Required when the model differs from the base, because a level the model does not have must never be written onto the agent.",
+      "additionalProperties": false,
+      "required": ["model"],
+      "properties": {
+        "model": {
+          "type": "string",
+          "description": "Model id without the provider prefix. Must resolve to a profile in this directory, so its limits and retention are known."
+        },
+        "levels": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Effort levels this role's model offers. Omitted means the role emits no variant at all, which is the right reading for a model with no tunable effort."
+        }
+      }
+    },
     "effortRequest": {
       "oneOf": [
         { "type": "string", "description": "Desired level, resolved to the nearest available one." },

package/skills/space-finish/SKILL.md

@@ -47,10 +47,10 @@ over an unreviewed or blocked change is the failure this skill exists to stop.
 
 ## The publish boundary
 
-Publishing is a human action. Do not `git push`, do not open a pull request, do
-not publish a package, do not change repository visibility, even if the task
-seems to imply it. The guard will block `git push` in code, but the boundary
-is yours to hold, not only the hook's.
+Publishing needs human approval. Ask before `git push`, opening a pull request,
+publishing a package, or changing repository visibility, even if the task
+seems to imply it. Permissions default to ask so opencode prompts first, but
+the boundary is yours to hold, not only the hook's.
 
 Leave the tree in a state a human can review: on a branch, with the change
 visible in `git diff`.

package/src/config.js

@@ -4,7 +4,7 @@
 // defaults, experimental flags - is fixed here. Everything model-specific is
 // derived from the profile, so switching models changes only the profile file.
 
-import { pruneThreshold, reservedTokens, resolveRoles, resolveDefaultVariant } from "./profile.js"
+import { pruneThreshold, reservedTokens, inputCap, effectiveRetention, resolveRoleModel, resolveRoles, resolveDefaultVariant, roleSplitModels } from "./profile.js"
 
 import { join } from "node:path"
 import { homedir } from "node:os"
@@ -87,8 +87,8 @@ export const BASH_ALLOWLIST = [
 
 /** Hard blocks. The guard plugin enforces the same set in code. */
 export const BASH_DENYLIST = [
-  "git push *",
-  "git push*",
+  // `git push` is intentionally absent: it falls through to the `*` ask rule
+  // so opencode prompts for human approval before publishing.
   "rm -rf *",
   "rm -fr *",
   "curl * | sh",
@@ -143,11 +143,16 @@ export function generateConfig(p, opts = {}) {
   for (const [role, level] of Object.entries(roles)) {
     if (level === undefined) continue
     const existing = { ...(agent[role] ?? {}) }
+    const rm = resolveRoleModel(p, role)
     // The model is pinned, never inherited. Preserving a model already written
     // on the agent is how `build` ended up on a `may-train` model while the rest
     // of the file claimed the profile's zero-retention one: the compiler was
     // asked to re-run over a hand-edited config and kept the hand-edit.
-    existing.model = model
+    //
+    // `roleModels` is the one sanctioned way a role differs, because it is
+    // declared in the profile next to the model it points at and validated
+    // against retention.yml. Still an assignment, never a preserved value.
+    existing.model = rm ? `${p.provider}/${rm.model}` : model
     if (level === null) delete existing.variant
     else existing.variant = level
     if (AGENT_PERMISSIONS[role]) {
@@ -280,22 +285,49 @@ function render(cfg, p, opts) {
   const levels = p.effort?.levels ?? []
   const roles = resolveRoles(p)
 
