thoth-agents 0.12.0 → 0.13.0

package/dist/index.js

@@ -2,10 +2,14 @@ import {
   formatGateVerdict,
   summarizeGateResult
 } from "./chunk-JLU3FSBT.js";
+import {
+  profileRpc,
+  toolRpc
+} from "./chunk-6O4GKDS7.js";
 import {
   createAgents,
   renderOpenCodeAgentConfigs
-} from "./chunk-QOA2AETX.js";
+} from "./chunk-NOLDFT7O.js";
 import {
   context7,
   exa,
@@ -14,8 +18,15 @@ import {
   spawnSync
 } from "./chunk-MIDGZE34.js";
 import {
-  loadPluginConfig
-} from "./chunk-NY2IPJ7V.js";
+  ModelProfileStore,
+  PROFILE_ROLES,
+  ProfileConflictError,
+  formatModelString,
+  loadPluginConfig,
+  mergeProfileModelChain,
+  resolveRoleProfile,
+  validateProfileName
+} from "./chunk-YCWGTDFE.js";
 
 // src/opencode/permission-rules.ts
 var ACTIONS = {
@@ -65,6 +76,202 @@ function translatePermissionRules(permission) {
   ];
 }
 
+// src/opencode/tool-overrides/wildcard.ts
+function matchAction(input, pattern, platform = process.platform) {
+  const normalized = input.replaceAll("\\", "/");
+  let escaped = pattern.replaceAll("\\", "/").replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  if (escaped.endsWith(" .*")) escaped = `${escaped.slice(0, -3)}( .*)?`;
+  return new RegExp(`^${escaped}$`, platform === "win32" ? "si" : "s").test(
+    normalized
+  );
+}
+function countActionMatches(pattern, actions, platform = process.platform) {
+  return actions.filter((action) => matchAction(action, pattern, platform)).length;
+}
+
+// src/opencode/tool-overrides/evaluator.ts
+function appendOverrideRules(overrides) {
+  if (!overrides.length) return [];
+  return [
+    ...overrides.map((override) => ({ ...override, resource: "*" })),
+    { action: "subagent", resource: "*", effect: "deny" }
+  ];
+}
+function evaluateAction(base, effective, action, platform = process.platform) {
+  let result = {
+    effect: "ask",
+    origin: "default"
+  };
+  for (const rule of base) {
+    if (matchAction(action, rule.action, platform) && matchAction("*", rule.resource, platform))
+      result = { effect: rule.effect, origin: "default" };
+  }
+  if (effective) {
+    const rules = appendOverrideRules(effective.overrides);
+    for (const [index, rule] of rules.entries()) {
+      if (matchAction(action, rule.action, platform))
+        result = {
+          effect: rule.effect,
+          origin: index === rules.length - 1 ? "default" : effective.origin
+        };
+    }
+  }
+  return result;
+}
+
+// src/opencode/tool-overrides/store.ts
+import { createHash, randomUUID } from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+// src/opencode/tool-overrides/types.ts
+var SPECIALIST_ROLES = PROFILE_ROLES.filter(
+  (role) => role !== "orchestrator"
+);
+
+// src/opencode/tool-overrides/validation.ts
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseActionOverrides(value) {
+  if (!Array.isArray(value)) throw new Error("Expected an overrides array");
+  return value.map((entry) => {
+    if (!object(entry) || typeof entry.action !== "string" || !entry.action.trim())
+      throw new Error("Action must be a non-empty pattern");
+    if (entry.effect !== "allow" && entry.effect !== "ask" && entry.effect !== "deny")
+      throw new Error("Effect must be allow, ask or deny");
+    return { action: entry.action.trim(), effect: entry.effect };
+  });
+}
+function validateSpecialistRole(role) {
+  const canonical = SPECIALIST_ROLES.find((name) => name === role);
+  if (!canonical) throw new Error(`Unknown specialist role: ${role}`);
+  return canonical;
+}
+function parseToolsDocument(value, warnings = []) {
+  if (!object(value) || value.version !== 1 || !object(value.roles))
+    throw new Error("Expected version 1 and a roles object");
+  const roles = {};
+  for (const [role, entry] of Object.entries(value.roles)) {
+    const canonical = SPECIALIST_ROLES.find((name) => name === role);
+    if (!canonical) {
+      warnings.push(`Unknown specialist role ignored: ${role}`);
+      continue;
+    }
+    if (!object(entry)) throw new Error(`Invalid overrides for ${role}`);
+    roles[canonical] = { overrides: parseActionOverrides(entry.overrides) };
+  }
+  return { version: 1, roles };
+}
+
+// src/opencode/tool-overrides/store.ts
+function toolsOverridePaths(options) {
+  if (options.paths) return { ...options.paths };
+  const env = options.env ?? process.env;
+  const configDir = options.configDir ?? (env.OPENCODE_CONFIG_DIR?.trim() || path.join(
