thoth-agents 0.3.8 → 0.3.9

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "thoth-agents",
       "description": "Adaptive root orchestration, six specialist subagents, and a runtime-autonomous Spec Kit-compatible SDD bundle.",
-      "version": "0.3.8",
+      "version": "0.3.9",
       "author": {
         "name": "thoth-agents maintainers"
       },

package/README.md

@@ -56,6 +56,11 @@ npx thoth-agents@latest install --agent=opencode --dry-run
 npx thoth-agents@latest install --agent=opencode
 ```
 
+Here, `@latest` selects which CLI release runs. That CLI writes the exact
+executing release to OpenCode configuration, for example
+`plugin: ["thoth-agents@0.4.8"]`; it never writes a `latest` plugin entry or
+falls back to one when package identity cannot be verified.
+
 Restart OpenCode and initialize the current repository:
 
 ```text
@@ -393,9 +398,31 @@ npx thoth-agents@latest list
 npx thoth-agents@latest install --agent=opencode
 npx thoth-agents@latest install --agent=codex
 npx thoth-agents@latest install --agent=claude
+npx thoth-agents@latest update --harness=opencode
+npx thoth-agents@latest update --harness=opencode --apply
 npx thoth-agents@latest model --harness=codex --role=deep --model=gpt-5.6-sol
 ```
 
+`update` previews by default. Applying it performs the same complete refresh as
+installation for the selected harness: OpenCode refreshes its exact plugin pin,
+managed configuration, owned skills, external skills, and provider setup;
+Codex runs native plugin setup before its global agent pack, external skills,
+and provider setup; Claude refreshes its native plugin before external skills
+and provider setup. Any required failure makes the operation fail rather than
+claiming a complete update.
+
+After every required step succeeds, the CLI records that harness's executing
+version in
+`${XDG_CONFIG_HOME:-~/.config}/thoth-agents/install-state.json`. `status` shows
+the executing CLI version and this last complete CLI-managed version. The three
+harness records are independent: native Codex or Claude marketplace updates do
+not advance them and do not prove that CLI-managed agents, skills,
+configuration, or provider setup are current.
+
+OpenCode's runtime release check is notification-only. It does not rewrite the
+exact plugin pin, invalidate package state, or run a package manager. Follow the
+notification by rerunning the latest CLI installer or applying CLI Update.
+
 In the interactive `Configure models` flow, `Apply` is always available. When
 no role is dirty, it reapplies every currently displayed role value; after an
 edit, preview and apply remain limited to the dirty roles. In OpenCode, both

package/dist/{chunk-F2K4CS5J.js → chunk-2TLT6WWY.js}

@@ -5,20 +5,135 @@ import * as path from "path";
 // src/cli/config-io.ts
 import {
   copyFileSync,
-  existsSync as existsSync2,
-  readFileSync,
+  existsSync as existsSync3,
+  readFileSync as readFileSync2,
   renameSync,
   statSync,
   writeFileSync
 } from "fs";
 
+// src/cli/package-version.ts
+import { readFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/cli/package-root.ts
+import { existsSync } from "fs";
+import { dirname, join, parse } from "path";
+function findPackageRoot(startDir) {
+  let currentDir = startDir;
+  const filesystemRoot = parse(startDir).root;
+  while (true) {
+    if (existsSync(join(currentDir, "package.json"))) {
+      return currentDir;
+    }
+    if (currentDir === filesystemRoot) {
+      return null;
+    }
+    const parentDir = dirname(currentDir);
+    if (parentDir === currentDir) {
+      return null;
+    }
+    currentDir = parentDir;
+  }
+}
+
+// src/cli/package-version.ts
+var EXPECTED_PACKAGE_NAME = "thoth-agents";
+var SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+function isValidPackageVersion(version) {
+  return typeof version === "string" && SEMVER_PATTERN.test(version);
+}
+function resolveExecutingPackageVersion(options = {}) {
+  const moduleUrl = options.moduleUrl ?? import.meta.url;
+  const packageRoot = findPackageRoot(dirname2(fileURLToPath(moduleUrl)));
+  if (!packageRoot) {
+    return {
+      ok: false,
+      error: {
+        code: "package-root-not-found",
+        message: "Could not locate the executing thoth-agents package root."
