openvisio-agent 0.18.8 → 0.18.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openvisio-agent",
-  "version": "0.18.8",
+  "version": "0.18.9",
   "description": "Connect Claude Code, Codex, or OpenCode to an OpenVisio team — MCP tools + optional autonomy — in one command.",
   "type": "module",
   "bin": {

package/src/events.mjs

@@ -389,6 +389,34 @@ export function renderedAgentMessages(value, identity = {}) {
 
 const cleanAlias = (value) => String(value || '').trim().toLowerCase().replace(/^@/, '')
 
+const escapeRegex = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+// Mentions may use a display name containing spaces (for example,
+// `@Alex Morgan`). The generic handle matcher sees only `@Alex`, so find this
+// agent's known aliases first and discard overlapping generic matches. This
+// keeps recipient checks exact without reducing a full display name to an
+// ambiguous first name.
+function conversationMentions(value, selfAliases) {
+  const text = String(value || '')
+  const aliases = [...new Set((selfAliases || []).map(cleanAlias).filter(Boolean))]
+    .sort((a, b) => b.length - a.length)
+  const self = []
+  for (const alias of aliases) {
+    // A sentence-ending period is punctuation, while a period followed by a
+    // handle character is still part of an alias such as `alex.morgan`.
+    const pattern = new RegExp(`@${escapeRegex(alias)}(?![a-z0-9_-]|\\.(?=[a-z0-9]))`, 'gi')
+    for (const match of text.matchAll(pattern)) {
+      const index = match.index ?? 0
+      const end = index + match[0].length
+      if (!self.some((item) => index >= item.index && end <= item.end)) self.push({ name: alias, index, end })
+    }
+  }
+  const other = [...text.matchAll(/@([a-z0-9](?:[a-z0-9_.-]*[a-z0-9_-])?)(?=$|[^a-z0-9_.-]|\.(?:\s|$))/gi)]
+    .map((match) => ({ name: cleanAlias(match[1]), index: match.index ?? 0, end: (match.index ?? 0) + match[0].length }))
+    .filter((mention) => !self.some((item) => mention.index >= item.index && mention.end <= item.end))
+  return { self, other, all: [...self, ...other].sort((a, b) => a.index - b.index) }
+}
+
 export function messageSenderIsAgent(message) {
   const m = message && typeof message === 'object' ? message : {}
   if (m.senderAgent || m.sender_agent || m.agent || m.agent_id != null || m.sender_agent_id != null || m.senderAgentId != null) return true
@@ -404,11 +432,7 @@ export function messageSenderIsAgent(message) {
 export function classifyConversationTarget(message, selfAliases) {
   const m = message && typeof message === 'object' ? message : {}
   const text = String(m.content ?? m.body ?? m.text ?? m.message ?? '').replace(/\s+/g, ' ').trim()
-  const aliases = new Set((selfAliases || []).map(cleanAlias).filter(Boolean))
-  const mentions = [...text.matchAll(/@([a-z0-9](?:[a-z0-9_.-]*[a-z0-9_-])?)/gi)]
-    .map((match) => ({ name: cleanAlias(match[1]), index: match.index ?? 0, end: (match.index ?? 0) + match[0].length }))
-  const selfMentions = mentions.filter((mention) => aliases.has(mention.name))
-  const otherMentions = mentions.filter((mention) => !aliases.has(mention.name))
+  const { self: selfMentions, other: otherMentions, all: mentions } = conversationMentions(text, selfAliases)
   const explicitSelf = selfMentions.length > 0
 
   if (messageSenderIsAgent(m) && !explicitSelf) {
@@ -426,7 +450,14 @@ export function classifyConversationTarget(message, selfAliases) {
   if (explicitSelf && requestTargetsLaterAgent(text, selfAliases)) {
     return { action: 'ignore', reason: 'redirected-to-later-agent', text, explicitSelf, otherMentions: otherMentions.map((item) => item.name) }
   }
-  return { action: 'handle', reason: explicitSelf ? 'explicit-self-recipient' : 'eligible-follow-up', text, explicitSelf, otherMentions: otherMentions.map((item) => item.name) }
+  // A transport-level `agent:mention` can be emitted for every new message in a
+  // thread whose root once mentioned this agent. With no mention or explicit
+  // stand-down in the current message, ownership is ambiguous. Fail closed
+  // instead of making every agent that ever joined the thread answer it.
+  if (!explicitSelf) {
+    return { action: 'ignore', reason: 'unaddressed-thread-activity', text, explicitSelf, otherMentions: otherMentions.map((item) => item.name) }
+  }
+  return { action: 'handle', reason: 'explicit-self-recipient', text, explicitSelf, otherMentions: otherMentions.map((item) => item.name) }
 }
 