+    env.XDG_CONFIG_HOME || path.join(options.homeDir ?? os.homedir(), ".config"),
+    "opencode"
+  ));
+  return {
+    global: path.join(configDir, "thoth", "tools.json"),
+    project: path.join(options.cwd, ".opencode", "thoth", "tools.json")
+  };
+}
+var emptyDocument = () => ({ version: 1, roles: {} });
+var revisionOf = (raw) => raw === null ? "missing" : createHash("sha256").update(raw).digest("hex");
+var ToolsConflictError = class extends Error {
+  constructor(scope) {
+    super(`Tools changed on disk: ${scope}; reload before saving.`);
+    this.scope = scope;
+    this.name = "ToolsConflictError";
+  }
+  scope;
+  code = "TOOLS_CONFLICT";
+};
+var ToolsOverrideStore = class {
+  constructor(options) {
+    this.options = options;
+    this.paths = toolsOverridePaths(options);
+  }
+  options;
+  paths;
+  raw(scope) {
+    try {
+      return fs.readFileSync(this.paths[scope], "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+  }
+  read(scope) {
+    const warnings = [];
+    let raw = null;
+    let document = emptyDocument();
+    try {
+      raw = this.raw(scope);
+      if (raw !== null)
+        document = parseToolsDocument(JSON.parse(raw), warnings);
+    } catch (error) {
+      warnings.push(`Cannot read tools ${this.paths[scope]}: ${String(error)}`);
+    }
+    for (const warning of warnings) this.options.warn?.(warning);
+    return { document, revision: revisionOf(raw), warnings };
+  }
+  resolve() {
+    const global = this.read("global");
+    const project = this.read("project");
+    const effective = {};
+    for (const role of SPECIALIST_ROLES) {
+      const origin = Object.hasOwn(project.document.roles, role) ? "project" : "global";
+      const entry = (origin === "project" ? project : global).document.roles[role];
+      if (entry) effective[role] = { ...entry, origin };
+    }
+    return {
+      global,
+      project,
+      effective,
+      warnings: [...global.warnings, ...project.warnings]
+    };
+  }
+  mutate(scope, role, baseRevision, update) {
+    validateSpecialistRole(role);
+    const raw = this.raw(scope);
+    if (revisionOf(raw) !== baseRevision) throw new ToolsConflictError(scope);
+    const document = raw === null ? emptyDocument() : parseToolsDocument(JSON.parse(raw));
+    update(document);
+    const file = this.paths[scope];
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const temp = `${file}.${randomUUID()}.tmp`;
+    try {
+      fs.writeFileSync(temp, `${JSON.stringify(document, null, 2)}
+`, {
+        encoding: "utf8",
+        flag: "wx"
+      });
+      if (revisionOf(this.raw(scope)) !== baseRevision)
+        throw new ToolsConflictError(scope);
+      fs.renameSync(temp, file);
+    } finally {
+      if (fs.existsSync(temp)) fs.unlinkSync(temp);
+    }
+    return this.read(scope);
+  }
+  /** Save ordered rules losslessly, including duplicates; other roles survive. */
+  save(scope, role, overrides, baseRevision) {
+    const next = parseActionOverrides(overrides);
+    return this.mutate(scope, role, baseRevision, (document) => {
+      document.roles[role] = { overrides: next };
+    });
+  }
+  /** Remove a scope's role entry (project reset resumes global inheritance). */
+  reset(scope, role, baseRevision) {
+    return this.mutate(scope, role, baseRevision, (document) => {
+      delete document.roles[role];
+    });
+  }
+};
+
 // src/opencode/agents.ts
 var ROLE_COLORS = {
   orchestrator: "#7c3aed",
@@ -89,6 +296,12 @@ async function registerAgents(ctx, deps) {
         agent.color = /^#[0-9a-f]{6}$/i.test(config.color ?? "") ? config.color : ROLE_COLORS[name];
         agent.steps = config.steps;
         agent.permissions = translatePermissionRules(config.permission);
+        if (name !== "orchestrator") {
+          const overrides = deps.toolState.state.effective[name]?.overrides;
+          if (overrides?.length) {
+            agent.permissions.push(...appendOverrideRules(overrides));
+          }
+        }
         const separator = model?.indexOf("/") ?? -1;
         agent.model = model && separator > 0 && separator < model.length - 1 ? {
           providerID: model.slice(0, separator),
@@ -193,6 +406,68 @@ function loadOpenCodeDependencies(ctx) {
       effectiveModelArrays[name] = effective;
     }
   }
+  const roster = {};
+  const configuredChains = {};
+  const baseArrays = structuredClone(effectiveModelArrays);
+  const baseRuntimeChains = structuredClone(runtimeChains);
+  for (const { name } of agentDefs) {