+  const effective = effectiveRetention(p)
+  // The input cap that actually governs context management, which on a split
+  // profile is the widest role model rather than the base. The header must name
+  // it, or `reserved` and `prune` read as arithmetic against a number that is
+  // not the one they used.
+  const effectiveInput = inputCap(p)
+  const splits = Object.keys(p.roleModels ?? {})
   const head = [
     `${c}Generated by opencode-harness-kit. Edit profiles/${p.id}.json instead`,
     `${c}of this file, then re-run: oc-harness use ${p.id}`,
     `${c}`,
     `${c}profile      ${p.id}`,
     `${c}model        ${p.provider}/${p.model}`,
+    ...(splits.length
+      ? [
+          `${c}split        ${splits.map((r) => `${r}=${p.roleModels?.[r]?.model}`).join("  ")}`,
+          `${c}             (roles not listed above run on the base model above)`,
+        ]
+      : []),
     `${c}context      ${p.limits.context.toLocaleString("en-US")} tokens`,
-    `${c}input cap    ${input.toLocaleString("en-US")} tokens`,
+    `${c}input cap    ${input.toLocaleString("en-US")} tokens${effectiveInput !== input ? `  (base model; ${effectiveInput.toLocaleString("en-US")} governs split roles)` : ""}`,
     `${c}output cap   ${p.limits.output.toLocaleString("en-US")} tokens`,
     `${c}reasoning    ${levels.length ? levels.join(" < ") : "(not tunable)"}`,
-    `${c}retention    ${p.retention}${p.retention === "may-train" ? "  <-- prompts may train a model" : ""}`,
+    // The header must name the retention that actually applies, which with a
+    // split is the least private model in the file, not the base one. Printing
+    // `p.retention` here is the same class of bug as the inherited `build`
+    // model: the file claims a privacy property the agents do not have.
+    `${c}retention    ${effective.retention}${effective.retention === "may-train" ? "  <-- prompts may train a model" : ""}`,
+    ...(effective.retention !== p.retention
+      ? [
+          `${c}             base ${p.provider}/${p.model} is ${p.retention}, but ${effective.worst} makes the whole file ${effective.retention}`,
+        ]
+      : []),
     `${c}`,
     `${c}Derived numbers, do not hand-edit:`,
-    `${c}  compaction.reserved  ${reservedTokens(p).toLocaleString("en-US")}  (${Math.round((p.effort?.reserveShare ?? 0.12) * 100)}% of the input cap, held back for reasoning growth)`,
-    `${c}  prune threshold      ${pruneThreshold(p).toLocaleString("en-US")}  (input cap minus reserve)`,
+    `${c}  compaction.reserved  ${reservedTokens(p).toLocaleString("en-US")}  (${Math.round((p.effort?.reserveShare ?? 0.12) * 100)}% of the governing input cap${effectiveInput !== input ? `, ${effectiveInput.toLocaleString("en-US")} for the widest split role` : ""}, held back for reasoning growth)`,
+    `${c}  prune threshold      ${pruneThreshold(p).toLocaleString("en-US")}  (governing input cap minus reserve)`,
     `${c}  role effort          ${Object.entries(roles).map(([k, v]) => `${k}=${v ?? "unset"}`).join("  ")}`,
+    ...(roleSplitModels(p).length
+      ? [
+          `${c}  role models          ${roleSplitModels(p).map((r) => `${r.role}=${r.model}${r.limits ? ` (out ${r.limits.output.toLocaleString("en-US")})` : ""}`).join("  ")}`,
+        ]
+      : []),
     `${c}  agent steps          ${Object.entries(AGENT_STEPS).filter(([r]) => roles[r]).map(([r, n]) => `${r}=${n}`).join("  ")}`,
   ]
 

