diff --git a/.grace/graph/main.xml b/.grace/graph/main.xml index c11e899..5f8b096 100644 --- a/.grace/graph/main.xml +++ b/.grace/graph/main.xml @@ -9,7 +9,7 @@ HostCompatCORE_LOGICimplementedOwn the supported native OpenCode host window, the verified-host evidence list from src/hosts.json, and the verified/tolerated/unsupported classification consumed by runtime discovery, CLI inspection, and the live host gates; report upstream drift and fetch an exact host binary for the gates.src/lib/host-compat.ts, src/hosts.json, scripts/host-check.tsnoneV-M-HOST-COMPAT OpenCodeConfigToolsUTILITYimplementedMutate native OpenCode 2.0.18 runtime and vvoc config conservatively through the native fields (plugins array of string or {package, options} entries, agents, skills, providers, permissions), pin the combined base package registration once, migrate legacy /tui specs, preserve plugin entry options, materialize supported V1 plugin/agent/provider/command/small_model/tools shapes into the native V2 shape with a timestamped backup and refuse residual V1 shapes before any write, inspect the supported host window (>=2.0.18 <3.0.0) and its verified/tolerated classification, write managed agent/skill registrations plus the vvoc plugins modelIntent envelope for role intent, and render strict schema v3 including optional web providers, credentials, required direct Z.AI regions, an optional provider-neutral systemone connection with guardian decision-backend policy, and plugin-owned config shapes (hashline-edit routing, tool-history-compaction budgets with the recent-message window and saved-output keys, peak-hours mode/grace/schedules with revision-dated defaults, spec-guard mode). The zone also mirrors an existing managed vvoc entry in the native cli.json TUI client config to the pinned specifier (never creating one) and compares the client and server pins for drift reporting, reconciles legacy inline managed {file:...} agent prompts, deduplicates skills roots by real path, and reports read-only managed prompt/skill and deprecated permission-action drift.src/lib/opencode.ts, src/lib/opencode/paths.ts, src/lib/opencode/plugin-registration.ts, src/lib/opencode/agent-registrations.ts, src/lib/opencode/model-overrides.ts, src/lib/opencode/vvoc-config-io.ts, src/lib/opencode/inspection.ts, src/lib/opencode/config-migration.ts, src/lib/opencode/shared-utils.ts, src/lib/package.ts, src/lib/vvoc-config.ts, src/lib/model-roles.ts, src/lib/vvoc-paths.ts, schemas/vvoc/v3.jsonM-CONFIG-LAYERS, M-MODEL-ROLES, M-VVOC-PRESET-REGISTRY, M-CLI-MANAGED-AGENTS, M-CLI-MANAGED-SKILLS, M-CLI-AGENT-MODELSV-M-CLI-CONFIG ReleaseAutomationSCRIPTimplementedGuard file-local GRACE markup, package exports, and releases with expected-governed-file checks, source-path checks, deterministic OpenTUI Solid test preloading, isolated local TUI smoke launches, local version bumping, AI changelog summary generation, schema id consistency, exact-SHA CI publication, CI-result waiting, bounded npm metadata retry and gitHead verification, and authenticated local tag/GitHub Release finalization, version-derived latest/rc publication channel plumbing with contradiction rejection and pre-release marked rc GitHub Releases,bunfig.toml, scripts/check-grace-markup.ts, scripts/check-grace-markup.test.ts, scripts/check-exports.ts, scripts/tui-local.ts, scripts/release-bump.ts, scripts/release-bump.test.ts, scripts/release-check.ts, scripts/release-summary.ts, .github/workflows/publish.yml, schemas/vvoc/v3.jsonM-CLI-CONFIG, M-CLI-COMMANDS, @opentui/solid, git CLI, gh CLI, GitHub Actions, npm trusted publishingV-M-RELEASE-AUTOMATION - ManagedAgentsUTILITYimplementedDefine bundled vv-controller, enhancer, guardian, investigator, vv-implementer, vv-spec-reviewer, vv-code-reviewer, and read-only vv-reflector templates carrying correctness-obligation and reflection instructions (controller correctness leadership with settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, stop/recovery/completion distinctions and reserved handoffs, bounded implementer impact investigation with worker-stop semantics, settled evidence, false-premise escalation, reviewer-finding conflict routing back to the controller, evidence-based reviewer verdicts with material verification gaps and scoped re-review guidance, and investigator property reporting), load managed prompt text, and keep the shipped tracked-result protocol examples semantically validated against the runtime parser; worker templates copy the assignment header and state that the controller owns work-item lifecycle.src/lib/managed-agents.ts, templates/agents/*.mdM-CLI-CONFIGV-M-CLI-MANAGED-AGENTS + ManagedAgentsUTILITYimplementedDefine bundled vv-controller, enhancer, guardian, investigator, vv-implementer, vv-spec-reviewer, vv-code-reviewer, and read-only vv-reflector templates carrying correctness-obligation and reflection instructions (controller correctness leadership, pressure-versus-evidence distinction, stop/recovery/completion distinctions and reserved handoffs, bounded implementer