+    const role = name;
+    const first = effectiveModelArrays[name]?.[0];
+    roster[role] = first ? { model: first.id, variant: first.variant } : { model: agents[name]?.model, variant: agents[name]?.variant };
+    configuredChains[name] = effectiveModelArrays[name] ?? (agents[name]?.model ? [{ id: agents[name].model, variant: agents[name].variant }] : []);
+  }
+  const store = new ModelProfileStore({
+    cwd: directory,
+    roster,
+    warn: (message) => console.warn(`[thoth-agents] ${message}`)
+  });
+  const profileState = {
+    store,
+    roster,
+    selection: store.resolve(),
+    roles: {},
+    refresh() {
+      this.selection = store.resolve();
+      applyProfile();
+    }
+  };
+  function applyProfile() {
+    for (const { name } of agentDefs) {
+      const role = name;
+      profileState.roles[role] = resolveRoleProfile(
+        role,
+        profileState.selection.profile,
+        roster
+      );
+      if (profileState.selection.name === "default") {
+        if (baseArrays[name])
+          effectiveModelArrays[name] = structuredClone(baseArrays[name]);
+        else delete effectiveModelArrays[name];
+        if (baseRuntimeChains[name])
+          runtimeChains[name] = [...baseRuntimeChains[name]];
+        else delete runtimeChains[name];
+      } else {
+        const chain = mergeProfileModelChain(
+          profileState.roles[role],
+          configuredChains[name]
+        );
+        effectiveModelArrays[name] = chain;
+        runtimeChains[name] = chain.map(({ id }) => id);
+      }
+    }
+  }
+  applyProfile();
+  const toolStore = new ToolsOverrideStore({
+    cwd: directory,
+    warn: (message) => console.warn(`[thoth-agents] ${message}`)
+  });
+  const toolState = {
+    store: toolStore,
+    state: toolStore.resolve(),
+    refresh() {
+      this.state = toolStore.resolve();
+    }
+  };
   return {
     directory,
     // Both src/opencode/context.ts and dist/index.js (or a root chunk) resolve
@@ -208,7 +483,9 @@ function loadOpenCodeDependencies(ctx) {
     agents,
     modelArrayMap,
     effectiveModelArrays,
-    runtimeChains
+    runtimeChains,
+    profileState,
+    toolState
   };
 }
 
@@ -427,22 +704,444 @@ async function registerPermissions(ctx, deps) {
   });
 }
 
+// src/opencode/profile-rpc-handlers.ts
+import { createHash as createHash2 } from "crypto";
+import path2 from "path";
+
+// src/opencode/profile-sessions.ts
+var SessionProfileSelections = class {
+  constructor(storage, projectDir) {
+    this.storage = storage;
+    this.projectDir = projectDir;
+  }
+  storage;
+  projectDir;
+  parse(value) {
+    if (typeof value === "string")
+      return { name: value, projectDir: this.projectDir };
+    if (value && typeof value === "object" && "name" in value && "projectDir" in value && typeof value.name === "string" && typeof value.projectDir === "string")
+      return { name: value.name, projectDir: value.projectDir };
+    return void 0;
+  }
+  async set(sessionID, name, projectDir = this.projectDir) {
+    const key = `model-profiles/session/${sessionID}`;
+    if (name === void 0) await this.storage.remove(key);
+    else await this.storage.set(key, { name, projectDir });
+  }
+  /** Collect before mutating storage so pagination remains stable. */
+  async all() {
+    const prefix = "model-profiles/session/";
+    const selections = [];
+    let after;
+    do {
+      const page = await this.storage.scan({ prefix, after });
+      for (const entry of page.entries) {
+        const value = this.parse(entry.value);
+        if (entry.key.startsWith(prefix) && value)
+          selections.push({
+            ...value,
+            sessionID: entry.key.slice(prefix.length)
+          });
+      }
+      after = page.next;
+    } while (after !== void 0);
+    return selections;
+  }
+  async get(sessionID) {
+    return this.parse(
+      await this.storage.get(`model-profiles/session/${sessionID}`)
+    );
+  }
+};
+
+// src/opencode/profile-rpc-handlers.ts
+function revision(profile) {
+  const canonical = profile === null ? null : {
+    agents: Object.fromEntries(
+      PROFILE_ROLES.filter((role) => profile.agents[role]).map((role) => [
+        role,
+        {
+          model: profile.agents[role]?.model,
+          variant: profile.agents[role]?.variant
+        }
+      ])
+    )
+  };
+  return createHash2("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+var RequestError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+async function registerProfileRpc(ctx, deps) {