package/src/profile.js

@@ -17,6 +17,7 @@ export const ROOT = resolve(HERE, "..")
 /**
  * @typedef {"zero-retention" | "may-train" | "unknown"} Retention
  * @typedef {string | null} EffortRequest
+ * @typedef {{ model: string, levels?: string[] }} RoleModel
  * @typedef {object} Profile
  * @property {string} id
  * @property {string} [title]
@@ -31,6 +32,7 @@ export const ROOT = resolve(HERE, "..")
  *             structuredOutput?: boolean, attachment?: boolean }} [supports]
  * @property {{ levels?: string[], default?: string | null, reserveShare?: number }} [effort]
  * @property {Record<string, EffortRequest>} [roles]
+ * @property {Record<string, RoleModel>} [roleModels]
  * @property {{ enabled?: boolean, keepRecentToolCalls?: number,
  *             keepRecentTurns?: number, keepUserMessages?: boolean }} [prune]
  * @property {string[]} [fallback]
@@ -135,6 +137,35 @@ export function validate(p, path = "<memory>") {
       `${where}: effort.reserveShare must be between 0 and 0.5`,
     )
   }
+  for (const [role, rm] of Object.entries(p.roleModels ?? {})) {
+    if (!SPLITTABLE_ROLES.includes(role)) {
+      throw new ProfileError(
+        `${where}: roleModels.${role} is not one of ${SPLITTABLE_ROLES.join(", ")}`,
+      )
+    }
+    // resolveRoles walks `roles`, so a split for a role nobody asks for never
+    // reaches an agent. That reads as "split installed" while doing nothing.
+    if (!(role in (p.roles ?? {}))) {
+      throw new ProfileError(
+        `${where}: roleModels.${role} has no matching entry in roles, so it would never apply`,
+      )
+    }
+    if (!rm?.model || typeof rm.model !== "string") {
+      throw new ProfileError(`${where}: roleModels.${role} needs a model`)
+    }
+    if (rm.levels !== undefined && !Array.isArray(rm.levels)) {
+      throw new ProfileError(
+        `${where}: roleModels.${role}.levels must be an array`,
+      )
+    }
+    // retention.yml is the only place retention is decided, so a role model
+    // missing from it is a profile we cannot honestly write a header for.
+    if (!retentionFor(rm.model)) {
+      throw new ProfileError(
+        `${where}: roleModels.${role} names ${rm.model}, which has no retention.yml entry`,
+      )
+    }
+  }
 }
 
 // Canonical ordering for reasoning effort, used to snap a requested level onto
@@ -178,15 +209,45 @@ export function resolveEffort(levels, requested) {
   return best ?? levels[levels.length - 1] ?? null
 }
 
+/**
+ * Model and effort levels for one role, or null when the role stays on the
+ * profile's base model.
+ *
+ * @param {Profile} p
+ * @param {string} role
+ * @returns {{ model: string, levels: string[] } | null}
+ */
+export function resolveRoleModel(p, role) {
+  const rm = p.roleModels?.[role]
+  if (!rm) return null
+  return { model: rm.model, levels: rm.levels ?? [] }
+}
+
+/**
+ * Effort levels a role's own model offers. Falls back to the profile's when the
+ * role is not split out, so an unsplit profile behaves exactly as before.
+ *
+ * @param {Profile} p
+ * @param {string} role
+ * @returns {string[]}
+ */
+function levelsForRole(p, role) {
+  const rm = resolveRoleModel(p, role)
+  if (rm) return rm.levels
+  return p.effort?.levels ?? []
+}
+
 /**
  * @param {Profile} p
  * @returns {Record<string, string | null>}
  */
 export function resolveRoles(p) {
-  const levels = p.effort?.levels ?? []
   const out = /** @type {Record<string, string | null>} */ ({})
   for (const [role, want] of Object.entries(p.roles ?? {})) {
-    out[role] = resolveEffort(levels, want)
+    // Resolve against the levels of the model this role actually runs on. A
+    // role asking for `max` on a model topping out at `xhigh` gets `xhigh`,
+    // which is only correct if the profile knows the role's real model.
+    out[role] = resolveEffort(levelsForRole(p, role), want)
   }
   return out
 }
@@ -201,10 +262,39 @@ export function resolveDefaultVariant(p) {
  * tool output. Scaled from the model, never hardcoded.
  * @param {Profile} p @returns {number}
  */
+// The roles a profile may split onto another model. Kept in step with
+// `roleModels` in profiles/schema.json, which nothing validates at runtime.
+const SPLITTABLE_ROLES = ["plan", "build", "reviewer", "locate", "verify"]
+
+/**
+ * The model whose limits govern context management: the one with the widest
+ * input cap, not necessarily the base model.
+ *
+ * A split profile derives `reserved` and `prune` from a single `limits`, but
+ * the roles do not share it. Sizing for the narrowest input cap silently
+ * throttles every wider role to under half its real window, which is the whole
+ * point of running them on a bigger model. Sizing for the widest means no role
+ * can be under-reserved, which is the direction that has to be safe.
+ *
+ * @param {Profile} p
+ * @returns {number}
+ */
+export function inputCap(p) {
+  let cap = p.limits.input ?? p.limits.context
+  for (const s of roleSplitModels(p)) {
+    const other = s.limits?.input ?? s.limits?.context
+    if (typeof other === "number" && other > cap) cap = other
+  }
+  return cap
+}
+
+/**
+ * @param {Profile} p
+ * @returns {number}
+ */
 export function reservedTokens(p) {
-  const input = p.limits.input ?? p.limits.context
   const share = p.effort?.reserveShare ?? 0.12
-  return Math.max(8000, Math.round(input * share))
+  return Math.max(8000, Math.round(inputCap(p) * share))
 }
 