impact investigation with worker-stop semantics, settled evidence, false-premise escalation, reviewer-finding conflict routing back to the controller, evidence-based reviewer verdicts with material verification gaps and scoped re-review guidance, and investigator property reporting), with the vv-controller working_state, assumption_discipline, editing_workflow, and reroute_on_evidence sections — settled-conclusion reopen triggers and false-premise handling included — delegated to the system-context-injection plugin's universal injection as their single source, load managed prompt text, and keep the shipped tracked-result protocol examples semantically validated against the runtime parser; worker templates copy the assignment header and state that the controller owns work-item lifecycle.src/lib/managed-agents.ts, templates/agents/*.mdM-CLI-CONFIGV-M-CLI-MANAGED-AGENTS ManagedSkillsUTILITYimplementedDefine bundled vv-spec, vv-plan, vv-review, vv-execute, vv-reflect, and vv-handoff skill templates and reference loading — including the packaged on-demand nine-tool tool-contracts reference generated from the agent-tool catalog and the vv-reflect read-only session-graph extractor reference with a streaming archive mode — and the element-name COMPONENT identity format with snake_case fields and the plan-subset-of-spec invariant, with correctness obligations carried through spec ambiguity resolution, plan criteria, execution acceptance evidence distinct from bounded recovery, native plan registration boundaries, scoped re-review guidance, honest review reporting, and the literal VVOC_WORK_ITEM_ID launch/state contract.src/lib/managed-skills.ts, templates/skills/**/SKILL.md, templates/skills/**/references/*M-CLI-CONFIG, M-AGENT-TOOL-CONTRACT (generated reference)V-M-CLI-MANAGED-SKILLS AgentModelsUTILITYimplementedDefine supported vvoc model target IDs and shared model override validation helpers retained for current command and config compatibility.src/lib/agent-models.tsM-CLI-MANAGED-AGENTSV-M-CLI-AGENT-MODELS PluginToggleConfigUTILITYimplementedDefine vvoc-managed server and TUI plugin toggle names, default all-true config, default hashline edit-routing table, default tool-history-compaction entry (including the recent-message window and saved-output keys), revision-dated default peak-hours schedules and mode/grace entry, default spec-guard warn entry, the systemone provider toggle, conservative plugin entry materialization for sync/init, and pure isPluginEnabled helper.src/lib/plugin-toggle-config.tsnoneV-M-PLUGIN-TOGGLE-CONFIG @@ -23,7 +23,7 @@ GuardianPluginINTEGRATIONimplementedReview native OpenCode 2.0.18 permission evaluations through ctx.permission.hook("evaluate") with a constrained, settings-bound Guardian auxiliary model whose policy denies both built-in and canonical web tools, or with an opt-in provider-neutral System One decision provider when guardian.decisionBackend selects it and the systemone section, toggle, and ${VAR} key resolve; systemone answers (a low-risk noul and a risk score) map onto the same bounded low-risk verdict, and any provider failure defers; mutating effect only to auto-approve a bounded low-risk verdict and otherwise leaving the user’s manual or denied decision intact; unbound or disabled families defer.src/plugins/guardian/index.ts, templates/agents/guardian.mdM-NATIVE-RUNTIME, M-CONFIG-LAYERS, M-CLI-CONFIG, M-MODEL-ROLES, M-SYSTEMONE-PROVIDER, M-PLUGIN-TOGGLE-CONFIGV-M-PLUGIN-GUARDIAN SystemOneProviderCORE_LOGICimplementedProvide a provider-neutral client for the de-facto System One decision protocol (POST /v1/systemone): shape state and typed noul, choice, and score questions, decode typed answers with probabilities and confidence while ignoring unknown fields, apply a bounded timeout and retry count, and raise credential-safe typed errors; any compliant endpoint is selected by baseUrl and model with no vendor-specific branch and no default endpoint.src/lib/systemone.tsnoneV-M-SYSTEMONE-PROVIDER HashlineEditPluginINTEGRATIONimplementedRoute per-model edit tooling by registering hashline_edit and dsh str_replace_editor as native OpenCode 2.0.18 tools; resolve the session edit mode from the family-settings-projected vvoc routing config (apply_patch | edit | str_replace_editor | hashline_edit); expose exactly one plugin edit tool per actual session model while never touching the host edit/apply_patch contracts; require a native resource permission before any write; transform native read results with true line/hash/context anchors and freshness tracking; apply valid payloads literally; honor an explicit host permission denial and restore plugin-owned versus captured host tool definitions by ownership; and report bounded post-edit diffs with apply warnings and editMode telemetry.src/plugins/hashline-edit/*.tsM-NATIVE-RUNTIME, M-PLUGIN-TOGGLE-CONFIG, M-CONFIG-LAYERS, M-CLI-CONFIG, M-AGENT-TOOL-CONTRACTV-M-PLUGIN-HASHLINE-EDIT - SystemContextInjectionPluginINTEGRATIONimplementedInject universal primary guidance — including