+  const { store, roster } = deps.profileState;
+  const sessions = new SessionProfileSelections(ctx.storage, deps.directory);
+  async function capture(sessionID) {
+    const session = await ctx.session.get({ sessionID });
+    const ref = session.model ?? (await ctx.agent.get({ agentID: session.agent ?? "orchestrator" })).data.model;
+    return ref ? {
+      model: `${ref.providerID}/${ref.id}`,
+      ...ref.variant ? { variant: ref.variant } : {}
+    } : {};
+  }
+  function snapshot(sessionName, change) {
+    const warnings = [];
+    const global = store.read("global", warnings);
+    const project = store.read("project", warnings);
+    const selections = {
+      ...sessionName === void 0 ? {} : { session: sessionName },
+      ...project.active === void 0 ? {} : { project: project.active },
+      ...global.active === void 0 ? {} : { global: global.active }
+    };
+    if (change) {
+      if (change.name === void 0) delete selections[change.scope];
+      else selections[change.scope] = change.name;
+    }
+    let effective = {
+      name: "default",
+      selectedBy: "default",
+      profile: store.defaultProfile()
+    };
+    for (const selectedBy of ["session", "project", "global"]) {
+      const name = selections[selectedBy];
+      if (!name) continue;
+      if (name === "default") {
+        effective = { name, selectedBy, profile: store.defaultProfile() };
+        break;
+      }
+      const source = Object.hasOwn(project.profiles, name) ? "project" : "global";
+      const profile = (source === "project" ? project : global).profiles[name];
+      if (Object.hasOwn(
+        (source === "project" ? project : global).profiles,
+        name
+      ) && (selectedBy !== "global" || Object.hasOwn(global.profiles, name))) {
+        effective = { name, source, selectedBy, profile };
+        break;
+      }
+      warnings.push(
+        `Missing ${selectedBy} model profile "${name}"; falling back.`
+      );
+    }
+    const profiles = [];
+    for (const [source, document] of [
+      ["global", global],
+      ["project", project]
+    ]) {
+      for (const [name, profile] of Object.entries(document.profiles))
+        profiles.push({
+          name,
+          scope: source,
+          source,
+          profile,
+          revision: revision(profile),
+          shadowed: source === "global" && Object.hasOwn(project.profiles, name)
+        });
+    }
+    return {
+      profiles,
+      defaultProfile: store.defaultProfile(),
+      roles: [...PROFILE_ROLES],
+      selections,
+      effective,
+      warnings
+    };
+  }
+  async function catalog() {
+    const [providers, models] = await Promise.all([
+      ctx.provider.list(),
+      ctx.model.list({ types: ["chat"] })
+    ]);
+    return providers.data.map((provider) => ({
+      id: provider.id,
+      name: provider.name,
+      models: models.data.filter((model) => model.providerID === provider.id && model.enabled).map((model) => ({
+        id: model.id,
+        name: model.name,
+        variants: model.variants.map((variant) => variant.id)
+      }))
+    }));
+  }
+  async function state(sessionID) {
+    return {
+      ...snapshot(
+        sessionID ? (await sessions.get(sessionID))?.name : void 0
+      ),
+      ...sessionID ? { orchestrator: await capture(sessionID) } : {},
+      providers: await catalog()
+    };
+  }
+  function available(profile, providers, name) {
+    for (const role of PROFILE_ROLES) {
+      const entry = resolveRoleProfile(role, profile, roster);
+      if (!entry.model) continue;
+      const slash = entry.model.indexOf("/");
+      const providerID = entry.model.slice(0, slash);
+      const modelID = entry.model.slice(slash + 1);
+      const model = providers.find((provider) => provider.id === providerID)?.models.find((candidate) => candidate.id === modelID);
+      if (!model || entry.variant && !model.variants.includes(entry.variant))
+        throw new RequestError(
+          "MODEL_UNAVAILABLE",
+          `Unavailable model or variant in profile "${name}" for ${role}: ${entry.model}${entry.variant ? `#${entry.variant}` : ""}. Nothing changed.`
+        );
+    }
+  }
+  async function activate(input) {
+    if (input.scope === "session" && !input.sessionID)
+      throw new RequestError(
+        "INVALID_REQUEST",
+        "Open a session to change its profile selection."