 /**
@@ -212,7 +302,7 @@ export function reservedTokens(p) {
  * @param {Profile} p @returns {number}
  */
 export function pruneThreshold(p) {
-  return (p.limits.input ?? p.limits.context) - reservedTokens(p)
+  return inputCap(p) - reservedTokens(p)
 }
 
 /**
@@ -296,6 +386,67 @@ export function retentionFor(id) {
   return table[id] ?? table[id.includes("/") ? id : `opencode/${id}`]
 }
 
+/**
+ * Every model a profile can put behind the user, base plus any split roles.
+ *
+ * @param {Profile} p
+ * @returns {string[]}
+ */
+export function modelsInPlay(p) {
+  const out = [p.model]
+  for (const rm of Object.values(p.roleModels ?? {})) {
+    if (!out.includes(rm.model)) out.push(rm.model)
+  }
+  return out
+}
+
+/**
+ * The split roles, each with the limits of the model that role actually runs
+ * on. A role on a different model has a different output cap, and the header
+ * has to say so: reading "output cap 524,288" and assuming `build` can spend
+ * all of it is wrong whenever build is split onto a smaller model.
+ *
+ * @param {Profile} p
+ * @returns {{ role: string, model: string, levels: string[], limits: Profile["limits"] | null }[]}
+ */
+export function roleSplitModels(p) {
+  return Object.entries(p.roleModels ?? {}).map(([role, rm]) => {
+    let limits = null
+    try {
+      limits = loadProfile(rm.model)?.limits ?? null
+    } catch {
+      limits = null
+    }
+    return { role, model: rm.model, levels: rm.levels ?? [], limits }
+  })
+}
+
+// Ordered safest-first: a profile is only as private as its least private model.
+const RETENTION_SEVERITY = ["zero-retention", "unknown", "may-train"]
+
+/**
+ * The retention that actually applies once every role is considered, which is
+ * what a config header has to print. `retention.yml` is the source of truth.
+ *
+ * @param {Profile} p
+ * @returns {{ retention: string, worst: string | null }}
+ */
+export function effectiveRetention(p) {
+  let worst = null
+  let retention = "zero-retention"
+  for (const id of modelsInPlay(p)) {
+    const declared = retentionFor(id)?.retention ?? "unknown"
+    if (declared === "may-train") {
+      return { retention: "may-train", worst: id }
+    }
+    if (!worst || RETENTION_SEVERITY.indexOf(declared) > RETENTION_SEVERITY.indexOf(worst)) {
+      worst = declared
+    }
+    retention = worst
+  }
+  return { retention, worst }
+}
+
 /** Where opencode keeps its config, honouring the same env var it does. */
 export function configFilePath() {
   const dir =

package/src/rules.js

@@ -349,24 +349,9 @@ export const BASH_RULES = [
     test: /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|python[0-9.]*)\b/i,
     why: "downloads and executes a script in one step",
   },
-  {
-    name: "git push with force",
-    scope: "segment",
-    // A dry run publishes nothing, so it is not the thing being gated.
-    check: (seg) =>
-      gitSubcommand(seg) === "push" &&
-      tokenize(seg).some((w) => w === "--force" || w === "-f" || w.startsWith("--force")),
-    why: "overwrites published history",
-  },
-  {
-    name: "git push",
-    scope: "segment",
-    // Flags are matched as whole words: a `-f` in `my-feature-f` is a branch
-    // name, not a force flag.
-    check: (seg) =>
-      gitSubcommand(seg) === "push" && !tokenize(seg).some((w) => w === "--dry-run" || w === "-n"),
-    why: "publishing is a human decision",
-  },
+  // `git push` is ask-gated via permissions (`*` ask in the generated
+  // config), not guard-blocked. Publishing needs human approval, but the
+  // guard lets it through so opencode can prompt first.
   {
     name: "recursive delete",
     scope: "segment",