the correctness-obligations block for behavior changes with material-assumption discipline, settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, test results treated as evidence rather than the specification, repository-answerable question resolution, and honest residual uncertainty, without mandatory per-claim reasoning labels or restatement rituals — and one family-settings-resolved orchestration policy into vv-controller at the request tail while static guidance stays in the system prefix; skill discovery is registered by install/sync through the native skills config, not by this plugin.src/plugins/system-context-injection/index.tsM-NATIVE-RUNTIME, M-CONFIG-LAYERS, M-ORCHESTRATION-PROFILES, M-CLI-MANAGED-AGENTS, M-PLUGIN-TOGGLE-CONFIGV-M-PLUGIN-SYSTEM-CONTEXT-INJECTION + SystemContextInjectionPluginINTEGRATIONimplementedInject universal primary guidance — including the correctness-obligations block for behavior changes with material-assumption discipline, settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, test results treated as evidence rather than the specification, repository-answerable question resolution, and honest residual uncertainty, without mandatory per-claim reasoning labels or restatement rituals — as the single source of the working_state, assumption_discipline, editing_workflow, and reroute_on_evidence sections for every eligible primary agent including vv-controller, whose bundled template carries no duplicate copies — and one family-settings-resolved orchestration policy into vv-controller at the request tail while static guidance stays in the system prefix; skill discovery is registered by install/sync through the native skills config, not by this plugin.src/plugins/system-context-injection/index.tsM-NATIVE-RUNTIME, M-CONFIG-LAYERS, M-ORCHESTRATION-PROFILES, M-CLI-MANAGED-AGENTS, M-PLUGIN-TOGGLE-CONFIGV-M-PLUGIN-SYSTEM-CONTEXT-INJECTION SecretsRedactionPluginINTEGRATIONimplementedRedact secrets including placeholder-resolved configured web apiKey values in native provider-bound request hooks (context/generate/compaction/title) under the family's resolved settings, then restore placeholders with copy-on-write semantics for frozen native tool inputs, SSE and non-SSE http.response bodies, and WebSocket frames — carrying placeholders split across SSE and WebSocket TEXT deltas with bounded carry while preserving opaque frames.src/plugins/secrets-redaction.ts, src/plugins/secrets-redaction/*.tsM-NATIVE-RUNTIME, M-CONFIG-LAYERS, M-CLI-CONFIG, M-PLUGIN-TOGGLE-CONFIG, M-ENV-SUBSTITUTIONV-M-PLUGIN-SECRETS-REDACTION SpecLintCORE_LOGICimplementedStrictly lint .vvoc spec-package XML artifacts through a content-addressed cache under XDG_CACHE_HOME keyed on every input hash plus a lint version: validate well-formedness over the htmlparser2 xmlMode tokenizer event stream, enforce attribute-free template contracts per artifact kind, component/task/wave/checkpoint identity patterns and uniqueness, bare-slug and task references, lifecycle-aware severity where draft incompleteness never blocks, the plan-components-subset-of-spec-components cross-file rule, the optional execution section with inline/classic/delegated modes, review_checkpoints with reviewer sets, scope paths, wave barriers, final coverage of tasks and write scopes, per-task write_scope requirements, and package layout checks; extractDelegatedPlanDefinition returns the typed obligations runtime registration reuses; the shared declared-path normalization and delegated obligation vocabulary are re-exported from M-WORKFLOW-CONTRACT.src/lib/spec-lint.ts, src/lib/spec-lint/parser.ts, src/lib/spec-lint/spec-rules.ts, src/lib/spec-lint/plan-rules.ts, src/lib/spec-lint/cross-file-rules.ts, src/lib/spec-lint/delegated-extraction.ts, src/lib/spec-lint/lint.ts, src/lib/spec-lint-cache.tshtmlparser2, M-CONFIG-LAYERSV-M-SPEC-LINT TelegramConfigResolverUTILITYimplementedResolve the optional canonical telegram section into gateway configuration: disabled-cause discrimination with value-free diagnostics, ${VAR} botToken resolution through the shared env-substitution helper with unset-reference reporting by name only, activity-window, maxTopics rotation-cap, and delivery-setting defaults, connectivity passthrough, and a stable credential-safe bot fingerprint for storage reset decisions.src/plugins/telegram/config.tssrc/lib/env-substitution.ts, src/lib/vvoc-config.tsV-M-TELEGRAM-CONFIG diff --git a/.grace/verification/main.xml b/.grace/verification/main.xml index 910f48f..3961a99 100644 --- a/.grace/verification/main.xml +++ b/.grace/verification/main.xml @@ -41,7 +41,7 @@ src/lib/host-compat.test.tsscripts/host-check.test.tsbun test src/lib/host-compat.test.ts scripts/host-check.test.tsbun run host:checkbun run contracts:host --probeThe supported host window is major-bounded (>=2.0.18 <3.0.0): 2.0.18 through 2.9.x are supported, prereleases and 1.x/3.x are refused, and the verified list from src/hosts.json separates verified from tolerated in-window hosts. The drift reporter classifies