+      );
+    const previous = input.sessionID ? (await sessions.get(input.sessionID))?.name : void 0;
+    const providers = await catalog();
+    if (input.name !== void 0) {
+      const target = store.lookup(
+        input.name,
+        input.scope === "global" ? "global" : void 0
+      );
+      if (!target)
+        throw new RequestError(
+          "INVALID_REQUEST",
+          `Profile not found: ${input.name}`
+        );
+      available(target.profile, providers, input.name);
+    }
+    if (input.scope !== "session") {
+      const defaults = snapshot(void 0, input);
+      available(defaults.effective.profile, providers, defaults.effective.name);
+    }
+    const next = snapshot(previous, input);
+    available(next.effective.profile, providers, next.effective.name);
+    if (input.scope === "session" && input.sessionID)
+      await sessions.set(input.sessionID, input.name);
+    else {
+      if (input.scope === "global") store.setGlobalActive(input.name);
+      else store.setProjectPin(input.name);
+      deps.profileState.refresh();
+      await ctx.agent.reload();
+    }
+    const orchestrator = resolveRoleProfile(
+      "orchestrator",
+      next.effective.profile,
+      roster
+    );
+    if (input.sessionID && orchestrator.model) {
+      const slash = orchestrator.model.indexOf("/");
+      await ctx.session.switchModel({
+        sessionID: input.sessionID,
+        model: {
+          providerID: orchestrator.model.slice(0, slash),
+          id: orchestrator.model.slice(slash + 1),
+          ...orchestrator.variant ? { variant: orchestrator.variant } : {}
+        }
+      });
+    }
+    return state(input.sessionID);
+  }
+  let pending = Promise.resolve();
+  function handler(method, run) {
+    return (raw) => {
+      const operation = pending.then(async () => {
+        const parsed = profileRpc.methods[method].input.safeParse(raw);
+        if (!parsed.success)
+          return {
+            ok: false,
+            error: { code: "INVALID_REQUEST", message: parsed.error.message }
+          };
+        try {
+          return {
+            ok: true,
+            value: await run(parsed.data)
+          };
+        } catch (error) {
+          const code = error instanceof ProfileConflictError ? "PROFILE_CONFLICT" : error instanceof RequestError ? error.code : "OPERATION_FAILED";
+          return {
+            ok: false,
+            error: {
+              code,
+              message: error instanceof Error ? error.message : String(error)
+            }
+          };
+        }
+      });
+      pending = operation;
+      return operation;
+    };
+  }
+  function writable(name) {
+    try {
+      validateProfileName(name, true);
+    } catch (error) {
+      throw new RequestError("INVALID_REQUEST", String(error));
+    }
+  }
+  function current(scope, name) {
+    const document = store.read(scope);
+    return Object.hasOwn(document.profiles, name) ? document.profiles[name] : null;
+  }
+  function projectStore(projectDir) {
+    return projectDir === deps.directory ? store : new ModelProfileStore({
+      cwd: projectDir,
+      roster,
+      paths: {
+        global: store.paths.global,
+        project: path2.join(
+          projectDir,
+          ".opencode",
+          "thoth",
+          "profiles.json"
+        )
+      }
+    });
+  }
+  function identity(project, name) {
+    const found = project.lookup(name);
+    return found ? found.scope ? `${project.paths[found.scope]}:${name}` : "default" : void 0;
+  }
+  async function maintenance(scope, name, newName) {
+    const selections = await sessions.all();
+    const target = `${store.paths[scope]}:${name}`;
+    const affected = selections.filter(
+      (selection) => identity(projectStore(selection.projectDir), selection.name) === target
+    );
+    const projects = new Map(
+      [
+        .../* @__PURE__ */ new Set([deps.directory, ...selections.map((s) => s.projectDir)])
+      ].map((dir) => [dir, projectStore(dir)])
+    );
+    const pins = [];
+    for (const project of projects.values()) {
+      const pin = project.read("project").active;
+      if (pin && identity(project, pin) === target) pins.push(project);
+    }
+    if (newName !== void 0) {
+      for (const [dir, project] of projects) {
+        let after2 = function(pointer, globalPointer = false) {
+          if (!pointer) return void 0;
+          if (pointer === "default") return "default";
