thoth-agents 0.2.0 → 0.2.2

package/dist/{chunk-4WYCZ5Z7.js → chunk-3SQ4ZQ57.js}

@@ -546,7 +546,8 @@ function spawn(command, options = {}) {
       options.stdin ?? "pipe",
       options.stdout ?? "pipe",
       options.stderr ?? "pipe"
-    ]
+    ],
+    shell: options.shell
   });
   const managed = {
     stdin: child.stdin ?? fallbackStdin(),
@@ -577,7 +578,8 @@ function spawnSync(command, options = {}) {
       options.stdin ?? "ignore",
       options.stdout ?? "pipe",
       options.stderr ?? "pipe"
-    ]
+    ],
+    shell: options.shell
   });
   return { exitCode: result.status };
 }
@@ -585,6 +587,25 @@ function spawnSync(command, options = {}) {
 // src/cli/system.ts
 import { statSync } from "fs";
 var cachedOpenCodePath = null;
+function quoteWindowsShellCommand(command) {
+  if (!/[\s&()^<>"|]/.test(command)) {
+    return command;
+  }
+  return `"${command.replace(/"/g, '\\"')}"`;
+}
+function getOpenCodeVersionInvocation(opencodePath, platform = process.platform) {
+  const options = {
+    stdout: "pipe",
+    stderr: "pipe"
+  };
+  if (platform === "win32") {
+    return {
+      command: [`${quoteWindowsShellCommand(opencodePath)} --version`],
+      options: { ...options, shell: true }
+    };
+  }
+  return { command: [opencodePath, "--version"], options };
+}
 function getOpenCodePaths() {
   const home = process.env.HOME || process.env.USERPROFILE || "";
   return [
@@ -651,10 +672,8 @@ async function isOpenCodeInstalled() {
   const paths = getOpenCodePaths();
   for (const opencodePath of paths) {
     try {
-      const proc = spawn([opencodePath, "--version"], {
-        stdout: "pipe",
-        stderr: "pipe"
-      });
+      const invocation = getOpenCodeVersionInvocation(opencodePath);
+      const proc = spawn(invocation.command, invocation.options);
       await proc.exited;
       if (proc.exitCode === 0) {
         cachedOpenCodePath = opencodePath;
@@ -668,10 +687,8 @@ async function isOpenCodeInstalled() {
 async function getOpenCodeVersion() {
   const opencodePath = resolveOpenCodePath();
   try {
-    const proc = spawn([opencodePath, "--version"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
+    const invocation = getOpenCodeVersionInvocation(opencodePath);
+    const proc = spawn(invocation.command, invocation.options);
     const output = await new Response(proc.stdout).text();
     await proc.exited;
     if (proc.exitCode === 0) {