 // Require an actionable repository verb and a concrete code/repository object.
@@ -445,13 +476,12 @@ export function conversationNeedsCode(value) {
 // model starts, while keeping explicitly shared requests addressed to both.
 export function requestTargetsLaterAgent(text, selfAliases) {
   const value = String(text || '')
-  const aliases = new Set((selfAliases || []).map((v) => String(v || '').toLowerCase().replace(/^@/, '')).filter(Boolean))
-  if (!value || !aliases.size) return false
+  if (!value || !(selfAliases || []).some((alias) => cleanAlias(alias))) return false
 
-  const mentions = [...value.matchAll(/@([a-z0-9](?:[a-z0-9_.-]*[a-z0-9_-])?)/gi)].map((match) => ({ name: match[1].toLowerCase(), index: match.index ?? 0, end: (match.index ?? 0) + match[0].length }))
-  const self = mentions.find((mention) => aliases.has(mention.name))
+  const parsed = conversationMentions(value, selfAliases)
+  const self = parsed.self[0]
   if (!self) return false
-  const later = mentions.find((mention) => mention.index > self.index && !aliases.has(mention.name))
+  const later = parsed.other.find((mention) => mention.index > self.index)
   if (!later) return false
 
   const bridge = value.slice(self.end, later.index).toLowerCase()

package/src/opencode-config.mjs

@@ -13,7 +13,29 @@ export function opencodeRuntimeLayout({ cfgKey, workdir, baseDir = OV_DIR }) {
 
 export function buildOpencodeConfig({ mcpUrl, mcpHeaders, canCode = true }) {
   if (!mcpUrl && canCode) return null
-  const replyPermissions = { '*': 'deny', 'openvisio-team_*': 'allow' }
+  // Keep chat/reply runs genuinely MCP-only. `--auto` should honor a wildcard
+  // deny, but some OpenCode releases have still exposed built-ins through a
+  // merged/default agent configuration. Explicit denials prevent a reply cycle
+  // from invoking local grep (and hitting its 64 KiB JSON-record limit), reading
+  // the workspace, editing files, or delegating before the MCP allow-list wins.
+  const replyPermissions = {
+    '*': 'deny',
+    read: 'deny',
+    edit: 'deny',
+    glob: 'deny',
+    grep: 'deny',
+    list: 'deny',
+    bash: 'deny',
+    task: 'deny',
+    external_directory: 'deny',
+    todowrite: 'deny',
+    webfetch: 'deny',
+    websearch: 'deny',
+    lsp: 'deny',
+    skill: 'deny',
+    question: 'deny',
+    'openvisio-team_*': 'allow',
+  }
   return {
     $schema: 'https://opencode.ai/config.json',
     ...(!canCode ? {

package/src/watch.mjs

@@ -39,6 +39,7 @@ const REPLY_DISCIPLINE = [
   '  • NO DUPLICATES OR PICKUP NOISE. Before you post, scan the recent thread/channel for what YOU already said. If you already replied to this exact request, do NOT repeat the same message. Do not send a generic pickup acknowledgement; activity shows that work is underway. For longer code work, you may send at most one concrete progress update after work has actually begun, but that update NEVER completes the cycle: keep using tools, then send one distinct verified result or real blocker. One final answer per question.',
   '  • BE SURE BEFORE YOU SPEAK. Do not claim something is possible, done, or broken until you have actually verified it — call the tool, read the code, check the real state. Never assert then contradict yourself. If you are unsure, verify FIRST, then give ONE clear, final answer instead of thinking out loud across several messages.',
   '  • USE RECALL, NEVER INVENT IT. Before answering a context-dependent question, search the visible thread and use any available history, search, docs, or recall tools. Reuse verified context instead of asking the user to repeat it. If no record exists, say plainly "I don\'t have a record of that". Never fabricate past events, conversations, results, links, PR numbers, deploy URLs, or figures.',
+  '  • LOOK UP ASSIGNED WORK. If someone says they assigned you a task, asks which task is yours, or asks for its status, check the live board yourself with list_agents + list_projects + list_tasks and then get_ticket as needed. Match assignments to your authenticated agent identity. Do not ask the teammate for a project slug, ticket slug, or numeric id before trying those MCP tools; ask only if the live lookup fails or returns genuinely ambiguous matches.',
   '  • TICKET SLUGS, NEVER DATABASE IDS. In every human-facing channel message, ticket comment, PR description, summary, blocker, and result, reference a ticket by the exact project-scoped slug returned by get_ticket/list_tasks (for example, `OVS-57`). Numeric project_id and ticket_id values are internal MCP arguments only: never write `#57`, `ticket 57`, or expose a database id to teammates. If the backend omits the slug, use the ticket title or say “the ticket”; do not invent a slug.',
   '  • CLOSE CONCERNS. Never leave a concern, direct question, correction, or blocker addressed to you without a clear response. Acknowledge the concern, act if you can, then report the verified result. If blocked, name the blocker and the exact next action or owner in one message.',
   '  • WRITE PLAINLY. Prefer short sentences, commas, periods, and colons. Avoid em dashes except when reproducing quoted text.',
@@ -46,7 +47,7 @@ const REPLY_DISCIPLINE = [
 