+          if (globalPointer && !Object.hasOwn(global.profiles, pointer))
+            return void 0;
+          const source = Object.hasOwn(local.profiles, pointer) ? "project" : "global";
+          if (!Object.hasOwn(
+            (source === "project" ? local : global).profiles,
+            pointer
+          ))
+            return void 0;
+          return `${project.paths[source]}:${pointer}`;
+        }, guard2 = function(before, next) {
+          const expected = before === target ? `${store.paths[scope]}:${newName}` : before;
+          if (next !== expected)
+            throw new RequestError(
+              "PROFILE_SHADOWED",
+              `Renaming to "${newName}" collides with a shadowing profile in ${dir}. Nothing changed.`
+            );
+        };
+        var after = after2, guard = guard2;
+        const global = structuredClone(project.read("global"));
+        const local = structuredClone(project.read("project"));
+        const changed = scope === "global" ? global : project.paths.project === store.paths.project ? local : void 0;
+        if (changed && Object.hasOwn(changed.profiles, name)) {
+          changed.profiles[newName] = changed.profiles[name];
+          delete changed.profiles[name];
+          if (changed.active === name) changed.active = newName;
+        }
+        if (pins.includes(project)) local.active = newName;
+        for (const selection of selections.filter(
+          (s) => s.projectDir === dir
+        )) {
+          const before = identity(project, selection.name);
+          guard2(before, after2(before === target ? newName : selection.name));
+        }
+        const pin = project.read("project").active;
+        guard2(pin ? identity(project, pin) : void 0, after2(local.active));
+        const active = project.read("global").active;
+        const beforeGlobal = active && project.lookup(active, "global") ? identity(project, active) : void 0;
+        guard2(beforeGlobal, after2(global.active, true));
+      }
+    }
+    return { affected, pins };
+  }
+  const handlers = {
+    state: handler("state", ({ sessionID }) => state(sessionID)),
+    capture: handler("capture", ({ sessionID }) => capture(sessionID)),
+    activate: handler("activate", activate),
+    clear: handler("clear", activate),
+    create: handler("create", ({ scope, name, profile }) => {
+      writable(name);
+      store.create(scope, name, profile);
+      return { revision: revision(current(scope, name)) };
+    }),
+    save: handler("save", ({ scope, name, profile, baseRevision }) => {
+      writable(name);
+      const expected = current(scope, name);
+      if (revision(expected) !== baseRevision)
+        throw new ProfileConflictError(scope, name);
+      store.save(scope, name, profile, { expected });
+      return { revision: revision(current(scope, name)) };
+    }),
+    rename: handler("rename", async ({ scope, name, newName }) => {
+      writable(name);
+      writable(newName);
+      const { affected, pins } = await maintenance(scope, name, newName);
+      store.rename(scope, name, newName);
+      for (const project of pins) project.setProjectPin(newName);
+      for (const selection of affected)
+        await sessions.set(selection.sessionID, newName, selection.projectDir);
+      return {};
+    }),
+    delete: handler("delete", async ({ scope, name }) => {
+      writable(name);
+      const { affected, pins } = await maintenance(scope, name);
+      store.delete(scope, name);
+      for (const project of pins) project.setProjectPin();
+      for (const selection of affected)
+        await sessions.set(selection.sessionID, void 0);
+      return {};
+    })
+  };
+  await ctx.rpc.register(profileRpc, handlers);
+}
+
+// src/opencode/profile-runtime.ts
+async function registerProfileRuntime(ctx, deps) {
+  const sessions = new SessionProfileSelections(ctx.storage, deps.directory);
+  await ctx.tool.hook("execute.before", async (event) => {
+    if (event.tool !== "subagent") return;
+    const input = event.input;
+    if (!input || typeof input !== "object" || Array.isArray(input)) return;
+    const args = input;
+    if (args.model !== void 0) return;
+    const role = PROFILE_ROLES.find((role2) => role2 === args.agent);
+    if (!role) return;
+    const { store, roster } = deps.profileState;
+    const selection = store.resolve(
+      (await sessions.get(event.sessionID))?.name
+    );
+    const model = formatModelString(
+      resolveRoleProfile(role, selection.profile, roster)