the newest stable upstream release and prints the next step, and the live probe authorizes exactly the selected host version with its SHA-256.The declared TestFiles and Checks exercise this scenario deterministically.Window parsing and classification are deterministic and data-driven; the verified list is the only evidence-bearing set; the drift report never claims a host is verified without an entry, and the live probe records schemaArgumentDescriptions and hostArgNormalization observations instead of asserting a host-specific forwarding shape. src/lib/opencode.test.tssrc/lib/opencode/config-migration.test.tssrc/lib/vvoc-config.test.tssrc/commands/sync.test.tsbun test src/lib/vvoc-config.test.ts src/lib/opencode.test.ts src/lib/opencode/config-migration.test.ts src/commands/sync.test.tsbun run lintbun run fmt:checkStrict vvoc and conservative native OpenCode runtime writes preserve user-owned configuration and reject invalid current documents, including host-gated materialization of supported V1 plugin/agent/provider/command/small_model/tools shapes into the native V2 shape with a timestamped backup and validate-before-write, and refusal of residual V1 shapes before any mutation. The strict schema v3 plugins union accepts the peak-hours entry (enabled, mode soft or hard, graceActiveSessions, schedules with HH:MM windows, timezone, and optional days) while rejecting malformed times, modes, and unknown keys, the embedded schema matches schemas/vvoc/v3.json, and install/init/sync conservatively materialize the peak-hours entry beside hashline-edit and tool-history-compaction. The strict schema v3 also accepts the optional provider-neutral systemone connection (baseUrl, model, optional ${VAR} apiKey, timeoutMs, maxRetries) and the guardian decisionBackend and systemone policy fields, rejecting a missing baseUrl or model and out-of-range values, with the embedded guardian and systemone schemas matching schemas/vvoc/v3.json. The cli.json TUI client config is mirrored only: an existing managed vvoc entry is rewritten to the pinned specifier with comments, client preferences, options, and unrelated entries preserved, nothing is created when no client pin exists, conflicting managed entries are refused, and inspection warns when the client pin drifts from the server pin. Prompt sync refreshes a vvoc-managed legacy inline {file:...} system prompt, preserves and reports user-owned inline sources, and deduplicates skills roots by real path; installation inspection warns about stale managed prompts/skills, duplicate skills roots, and deprecated permission actions while missing {file:} references remain problems.The declared TestFiles and Checks exercise this scenario deterministically.Native plugins-array mutation writes the pinned combined base package as a string or {package, options} entry, migrates legacy /tui specs, preserves comments, unrelated entries, and entry options, and carries role intent in the vvoc plugins options.modelIntent envelope instead of native model fields; strict schema-v3 parsing preserves optional web providers and credentials, requires explicit valid regions for direct zai providers, and rejects invalid providers, regions, or fields; the >=2.0.18 <3.0.0 host window check with its verified list, install/sync idempotence, parse state, and registration state are deterministic. bunfig.tomlscripts/check-grace-markup.test.tsscripts/tui-local.test.tsscripts/release-bump.test.tsscripts/release-check.test.tsscripts/release-summary.test.tsbun test scripts/check-grace-markup.test.ts scripts/tui-local.test.ts scripts/release-bump.test.ts scripts/release-check.test.ts scripts/release-summary.test.tsbun run grace:checkbun test src/tui/context/view.test.tsbun run scripts/check-exports.tsbun run release:checkbun run typecheckbun run fmt:checkbun run pack:checkRepository gates validate file-local GRACE markup, exports, summary generation, exact-SHA publication, npm metadata, and local finalization without premature tag mutation. Channel derivation maps rc pre-release versions to the rc dist-tag and everything else to latest, rejects a contradicting explicit channel, passes the channel through the publish workflow dispatch, publishes with the explicit npm dist-tag, and marks rc GitHub Releases as pre-release.The declared TestFiles and Checks exercise this scenario deterministically.Every expected governed TypeScript or TSX source and test has one balanced module contract and map plus exactly one current LAST_CHANGE entry, while the Bun test runner preloads @opentui/solid/preload before test module discovery; local release preparation pushes only the branch, captures and waits for the exact-SHA workflow run, retries delayed npm metadata, verifies gitHead, and creates the annotated tag/GitHub Release locally; publish.yml is explicit-dispatch-only, read-only for repository contents, and orders tests before npm publication without tag mutation. - src/lib/managed-agents.test.tsbun test src/lib/managed-agents.test.tsbun x tsc --noEmitBundled managed agent