+      }
+    };
+  }
+  const packageJsonPath = join2(packageRoot, "package.json");
+  let serializedMetadata;
+  try {
+    serializedMetadata = readFileSync(packageJsonPath, "utf8");
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        code: "package-metadata-unreadable",
+        message: `Could not read executing package metadata: ${error}`,
+        packageJsonPath
+      }
+    };
+  }
+  let metadata;
+  try {
+    metadata = JSON.parse(serializedMetadata);
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        code: "package-metadata-malformed",
+        message: `Could not parse executing package metadata: ${error}`,
+        packageJsonPath
+      }
+    };
+  }
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    return {
+      ok: false,
+      error: {
+        code: "package-metadata-malformed",
+        message: "Executing package metadata must be a JSON object.",
+        packageJsonPath
+      }
+    };
+  }
+  const { name, version } = metadata;
+  if (typeof name !== "string" || name.length === 0) {
+    return {
+      ok: false,
+      error: {
+        code: "package-metadata-malformed",
+        message: "Executing package metadata has no valid package name.",
+        packageJsonPath
+      }
+    };
+  }
+  if (name !== EXPECTED_PACKAGE_NAME) {
+    return {
+      ok: false,
+      error: {
+        code: "package-name-mismatch",
+        message: `Expected package ${EXPECTED_PACKAGE_NAME}, received ${name}.`,
+        packageJsonPath
+      }
+    };
+  }
+  if (!isValidPackageVersion(version)) {
+    return {
+      ok: false,
+      error: {
+        code: "package-version-invalid",
+        message: "Executing package metadata has no valid semantic version.",
+        packageJsonPath
+      }
+    };
+  }
+  return { ok: true, version, packageRoot };
+}
+
 // src/cli/paths.ts
-import { existsSync, mkdirSync } from "fs";
+import { existsSync as existsSync2, mkdirSync } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 function getDefaultOpenCodeConfigDir() {
-  const userConfigDir = process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join(homedir(), ".config");
-  return join(userConfigDir, "opencode");
+  const userConfigDir = process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join3(homedir(), ".config");
+  return join3(userConfigDir, "opencode");
 }
 function getCustomOpenCodeConfigDir() {
   const configDir = process.env.OPENCODE_CONFIG_DIR?.trim();
@@ -33,7 +148,7 @@ function getConfigDir() {
 }
 function getOpenCodeConfigPaths() {
   const configDir = getDefaultOpenCodeConfigDir();
-  return [join(configDir, "opencode.json"), join(configDir, "opencode.jsonc")];
+  return [join3(configDir, "opencode.json"), join3(configDir, "opencode.jsonc")];
 }
 function getConfigJson() {
   return getOpenCodeConfigPaths()[0];
@@ -42,37 +157,37 @@ function getConfigJsonc() {
   return getOpenCodeConfigPaths()[1];
 }
 function getLiteConfig() {
-  return join(getConfigDir(), "thoth-agents.json");
+  return join3(getConfigDir(), "thoth-agents.json");
 }
 function getLiteConfigJsonc() {
-  return join(getConfigDir(), "thoth-agents.jsonc");
+  return join3(getConfigDir(), "thoth-agents.jsonc");
 }
 function getOpenCodeManagedModelStatePath() {
-  return join(getConfigDir(), ".thoth-agents-managed-models.json");
+  return join3(getConfigDir(), ".thoth-agents-managed-models.json");
 }
 function getExistingLiteConfigPath() {
   const jsonPath = getLiteConfig();
-  if (existsSync(jsonPath)) return jsonPath;