+    );
+    if (model !== void 0) args.model = model;
+  });
+}
+
 // src/utils/logger.ts
 import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
 function getLogFile() {
-  const os = require2("node:os");
-  const path = require2("node:path");
+  const os2 = require2("node:os");
+  const path3 = require2("node:path");
   const configuredPath = process.env.THOTH_AGENTS_LOG_FILE?.trim();
-  return configuredPath || path.join(os.tmpdir(), "thoth-agents.log");
+  return configuredPath || path3.join(os2.tmpdir(), "thoth-agents.log");
 }
 function log(message, data) {
   try {
-    const fs = require2("node:fs");
+    const fs2 = require2("node:fs");
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const logEntry = `[${timestamp}] ${message} ${data ? JSON.stringify(data) : ""}
 `;
-    fs.appendFileSync(getLogFile(), logEntry);
+    fs2.appendFileSync(getLogFile(), logEntry);
   } catch {
   }
 }
@@ -615,14 +1314,14 @@ var SessionState = class {
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name === "archive") continue;
       const id = entry.name;
-      const path = join2(root, id, `${id}.md`);
+      const path3 = join2(root, id, `${id}.md`);
       try {
-        const info = await stat(path);
+        const info = await stat(path3);
         if (!info.isFile()) continue;
         active.add(id);
         const fingerprint = `${info.mtimeMs}:${info.ctimeMs}:${info.size}`;
         if (this.records.get(id)?.fingerprint === fingerprint) continue;
-        const content = await readFile(path, "utf8");
+        const content = await readFile(path3, "utf8");
         const title = /^#\s+(.+)$/m.exec(content)?.[1]?.trim() ?? id;
         const status = content.match(/^\*\*(?:Status|Phase)\*\*:\s*.+$/gm) ?? [];
         this.records.set(id, {
@@ -667,16 +1366,15 @@ var SessionState = class {
 // src/opencode/session-hooks.ts
 async function registerSessionHooks(ctx, deps) {
   const names = new Set(deps.agentDefs.map((agent) => agent.name));
-  const chains = Object.fromEntries(
-    Object.entries(deps.runtimeChains).filter(([name]) => names.has(name))
-  );
   const fallback = new ForegroundFallbackManager(
     ctx.session,
-    chains,
+    deps.runtimeChains,
     deps.effectiveModelArrays
   );
   const state = new SessionState(deps.directory, ctx.session.instructions);
-  await ctx.session.hook("retry", (input) => fallback.retry(input));
+  await ctx.session.hook("retry", (input) => {
+    if (names.has(input.agent)) return fallback.retry(input);
+  });
   await ctx.session.hook("prompt", async (input) => {
     await state.refresh(input.sessionID);
   });
@@ -737,9 +1435,9 @@ var ownedSkills = [
 async function registerSkills(ctx, deps) {
   const skills = [];
   for (const id of ownedSkills) {
-    const path = resolve(deps.packageRoot, "skills", id, "SKILL.md");
+    const path3 = resolve(deps.packageRoot, "skills", id, "SKILL.md");
     try {
-      const source = await readFile2(path, "utf8");
+      const source = await readFile2(path3, "utf8");
       const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/.exec(
         source
       );
@@ -752,12 +1450,12 @@ async function registerSkills(ctx, deps) {
         id,
         name: metadata.name,
         description: metadata.description,
-        path,
+        path: path3,
         content: match[2].trim()
       });
     } catch (cause) {
       throw new Error(
-        `Cannot load bundled skill ${path}: ${cause instanceof Error ? cause.message : String(cause)}`,
+        `Cannot load bundled skill ${path3}: ${cause instanceof Error ? cause.message : String(cause)}`,
         { cause }
       );
     }
@@ -773,6 +1471,99 @@ async function registerSkills(ctx, deps) {
   });
 }
 
+// src/opencode/tool-rpc-handlers.ts
+async function registerToolRpc(ctx, deps) {
+  const { store } = deps.toolState;
+  async function state() {
+    const snapshot = store.resolve();
+    const grouped = /* @__PURE__ */ new Map();
+    for (const tool of await ctx.tool.list()) {
+      const action = tool.options?.permission ?? tool.id;
+      const members = grouped.get(action) ?? [];
+      members.push(tool.id);
+      grouped.set(action, members);
+    }
+    if (!grouped.has("subagent")) grouped.set("subagent", []);
+    const inventory = [...grouped].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([action, tools]) => ({
+      action,
+      tools: tools.sort(),
+      locked: action === "subagent"
+    }));