metadata, correctness-obligation instruction contracts with superseded-direction removal — stop/recovery/completion distinctions with reserved handoffs, repository-answerable question resolution, settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, reviewer-finding conflict routing back to the controller, worker-stop semantics, scoped re-review guidance, and per-claim/restatement exclusions — the shipped tracked-result protocol examples semantically validated against the runtime parser with a non-wi-1 assigned id, worker templates copying the assignment header with controller-owned lifecycle, and project/global prompt lookup remain deterministic and profile-neutral where required; tests assert instruction delivery, never model evaluation.The declared TestFiles and Checks exercise this scenario deterministically. + src/lib/managed-agents.test.tsbun test src/lib/managed-agents.test.tsbun x tsc --noEmitBundled managed agent metadata, correctness-obligation instruction contracts with superseded-direction removal — stop/recovery/completion distinctions with reserved handoffs, repository-answerable question resolution, pressure-versus-evidence distinction, reviewer-finding conflict routing back to the controller, worker-stop semantics, scoped re-review guidance, and per-claim/restatement exclusions — plus the template-side dedup contract leaving the working_state, assumption_discipline, editing_workflow, and reroute_on_evidence sections to the plugin's universal injection, the shipped tracked-result protocol examples semantically validated against the runtime parser with a non-wi-1 assigned id, worker templates copying the assignment header with controller-owned lifecycle, and project/global prompt lookup remain deterministic and profile-neutral where required; tests assert instruction delivery, never model evaluation.The declared TestFiles and Checks exercise this scenario deterministically. src/lib/opencode.test.tssrc/lib/managed-skills.test.tssrc/lib/session-graph.test.tsbun test src/lib/opencode.test.tsbun test src/lib/managed-skills.test.tsbun test src/lib/session-graph.test.tsbun x tsc --noEmitbun run lintbun run fmt:checkManaged skill discovery, lookup, installation, synchronization, references, and workflow contracts — including correctness obligations across spec, plan, execute, and review stages, bounded recovery operations distinct from acceptance and rework, the native plan registration boundary, and scoped re-review guidance — remain deterministic, and the generated on-demand nine-tool tool-contracts reference plus the vv-reflect read-only session-graph extractor install through the existing reference loader and are included in the packed templates; the extractor runs against a synthetic OpenCode 2.x schema to pin target resolution, subagent-tree recursion, friction signals, changed-file semantics, archive filters, legacy part union/deduplication, deterministic JSON/Markdown output, and truncation markers; the shipped vv-execute and vv-review instructions carry the literal VVOC_WORK_ITEM_ID header, state map, standalone field rules, and launch-rejection guidance; tests assert instruction delivery, not model evaluation.The declared TestFiles and Checks exercise this scenario deterministically. src/lib/agent-models.test.tsbun test src/lib/agent-models.test.tsbun x tsc --noEmitbun run lintbun run fmt:checkbun run buildSupported model target IDs and override arguments validate and format deterministically.The declared TestFiles and Checks exercise this scenario deterministically. src/lib/plugin-toggle-config.test.tsbun test src/lib/plugin-toggle-config.test.tsbun x tsc --noEmitbun run lintbun run fmt:checkPlugin toggle names, defaults, materialization, and enablement stay conservative; Known plugin toggles default on, preserve explicit values, and reject unknown names. The systemone provider toggle is canonical, defaults on, and can be disabled as a kill switch without affecting other plugins.The declared TestFiles and Checks exercise this scenario deterministically. The peak-hours entry materializes conservatively: boolean or missing entries expand to the revision-dated default schedules, object entries keep user mode, grace, and schedules values without overwrite, and the shared defaults are never mutated. @@ -58,7 +58,7 @@ src/plugins/guardian.integration.test.tsbun test src/plugins/guardian.integration.test.tsbun x tsc --noEmitGuardian permission review remains bounded, role-resolved, web-tool constrained, backend-selectable, and fail-safe.The declared TestFiles and Checks exercise this scenario deterministically.Native permission.evaluate events mutate effect only within policy: unresolved or disabled families defer, low-risk verdicts below the threshold auto-allow through settings-bound auxiliary generation or through the opt-in System One provider (a low-risk noul gated by lowRiskThreshold and a risk score mapped linearly onto the approval threshold); any provider failure or malformed answer, uncertainty, inference failure, and empty