 // ── CHAT-ONLY agents (no --workdir): chat/ticket tools, no code surface. ──────
 const CHAT_CHARTER = [
-  'YOU ARE a connected agent in an OpenVisio team, running in CHAT-ONLY mode. Use only tools that actually appear in your openvisio-team tool list. Backend MCP provides post_message, react_message, list_agents, list_projects, list_tasks, get_ticket, update_ticket, and list_activity. A ticket-comment tool is optional and must not be assumed. Some relay runtimes also provide poll_inbox or get_marching_orders. Never call a tool that is absent. You have NO file/Bash/git tools in this mode, so you cannot write code yourself.',
+  'YOU ARE a connected agent in an OpenVisio team, running in CHAT-ONLY mode. Use only tools that actually appear in your openvisio-team tool list. Backend MCP provides post_message, react_message, list_agents, list_projects, list_tasks, get_ticket, update_ticket, and list_activity. A ticket-comment tool is optional and must not be assumed. Some relay runtimes also provide poll_inbox or get_marching_orders. Never call a tool that is absent. You have NO local read, grep, glob, list, file, Bash, git, web, or delegation tools in this mode; use the OpenVisio MCP for live team state and do not inspect the local workspace.',
   'WORK ETHIC — behave like a dependable teammate: never leave a promise dangling. Either ACT now (reply, or file a ticket) or say plainly you can\'t and offer to file a ticket / tag a coding agent who can. Never invent progress. Close the loop every cycle — the human should never have to remind you to circle back.',
   '',
   REPLY_DISCIPLINE,
@@ -789,7 +790,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   const fullPrompt = (canCode ? CODE_FULL + codexPushGuide : 'Handle the supplied verified backend ticket with the available OpenVisio tools. Update or comment on the ticket as requested, do not claim repository work in chat-only mode, and stop after the verified action.') + '\n\n' + backendToolRule
   const fastPrompt = (canCode ? CODE_FAST : CYCLE_FAST) + '\n\n' + backendToolRule
   const coordinatePrompt = COORDINATE + '\n\n' + backendToolRule
-  const guardedReplyPrompt = 'WATCHER-DELIVERED REPLY: the watcher has already verified that the current source message is addressed to you. Do not call post_message or any inbox/resource-discovery tool. Return only one natural, context-specific reply of 1-3 sentences. Do not echo the request, announce a plan, or add a generic acknowledgement. If the supplied context says the work was completed, lead with the verified result; if it is blocked, name only the real blocker and next action.' + '\n\n' + backendToolRule
+  const guardedReplyPrompt = 'WATCHER-DELIVERED REPLY: the watcher has already verified that the current source message is addressed to you. Do not call post_message, relay inbox tools, or MCP resource APIs. OpenVisio team-state tools are allowed: when the answer depends on live projects, assignments, tickets, or status, call list_agents/list_projects/list_tasks/get_ticket yourself before answering and never ask the teammate for a slug that those tools can resolve. Return only one natural, context-specific reply of 1-3 sentences. Do not echo the request, announce a plan, or add a generic acknowledgement. If the supplied context says the work was completed, lead with the verified result; if it is blocked, name only the real blocker and next action.' + '\n\n' + backendToolRule
   // Live model state — changeable at runtime by the in-chat `/model` command.
   // codeModel drives full/sweep cycles; chatModel (if set) the lighter fast/intro
   // ones, so routine chatter can run cheaper than real code work.