+    const actions = inventory.map(({ action }) => action);
+    return {
+      specialists: [...SPECIALIST_ROLES],
+      inventory,
+      roles: SPECIALIST_ROLES.map((role) => {
+        const scopeState = (scope) => ({
+          present: Object.hasOwn(snapshot[scope].document.roles, role),
+          revision: snapshot[scope].revision,
+          overrides: (snapshot[scope].document.roles[role]?.overrides ?? []).map((entry) => ({
+            ...entry,
+            matchCount: countActionMatches(entry.action, actions)
+          }))
+        });
+        const base = translatePermissionRules(deps.agents[role].permission);
+        return {
+          role,
+          effectiveScope: snapshot.effective[role]?.origin ?? "default",
+          global: scopeState("global"),
+          project: scopeState("project"),
+          actions: inventory.map(({ action, locked }) => ({
+            action,
+            locked,
+            baseEffect: evaluateAction(base, void 0, action).effect,
+            ...evaluateAction(base, snapshot.effective[role], action)
+          }))
+        };
+      }),
+      warnings: snapshot.warnings
+    };
+  }
+  let pending = Promise.resolve();
+  function handler(method, run) {
+    return (raw) => {
+      const operation = pending.then(async () => {
+        const parsed = toolRpc.methods[method].input.safeParse(raw);
+        if (!parsed.success)
+          return {
+            ok: false,
+            error: { code: "INVALID_REQUEST", message: parsed.error.message }
+          };
+        try {
+          return { ok: true, value: await run(parsed.data) };
+        } catch (error) {
+          return {
+            ok: false,
+            error: {
+              code: error instanceof ToolsConflictError ? "TOOLS_CONFLICT" : "OPERATION_FAILED",
+              message: error instanceof Error ? error.message : String(error)
+            }
+          };
+        }
+      });
+      pending = operation;
+      return operation;
+    };
+  }
+  async function reload() {
+    deps.toolState.refresh();
+    await ctx.agent.reload();
+    return state();
+  }
+  const handlers = {
+    state: handler("state", state),
+    save: handler("save", async ({ scope, role, overrides, baseRevision }) => {
+      store.save(scope, role, overrides, baseRevision);
+      return reload();
+    }),
+    reset: handler("reset", async ({ scope, role, baseRevision }) => {
+      store.reset(scope, role, baseRevision);
+      return reload();
+    })
+  };
+  await ctx.rpc.register(toolRpc, handlers);
+}
+
 // src/tools/ast-grep/tools.ts
 import { z } from "zod";
 
@@ -845,8 +1636,8 @@ function isPwshAvailable() {
   });
   return result.exitCode === 0;
 }
-function escapePowerShellPath(path) {
-  return path.replace(/'/g, "''");
+function escapePowerShellPath(path3) {
+  return path3.replace(/'/g, "''");
 }
 function getWindowsZipExtractor() {
   const buildNumber = getWindowsBuildNumber();
@@ -975,8 +1766,8 @@ async function downloadAstGrep(version = DEFAULT_VERSION) {
   if (existsSync2(binaryPath)) {
     return binaryPath;
   }
-  const { arch, os } = platformInfo;
-  const assetName = `app-${arch}-${os}.zip`;
+  const { arch, os: os2 } = platformInfo;
+  const assetName = `app-${arch}-${os2}.zip`;
   const downloadUrl = `https://github.com/${REPO}/releases/download/${version}/${assetName}`;
   console.log(`[thoth-agents] Downloading ast-grep binary...`);
   try {
@@ -1100,9 +1891,9 @@ function findSgCliPathSync() {
   }
   if (process.platform === "darwin") {
     const homebrewPaths = ["/opt/homebrew/bin/sg", "/usr/local/bin/sg"];
-    for (const path of homebrewPaths) {
-      if (existsSync3(path) && isValidBinary(path)) {
-        return path;
+    for (const path3 of homebrewPaths) {
+      if (existsSync3(path3) && isValidBinary(path3)) {
+        return path3;
       }
     }
   }
@@ -1119,8 +1910,8 @@ function getSgCliPath() {
   }
   return "sg";
 }
-function setSgCliPath(path) {
-  resolvedCliPath = path;
+function setSgCliPath(path3) {
+  resolvedCliPath = path3;
 }
 var DEFAULT_TIMEOUT_MS = 3e5;
 var DEFAULT_MAX_OUTPUT_BYTES = 1 * 1024 * 1024;
@@ -3048,6 +3839,9 @@ var plugin = {
     await registerCommand(ctx, deps);
     await registerSkills(ctx, deps);
     await registerPermissions(ctx, deps);
+    await registerProfileRuntime(ctx, deps);
+    await registerProfileRpc(ctx, deps);
+    await registerToolRpc(ctx, deps);
     await registerDelegationHooks(ctx, deps);
     await registerSessionHooks(ctx, deps);
   }