verdicts fall back to the user’s ask/deny decision; a disabled section, unresolved ${VAR} key, or disabled systemone toggle keeps the fast backend without auto-approving from the provider; review input stays bounded and credential-safe, provider failures never auto-approve, and setup registers the evaluate hook and releases the shared runtime on cleanup. src/lib/systemone.test.tsbun test src/lib/systemone.test.tsbun x tsc --noEmitThe provider-neutral System One client shapes requests, decodes typed noul, choice, and score answers, and fails safely over an injected transport.The declared TestFiles and Checks exercise this scenario deterministically.POST {baseUrl}/v1/systemone receives state, model, and typed questions; noul, choice, and score answers decode with probabilities and confidence while unknown fields and provider extras are ignored; two distinct base URLs work through one client with no vendor branch; a bounded timeout and retry count apply and exhausted retries surface a typed error; 401 is not retried; invalid local request shapes are rejected before any call; and no error message contains the apiKey or the state. src/plugins/hashline-edit/normalize-edits.test.tssrc/plugins/hashline-edit/contracts.test.tssrc/plugins/hashline-edit.integration.test.tssrc/plugins/hashline-edit/edit-operations.test.tssrc/plugins/hashline-edit/validation.test.tssrc/plugins/hashline-edit/tool-description.test.tssrc/plugins/hashline-edit/routing.test.tssrc/plugins/hashline-edit/session-state.test.tssrc/plugins/hashline-edit/str-replace-editor.test.tsbun test src/plugins/hashline-edit/normalize-edits.test.ts src/plugins/hashline-edit/contracts.test.ts src/plugins/hashline-edit.integration.test.ts src/plugins/hashline-edit/edit-operations.test.ts src/plugins/hashline-edit/validation.test.ts src/plugins/hashline-edit/tool-description.test.ts src/plugins/hashline-edit/routing.test.ts src/plugins/hashline-edit/session-state.test.ts src/plugins/hashline-edit/str-replace-editor.test.tsbun x tsc --noEmitThe four-value routing vocabulary (apply_patch | edit | str_replace_editor | hashline_edit) resolves per family settings and session model, and native session tool-list visibility leaves exactly one existing-file editor visible — the host built-in edit stays visible for the edit cohort and is hidden for the str_replace_editor/hashline_edit cohorts, apply_patch is left to the host gate, new-file creation stays available, and the plugin registers only hashline_edit and str_replace_editor as native tools while requiring an awaited native resource permission before any write, honoring an explicit host permission denial (a session that exposes no edit-family tool is left untouched without throwing), and restoring plugin-owned definitions from the plugin itself rather than from the captured host map; hashline_edit and str_replace_editor publish closed operation-specific input contracts, reject unknown or conflicting fields and malformed ranges before mutation, and preserve hashline read anchors, three-part reference enforcement, unified replace with optional end, replace_range, lines:null/empty deletion, append/prepend boundary insertion, meaningful empty new_str, a view_range ending at -1, literal payload application, neighbor-duplication warnings, the dsh str_replace_editor contract, and bounded post-edit diff feedback. Post-release telemetry reruns the opencode.db baseline split by the editMode metadata tag.The declared TestFiles and Checks exercise this scenario deterministically. - src/plugins/system-context-injection.integration.test.tsbun test src/plugins/system-context-injection.integration.test.tsbun x tsc --noEmitEligible primary sessions receive universal guidance — including the correctness-obligations block for behavior changes with material-assumption discipline, settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, test results treated as evidence rather than the specification, repository-answerable question resolution, and honest residual uncertainty, without mandatory per-claim reasoning labels or restatement rituals — and the controller orchestration policy injected at the request tail while static guidance stays in the system prefix; tests assert deterministic instruction delivery, not model behavior.The declared TestFiles and Checks exercise this scenario deterministically. + src/plugins/system-context-injection.integration.test.tsbun test src/plugins/system-context-injection.integration.test.tsbun x tsc --noEmitEligible primary sessions receive universal guidance — including the correctness-obligations block for behavior changes with material-assumption discipline, settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, test results treated as evidence rather than the specification, repository-answerable question resolution, and honest residual uncertainty, without mandatory per-claim reasoning labels or restatement rituals — as the single source of the working_state, assumption_discipline, editing_workflow, and reroute_on_evidence sections, with the