opencode-plugin-flow 4.0.1 → 4.1.1

package/CHANGELOG.md

@@ -3,7 +3,13 @@
 One short line per release. For the full rationale behind each entry, see the
 commit history and review evidence.
 
-## [Unreleased]
+## [4.1.1] - 2026-06-15
+
+Keep Flow's local session ledger out of Git by default with a generated `.flow/.gitignore`, while preserving opt-in versioning for teams that intentionally archive session evidence.
+
+## [4.1.0] - 2026-06-15
+
+Add Flow-native orchestration handoffs, verification gates, and a hidden verifier worker, inspired by Ray Fernando's parallel agent workflow skill work and RepoPrompt CE's context-engineering approach, while keeping the public runtime surface unchanged.
 
 ## [4.0.1] - 2026-06-15
 

package/README.md

@@ -1,16 +1,26 @@
 # Flow Plugin for OpenCode
 
-`opencode-plugin-flow` is a skills-first workflow helper for OpenCode. The skills carry the planning, execution, validation, cleanup, UI, and review guidance. The plugin code is deliberately small: it keeps a durable `.flow/session.json` ledger and enforces the few binary gates that prompts cannot reliably enforce.
+`opencode-plugin-flow` is a skills-first workflow helper for OpenCode. The skills carry planning, execution, validation, cleanup, UI quality, review, and orchestration judgment. The plugin code stays deliberately small: it keeps a durable `.flow/session.json` ledger and enforces the hard gates prompts should not be trusted to remember.
 
 Flow v4 is a breaking simplification. It does not preserve v3 session layouts or retired tool aliases.
 
+## What Flow adds
+
+- A resumable one-feature-at-a-time loop for larger coding work.
+- Skill-guided planning, running, validation, review, cleanup, and UI quality.
+- Hidden evidence, review, validation, audit, verifier, and candidate workers for broad work.
+- Structured handoffs with coverage, evidence, confidence, and gaps.
+- Runtime gates for approval immutability, validation evidence, review evidence, and safe session closure.
+
+The manager still owns every Flow state change. Workers gather evidence; they do not approve plans, complete features, or close sessions.
+
 ## Install
 
 Add Flow to your OpenCode config:
 
 ```json
 {
-  "plugin": ["opencode-plugin-flow@4.0.1"]
+  "plugin": ["opencode-plugin-flow@4.1.1"]
 }
 ```
 
@@ -45,7 +55,7 @@ Commands are thin pointers into skills:
 
 ## Tools
 
-The v4 runtime exposes seven tools:
+The runtime exposes seven tools:
 
 | Tool | Purpose |
 | --- | --- |
@@ -66,6 +76,7 @@ The runtime owns only safety:
 - `.flow/session.json` is the active source of truth.
 - `.flow/history/<session-id>.json` stores closed sessions.
 - Session writes are locked and atomic.
+- Flow writes `.flow/.gitignore` so session state stays out of Git by default.
 - Mutable roots cannot be filesystem roots or `$HOME`.
 - Plans cannot be changed after approval.
 - Only one feature can be active at a time.
@@ -74,7 +85,7 @@ The runtime owns only safety:
 - Final completion requires `validationScope: "broad"` and a passing final review matching the plan's `finalReviewPolicy`.
 - `flow_session_close` accepts `kind: "completed"` only after an approved plan has passed final completion.
 
-Planning quality, decomposition, review depth, validation adequacy, and recovery judgment live in the skills.
+Planning quality, decomposition, review depth, validation adequacy, orchestration, and recovery judgment live in the skills.
 
 ## State Layout
 
@@ -84,6 +95,10 @@ Planning quality, decomposition, review depth, validation adequacy, and recovery
 .flow/session.lock/
 ```
 
+Versioning `.flow` state is opt-in. Edit `.flow/.gitignore` or use
+`git add -f` only when a repository intentionally wants to archive Flow session
+evidence.
+
 ## Development
 
 ```bash
@@ -97,6 +112,12 @@ The package exports only the OpenCode plugin entrypoint:
 import flowPlugin from "opencode-plugin-flow";
 ```
 
+## Credits
+
+Flow's parallel orchestration guidance was inspired by Ray Fernando's skill work on parallel agent workflows. Flow also draws conceptual inspiration from [RepoPrompt CE](https://github.com/repoprompt/repoprompt-ce), especially its emphasis on codebase orientation, context engineering, agent orchestration, and reviewable handoffs.
+
+The Flow version is its own OpenCode-native design: skills-first, manager-owned state, hidden workers, and no extra runtime ledger.
+
 ## Uninstall
 