+  if (existsSync2(jsonPath)) return jsonPath;
   const jsoncPath = getLiteConfigJsonc();
-  if (existsSync(jsoncPath)) return jsoncPath;
+  if (existsSync2(jsoncPath)) return jsoncPath;
   return jsonPath;
 }
 function getExistingConfigPath() {
   const jsonPath = getConfigJson();
-  if (existsSync(jsonPath)) return jsonPath;
+  if (existsSync2(jsonPath)) return jsonPath;
   const jsoncPath = getConfigJsonc();
-  if (existsSync(jsoncPath)) return jsoncPath;
+  if (existsSync2(jsoncPath)) return jsoncPath;
   return jsonPath;
 }
 function ensureConfigDir() {
   const configDir = getConfigDir();
-  if (!existsSync(configDir)) {
+  if (!existsSync2(configDir)) {
     mkdirSync(configDir, { recursive: true });
   }
 }
 function ensureOpenCodeConfigDir() {
-  const configDir = dirname(getConfigJson());
-  if (!existsSync(configDir)) {
+  const configDir = dirname3(getConfigJson());
+  if (!existsSync2(configDir)) {
     mkdirSync(configDir, { recursive: true });
   }
 }
@@ -349,10 +464,10 @@ function stripJsonComments(json) {
 }
 function parseConfigFile(path2) {
   try {
-    if (!existsSync2(path2)) return { config: null };
+    if (!existsSync3(path2)) return { config: null };
     const stat = statSync(path2);
     if (stat.size === 0) return { config: null };
-    const content = readFileSync(path2, "utf-8");
+    const content = readFileSync2(path2, "utf-8");
     if (content.trim().length === 0) return { config: null };
     return { config: JSON.parse(stripJsonComments(content)) };
   } catch (err) {
@@ -378,7 +493,7 @@ function writeConfig(configPath, config) {
   const bakPath = `${configPath}.bak`;
   const content = `${JSON.stringify(config, null, 2)}
 `;
-  if (existsSync2(configPath)) {
+  if (existsSync3(configPath)) {
     copyFileSync(configPath, bakPath);
   }
   writeFileSync(tmpPath, content);
@@ -391,7 +506,7 @@ function mergeOpenCodeMainConfig(config, update) {
       ...plugins.filter(
         (plugin) => plugin !== PACKAGE_NAME && !plugin.startsWith(`${PACKAGE_NAME}@`)
       ),
-      `${PACKAGE_NAME}@latest`
+      `${PACKAGE_NAME}@${update.pluginVersion}`
     ];
   }
   if (update.disableDefaults) {
@@ -406,6 +521,13 @@ function mergeOpenCodeMainConfig(config, update) {
 }
 function updateOpenCodeMainConfig(update) {
   const configPath = getExistingConfigPath();
+  if (update.ensurePlugin && !isValidPackageVersion(update.pluginVersion)) {
+    return {
+      success: false,
+      configPath,
+      error: "An approved plugin version is required."
+    };
+  }
   try {
     ensureOpenCodeConfigDir();
   } catch (err) {
@@ -446,7 +568,7 @@ function writeLiteConfig(installConfig, targetPath) {
     const bakPath = `${configPath}.bak`;
     const content = `${JSON.stringify(config, null, 2)}
 `;
-    if (existsSync2(configPath)) {
+    if (existsSync3(configPath)) {
       copyFileSync(configPath, bakPath);
     }
     writeFileSync(tmpPath, content);
@@ -1748,6 +1870,9 @@ export {
   getDefaultOpenCodeModel,
   getDefaultOpenCodeVariant,
   POLL_INTERVAL_BACKGROUND_MS,
+  findPackageRoot,
+  isValidPackageVersion,
+  resolveExecutingPackageVersion,
   getOpenCodeConfigPaths,
   getOpenCodeManagedModelStatePath,
   getExistingLiteConfigPath,

package/dist/{chunk-6GQYMWWT.js → chunk-MY2GIOOH.js}

@@ -14,7 +14,7 @@ import {
   getStepBudgetPromptSection,
   loadAgentPrompt,
   renderRolePrompt
-} from "./chunk-F2K4CS5J.js";
+} from "./chunk-2TLT6WWY.js";
 
 // src/agents/deep.ts
 var DEEP_PROMPT = renderRolePrompt(