assembled bundled vv-controller template plus injection carrying each of them exactly once and the editing_workflow section including the merged template-only contract-reading and speculative-reroute lines — and the controller orchestration policy injected at the request tail while static guidance stays in the system prefix; tests assert deterministic instruction delivery, not model behavior.The declared TestFiles and Checks exercise this scenario deterministically. src/plugins/secrets-redaction/engine.test.tssrc/plugins/secrets-redaction/index.test.tssrc/plugins/secrets-redaction/patterns.test.tssrc/plugins/secrets-redaction/session.test.tssrc/plugins/secrets-redaction/stream.test.tsbun test src/plugins/secrets-redaction/engine.test.ts src/plugins/secrets-redaction/index.test.ts src/plugins/secrets-redaction/patterns.test.ts src/plugins/secrets-redaction/session.test.ts src/plugins/secrets-redaction/stream.test.tsbun run typecheckbun run lintBuilt-in, custom, and configured secrets redact before provider exposure under the family’s resolved settings, restore copy-on-write for frozen native tool input and streamed provider responses — including placeholders split across SSE and WebSocket TEXT deltas with bounded lane carry — and preserve opaque frames.The declared TestFiles and Checks exercise this scenario deterministically.Built-in, regex, custom keyword, and configured web apiKey values redact before provider calls, with ${VAR} placeholders in web apiKey fields resolved from the environment so redaction covers the real key rather than the placeholder text; split placeholders restore across text pushes, SSE events, and byte chunks with per-lane scoping, bounded carry, byte-for-byte opaque/comment/malformed frame preservation, and non-SSE body restoration; placeholder restoration and session behavior remain deterministic. src/lib/spec-lint.test.tssrc/lib/spec-lint-cache.test.tssrc/lib/config-layers.test.tsbun test src/lib/spec-lint.test.ts src/lib/spec-lint-cache.test.ts src/lib/config-layers.test.tsbun run typecheckThe strict engine validates well-formedness, template contracts, identity patterns, references, lifecycle-aware severity, cross-file subset rules, layout checks, the optional delegated execution and review-checkpoint vocabulary with scope paths, reviewer sets, wave barriers, and final coverage, typed extractDelegatedPlanDefinition, and the content-addressed cache with content and version invalidation including rejection of old-version disk caches.The declared TestFiles and Checks exercise this scenario deterministically.Fixture corpus proves every violation class carries a specific rule with file and line, draft documents tolerate emptiness while approved documents do not, plan components must exist in the linked spec, legacy plans without execution stay valid, delegated obligations are required only for approved plans, the shipped reference templates lint clean, and cache runs hit on unchanged inputs and invalidate when any input hash or the lint version changes. src/plugins/spec-guard/index.test.tssrc/lib/plugin-toggle-config.test.tssrc/lib/vvoc-config.test.tssrc/lib/opencode.test.tsbun test src/plugins/spec-guard/index.test.ts src/lib/plugin-toggle-config.test.ts src/lib/vvoc-config.test.ts src/lib/opencode.test.tsbun run typecheckThe spec-guard plugin annotates reads of active artifacts, validates post-write state, refuses only enforce-mode ERROR writes, stays silent on archived files, and fails open on internal errors; strict schema v3 accepts the warn/enforce entry and sync materializes it conservatively.The declared TestFiles and Checks exercise this scenario deterministically.Hook-level tests with injected dependencies prove read verdict injection, archive silence, warn append, enforce refusal and edit prefixes, warning-only and draft states never failing, unreadable-file degradation, schema acceptance and rejection for the spec-guard arm, and canonical sync writes materializing the default warn entry without overwriting user values. diff --git a/src/lib/managed-agents.test.ts b/src/lib/managed-agents.test.ts index cd360c4..9894128 100644 --- a/src/lib/managed-agents.test.ts +++ b/src/lib/managed-agents.test.ts @@ -2,7 +2,7 @@ // VERSION: 0.8.0 // START_MODULE_CONTRACT // PURPOSE: Verify vvoc-managed agent prompt template loading, scoped runtime lookup, and correctness-obligation instruction contracts. -// SCOPE: Bundled template reads, profile-neutral controller invariants, controller correctness leadership with settled-conclusion reopen triggers, false-premise handling, and stop/recovery distinction with reserved handoffs, bounded implementer impact investigation with worker-stop semantics, settled evidence, false-premise escalation, and reviewer-finding conflict routing, evidence-based reviewer verdicts with initial-versus-scoped-re-review guidance, investigator property reporting, primary/subagent metadata checks, semantic agreement of the shipped tracked-result protocol examples with the runtime parser, scoped prompt resolution, and