tumwater 0.2.0 → 0.4.0

package/dist/src/agent/opencode/write-guard-plugin/index.js

@@ -0,0 +1,48 @@
+/** OpenCode's half of the write guard (src/agent/write-guard.ts holds the rule): a plugin every
+ * team run loads through the injected config's `plugins` entry (opencode-config.ts). It refuses a
+ * write under the team root but outside the run's worktree.
+ *
+ * OpenCode 2.x has no hook that blocks a tool from running. It has a permission `evaluate` hook
+ * that may turn a decision to `deny` with a `message`, which reaches the model as the tool's error
+ * while the run goes on. Every file-writing tool asks for the `edit` action with the absolute
+ * paths it writes as `resources`, and the hook runs under `--auto` too, since `--auto` only
+ * answers what would otherwise be asked. Checked live on opencode 2.1.0 on 2026-10-23. A
+ * configured plugin path must be a directory, which is why this is `index.js` in a directory of
+ * its own.
+ *
+ * The plugin's context names the run's directory (`location.directory`, the worktree OpenCode
+ * runs in), which is the run directory the rule reads its checkout from. A failure of its own
+ * leaves the decision alone, so a broken guard cannot stop every edit of a run. */
+import { strayWriteRefusal } from "../../write-guard.js";
+/** Deny an `edit` decision whose resources include a stray path from a run in `runDir`, naming
+ * the first such path's refusal. Every other decision is left as it is. Exported for tests. */
+export function guardEvaluate(event, runDir) {
+    if (event.action !== "edit" || !Array.isArray(event.resources))
+        return;
+    for (const resource of event.resources) {
+        if (typeof resource !== "string" || resource === "")
+            continue;
+        const refusal = strayWriteRefusal(resource, runDir);
+        if (refusal === null)
+            continue;
+        event.effect = "deny";
+        event.message = refusal;
+        return;
+    }
+}
+export default {
+    id: "tumwater-write-guard",
+    async setup(ctx) {
+        const runDir = ctx.location?.directory;
+        if (typeof runDir !== "string" || runDir === "")
+            return;
+        await ctx.permission.hook("evaluate", (event) => {
+            try {
+                guardEvaluate(event, runDir);
+            }
+            catch {
+                // Leave the decision alone; runner-run.ts's stray-write warning still sees the write.
+            }
+        });
+    },
+};

package/dist/src/agent/role-notes-write.js

@@ -1,8 +1,7 @@
-// vocabulary: plain
 /**
- * The one write path for a role's notebook, shared by every surface that touches it: the
+ * The one write path for a role's notes, shared by every surface that touches it: the
  * `tumwater-notes` command (src/notes-cli.ts), `tumwater role --notes-file` /
- * `--clear-notes` (cli-query-commands.ts), the dashboard drawer (gui-operator-commands.ts)
+ * `--clear-notes` (cli-role-command.ts), the dashboard drawer (gui-operator-commands.ts)
  * and the TUI editors (tui-editor-notes.ts, tui-pane-transcript.ts). Kept backend-neutral —
  * no pi, claude or opencode types — so every surface quotes the SAME 4 KB cap, the SAME
  * validation, and the SAME validate-then-atomic-write execution, and cannot drift on what
@@ -26,7 +25,7 @@ export function validateRoleNote(text) {
 }
 /** Replace the note file at `notesPath` with `text` through src/files/files.ts's
  * writeTextAtomic — the one home of the parent-dir creation, tmp+rename, and
- * no-remnant-on-failure contract, so a role's notebook cannot litter `.tumwater/state/notes/`
+ * no-remnant-on-failure contract, so a role's notes cannot litter `.tumwater/state/notes/`
  * with a temp file that nothing prunes. Callers validate first; this does not. */
 export function writeRoleNote(notesPath, text) {
     writeTextAtomic(notesPath, text);
@@ -34,12 +33,12 @@ export function writeRoleNote(notesPath, text) {
 /** Validate and write one note's text, returning the success message surfaces show. `text` is
  * `unknown` because a caller may hand it a malformed value (a malformed heredoc, a stray
  * argument) without having enforced the string contract: coercing a malformed `text` to ""
- * would clear the notebook, the destructive reading of a typo the writer never sees, so a bad
+ * would clear the notes, the destructive reading of a typo the writer never sees, so a bad
  * value throws instead and the caller renders it as an error. Shared so every surface
  * rejects the same inputs with the same wording and the same no-write-on-failure behavior. */
 export function saveRoleNote(notesPath, text) {
     if (typeof text !== "string") {
-        throw new Error(`a note must be a string, not ${typeof text}${text === undefined ? "" : gotSuffix(text)} — pass the full replacement note, or "" to clear it`);
+        throw new Error(`a note must be a string, not ${typeof text}${gotSuffix(text)} — pass the full replacement note, or "" to clear it`);
     }
     const error = validateRoleNote(text);
     if (error)