 ```bash

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import{createHash as g}from"node:crypto";import{mkdir as Xe,readdir as w,readFile as y,rm as b,writeFile as $e}from"node:fs/promises";import{dirname as Je,join as i,normalize as k,sep as x}from"node:path";var _=".flow-skill-version";function p(){return process.env.HOME??process.env.USERPROFILE??""}function R(e=p()){return i(e,".config","opencode","skills")}function I(e){return g("sha256").update(e).digest("hex")}async function u(e){try{return await y(e,"utf8")}catch(a){if(a.code==="ENOENT")return null;throw a}}function F(e){let a=new Map;if(!e)return a;for(let t of e.split(/\r?\n/)){let o=/^file=(.+) sha256=([a-f0-9]{64})$/.exec(t)??/^file=(.+)=sha256:([a-f0-9]{64})$/.exec(t);if(o?.[1]&&o[2])a.set(o[1],o[2]);let n=/^hash=sha256:([a-f0-9]{64})$/.exec(t);if(n?.[1]&&!a.has("SKILL.md"))a.set("SKILL.md",n[1])}return a}function C(e,a){let t=k(i(e,...a.split("/")));if(t!==e&&t.startsWith(`${e}${x}`))return t;throw Error(`Unsafe skill file path '${a}'.`)}async function h(e=p()){let a=R(e),t=[],o=[],n;try{n=await w(a)}catch(r){if(r.code==="ENOENT")return{removed:t,kept:o};throw r}for(let r of n){if(r!=="flow"&&!r.startsWith("flow-"))continue;let s=i(a,r),l=await u(i(s,_));if(l===null){o.push(s);continue}let f=F(l),d=!1;for(let[m,v]of f){let c=await u(C(s,m));if(c!==null&&I(c)!==v){d=!0;break}}if(d){o.push(s);continue}await b(s,{recursive:!0,force:!0}),t.push(s)}return{removed:t,kept:o}}async function A(e){if(e[2]!=="uninstall"){process.stderr.write(`usage: opencode-plugin-flow uninstall
-`),process.exitCode=2;return}let t=await h();for(let o of t.removed)process.stdout.write(`Removed Flow skill: ${o}
+import{createHash as g}from"node:crypto";import{mkdir as aa,readdir as w,readFile as y,rm as b,writeFile as ta}from"node:fs/promises";import{dirname as ra,join as i,normalize as k,sep as x}from"node:path";var _=".flow-skill-version";function h(){return process.env.HOME??process.env.USERPROFILE??""}function F(e=h()){return i(e,".config","opencode","skills")}function R(e){return g("sha256").update(e).digest("hex")}async function u(e){try{return await y(e,"utf8")}catch(a){if(a.code==="ENOENT")return null;throw a}}function I(e){let a=new Map;if(!e)return a;for(let t of e.split(/\r?\n/)){let o=/^file=(.+) sha256=([a-f0-9]{64})$/.exec(t)??/^file=(.+)=sha256:([a-f0-9]{64})$/.exec(t);if(o?.[1]&&o[2])a.set(o[1],o[2]);let n=/^hash=sha256:([a-f0-9]{64})$/.exec(t);if(n?.[1]&&!a.has("SKILL.md"))a.set("SKILL.md",n[1])}return a}function C(e,a){let t=k(i(e,...a.split("/")));if(t!==e&&t.startsWith(`${e}${x}`))return t;throw Error(`Unsafe skill file path '${a}'.`)}async function p(e=h()){let a=F(e),t=[],o=[],n;try{n=await w(a)}catch(r){if(r.code==="ENOENT")return{removed:t,kept:o};throw r}for(let r of n){if(r!=="flow"&&!r.startsWith("flow-"))continue;let s=i(a,r),c=await u(i(s,_));if(c===null){o.push(s);continue}let f=I(c),l=!1;for(let[m,v]of f){let d=await u(C(s,m));if(d!==null&&R(d)!==v){l=!0;break}}if(l){o.push(s);continue}await b(s,{recursive:!0,force:!0}),t.push(s)}return{removed:t,kept:o}}async function U(e){if(e[2]!=="uninstall"){process.stderr.write(`usage: opencode-plugin-flow uninstall
+`),process.exitCode=2;return}let t=await p();for(let o of t.removed)process.stdout.write(`Removed Flow skill: ${o}
 `);for(let o of t.kept)process.stdout.write(`Kept non-Flow or user-edited skill: ${o}
 `);process.stdout.write(`Remove "opencode-plugin-flow" from opencode.json and restart OpenCode.
-`)}A(process.argv).catch((e)=>{process.stderr.write(`${e instanceof Error?e.message:String(e)}
+`)}U(process.argv).catch((e)=>{process.stderr.write(`${e instanceof Error?e.message:String(e)}
 `),process.exitCode=1});