package/dist/{chunk-WH3F3GWE.js → chunk-FRZZ25ND.js}

@@ -2462,12 +2462,6 @@ var CLAUDE_CODE_SUBAGENT_DEFAULT_MODELS = {
   quick: "haiku",
   deep: "sonnet"
 };
-var READ_ONLY_ROLE_TOOLS = {
-  explorer: "Read, Grep, Glob",
-  librarian: "Read, Grep, Glob, WebSearch, WebFetch",
-  oracle: "Read, Grep, Glob"
-};
-var WRITE_CAPABLE_ROLE_TOOLS = "Read, Edit, Write, Bash, Grep, Glob";
 function isClaudeCodeSubagentName(name) {
   return name in CLAUDE_CODE_SUBAGENT_DEFAULT_MODELS;
 }
@@ -2477,10 +2471,6 @@ function getClaudeCodeAgentModel(role, config) {
   if (override && isClaudeCodeModel(override)) return override;
   return CLAUDE_CODE_SUBAGENT_DEFAULT_MODELS[role.name];
 }
-function toolsForRole(role) {
-  if (role.canMutateWorkspace) return WRITE_CAPABLE_ROLE_TOOLS;
-  return READ_ONLY_ROLE_TOOLS[role.name] ?? "Read, Grep, Glob";
-}
 function claudeCodePromptSections(roleName) {
   switch (roleName) {
     case "orchestrator":
@@ -2532,7 +2522,7 @@ function claudeCodeRoleInstructions(role) {
     `- Responsibility: ${role.responsibility}`,
     "- Use AskUserQuestion for local blocking decisions.",
     `- ${role.name} runs as an auto-discovered Claude Code plugin subagent invoked via Task(subagent_type: ${claudeCodeSubagentType(role.name)}); plugin subagents are namespaced with the plugin name. The orchestrator is the main Claude Code session.`,
-    "- Role permissions are enforced by this subagent's frontmatter `tools` allowlist; read-only roles cannot mutate the workspace.",
+    "- This subagent inherits ALL of the main thread's tools, including MCP servers (thoth-mem, context7, exa, grep_app); read-only roles (explorer, librarian, oracle) MUST NOT mutate the workspace per this operational contract (instruction-level, not tooling-enforced).",
     ...role.toolGovernance.map((rule) => `- ${rule}`),
     ...role.verification.map((rule) => `- ${rule}`),
     "</role-operational-contract>"
@@ -2566,7 +2556,7 @@ function renderClaudeCodeRootInstructions(config) {
     '- Before delegating after meaningful context changes, refresh the handoff body with root-owned mem_session(action="summary") or mem_save(kind="session_summary") when available.',
     "- Use AskUserQuestion for blocking user decisions; do not ask those questions in plain prose.",
     "- Track progress with TodoWrite; subagents do not own progress checkboxes or root-only memory.",
-    "- Role permissions are enforced at runtime by each subagent's frontmatter `tools` allowlist.",
+    "- Subagents inherit all of your tools (including MCP servers); role permissions are instruction-level, so read-only roles (explorer, librarian, oracle) must not mutate the workspace per their operational contract.",
     "</claude-code-runtime>"
   ].join("\n");
 }
@@ -2622,7 +2612,6 @@ function renderSubagentArtifacts(config) {
     const content = renderClaudeCodeSubagent({
       name: role.name,
       description: role.responsibility,
-      tools: toolsForRole(role),
       model: getClaudeCodeAgentModel(role, config),
       instructions: roleInstructions2(role, config)
     });
@@ -2835,7 +2824,7 @@ function buildClaudeCodeSetupPlan(config) {
     ],
     disclaimers: [
       "The orchestrator agent is the Claude Code main thread (plugin settings.json `agent` key); while enabled it replaces the default system prompt for every session in scope.",
-      "Role permissions are enforced by each specialist subagent frontmatter `tools` allowlist; the orchestrator inherits all tools.",
+      "Every subagent inherits all main-thread tools, including MCP servers; read-only roles must not mutate the workspace per their operational contract (instruction-level, not tooling-enforced).",
       "Subagent models accept only sonnet, opus, haiku, or inherit.",
       "User-scope skills-directory plugins load hooks and MCP servers without extra approval; project-scope requires accepting the workspace trust dialog."
     ]
@@ -3025,7 +3014,7 @@ function claudeCodeConfig(context = { cwd: process.cwd() }, dryRun) {
 function claudeCodeDisclaimers() {
   return [
     {
-      message: "Role permissions are enforced by subagent frontmatter tools; the orchestrator is the main session, injected via the SessionStart hook.",
+      message: "Subagents inherit all main-thread tools (including MCP servers); read-only roles must not mutate the workspace per their operational contract (instruction-level, not tooling-enforced). The orchestrator is the main session.",
       code: "claude-code-first-class"
     },
     {

package/dist/cli/index.js

@@ -4,7 +4,7 @@ import {
   getOpenCodeVersion,
   isOpenCodeInstalled,
   opencodeAdapter
-} from "../chunk-4WYCZ5Z7.js";
+} from "../chunk-3SQ4ZQ57.js";
 import {
   CODEX_ROLE_NAMES,
   RECOMMENDED_SKILLS,
@@ -36,7 +36,7 @@ import {
   getOperationHarness,
   installRecommendedSkill,
   listOperationHarnesses
-} from "../chunk-WH3F3GWE.js";
+} from "../chunk-FRZZ25ND.js";
 import {
   ALL_AGENT_NAMES,
   CUSTOM_SKILLS,

package/dist/cli/system.d.ts

@@ -1,6 +1,16 @@
+type OpenCodeVersionInvocation = {
+    command: string[];
+    options: {
+        stdout: 'pipe';
+        stderr: 'pipe';
+        shell?: boolean;
+    };
+};
+export declare function getOpenCodeVersionInvocation(opencodePath: string, platform?: typeof process.platform): OpenCodeVersionInvocation;
 export declare function resolveOpenCodePath(): string;
 export declare function isOpenCodeInstalled(): Promise<boolean>;
 export declare function isTmuxInstalled(): Promise<boolean>;
 export declare function getOpenCodeVersion(): Promise<string | null>;
 export declare function getOpenCodePath(): string | null;
 export declare function fetchLatestVersion(packageName: string): Promise<string | null>;
+export {};

package/dist/cli/tui/index.js

@@ -25,7 +25,7 @@ import {
   listOperationHarnesses,
   parseRoleTomlModel,
   parseSubagentModel
-} from "../../chunk-WH3F3GWE.js";
+} from "../../chunk-FRZZ25ND.js";
 import {
   ALL_AGENT_NAMES,
   DEFAULT_MODELS,

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   renderOpenCodeAgentConfigs,
   spawn,
   spawnSync
-} from "./chunk-4WYCZ5Z7.js";
+} from "./chunk-3SQ4ZQ57.js";
 import {
   DEFAULT_THOTH_COMMAND,
   POLL_INTERVAL_BACKGROUND_MS,

package/dist/utils/subprocess.d.ts

@@ -4,6 +4,7 @@ type SpawnOptions = {
     stdin?: 'pipe' | 'ignore';
     stdout?: 'pipe' | 'ignore';
     stderr?: 'pipe' | 'ignore';
+    shell?: boolean | string;
 };
 export type ManagedSubprocess = {
     stdin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thoth-agents",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Delegate-first OpenCode plugin with seven agents, thoth-mem persistence, and bundled SDD skills.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",