missing prompt failures. +// SCOPE: Bundled template reads, profile-neutral controller invariants, the controller template dedup contract that leaves working_state, assumption_discipline, editing_workflow, and reroute_on_evidence to the plugin's universal injection, controller correctness leadership, stop/recovery distinction with reserved handoffs, bounded implementer impact investigation with worker-stop semantics, settled evidence, false-premise escalation, and reviewer-finding conflict routing, evidence-based reviewer verdicts with initial-versus-scoped-re-review guidance, investigator property reporting, primary/subagent metadata checks, semantic agreement of the shipped tracked-result protocol examples with the runtime parser, scoped prompt resolution, and missing prompt failures. // DEPENDS: [bun:test, node:fs/promises, node:os, node:path, src/lib/managed-agents.ts, src/lib/vvoc-paths.ts, src/plugins/workflow/protocol.ts] // LINKS: [M-CLI-MANAGED-AGENTS, M-WORKFLOW-PROTOCOL, V-M-CLI-MANAGED-AGENTS] // ROLE: TEST @@ -16,7 +16,7 @@ // END_MODULE_MAP // // START_CHANGE_SUMMARY -// LAST_CHANGE: [C-WORKFLOW-PROMPT-SYNC-DOCTOR-ARCHIVE T-001 - Worker templates now copy the assignment header and state that the controller owns work-item lifecycle; the shipped protocol examples remain parser-validated.] +// LAST_CHANGE: [Instruction deduplication - The vv-controller template contract now asserts the dedup contract (no working_state, assumption_discipline, editing_workflow, or reroute_on_evidence copies; the plugin's universal sections are the single source) and drops assertions on the removed template wordings.] // END_CHANGE_SUMMARY import { describe, expect, test } from "bun:test"; @@ -114,10 +114,6 @@ describe("managed agent prompts", () => { expect(template).toContain("You are the vv-controller primary agent."); expect(MANAGED_PRIMARY_AGENT_NAMES.filter((name) => name === "vv-controller")).toHaveLength(1); expect(template).toContain(""); - expect(template).toContain(""); - expect(template).toContain(""); - expect(template).toContain(""); - expect(template).toContain(""); expect(template).toContain(""); expect(template).toContain(""); expect(template).toContain(""); @@ -129,6 +125,17 @@ describe("managed agent prompts", () => { expect(template).toContain("`vv-execute` validates an approved plan"); expect(template).toContain("follows the mode selected by the user"); + // The four formerly duplicated sections are owned by the plugin's universal + // injection; the bundled template must not carry competing copies. + for (const deduplicatedSection of [ + "", + "", + "", + "", + ]) { + expect(template).not.toContain(deduplicatedSection); + } + for (const inactivePolicyTerm of [ "direct_change", "change_with_review", @@ -190,7 +197,9 @@ describe("managed agent prompts", () => { const template = await loadManagedAgentPromptTemplate("vv-controller"); const normalized = template.replace(/\s+/g, " "); - expect(normalized).toContain("Surface a false premise instead of silently satisfying it"); + // working_state, assumption_discipline, and reroute_on_evidence wording now + // lives only in the plugin's universal injection; the assertions below cover + // the sections this template still carries. expect(normalized).toContain( "Distinguish unsupported disagreement or authority pressure from concrete new evidence", ); @@ -200,12 +209,6 @@ describe("managed agent prompts", () => { expect(normalized).toContain( "route an explicit user change in requirements through the existing scope and approval process rather than a factual debate", ); - expect(normalized).toContain( - "Reopen a settled conclusion or reroute on concrete triggers only", - ); - expect(normalized).toContain( - "Vague doubt or unsupported pressure is not itself a trigger, but required checks still run — an unchecked claim is not settled", - ); expect(normalized).toContain( "Move forward once the required checks substantiate the material claims for the current files and inputs", ); diff --git a/src/lib/managed-agents.ts b/src/lib/managed-agents.ts index 900cdc7..912d255 100644 --- a/src/lib/managed-agents.ts +++ b/src/lib/managed-agents.ts @@ -2,7 +2,7 @@ // VERSION: 0.4.0 // START_MODULE_CONTRACT // PURPOSE: Describe vvoc-managed OpenCode agent prompts and load them from bundled templates or scoped vvoc config roots. -// SCOPE: Built-in primary/subagent metadata, managed prompt names, prompt file path resolution, bundled template loading, and project/global prompt lookup. +// SCOPE: Built-in primary/subagent metadata, managed prompt names, prompt file path resolution, bundled template loading (the vv-controller template delegates its working_state, assumption_discipline, editing_workflow, and reroute_on_evidence sections to the system-context-injection plugin's universal sections as their single source), and project/global prompt lookup. // DEPENDS: [node:fs/promises, node:path, src/lib/vvoc-paths.ts] // LINKS: M-CLI-MANAGED-AGENTS, M-CLI-CONFIG, M-PLUGIN-GUARDIAN // ROLE: RUNTIME @@ -37,7 +37,7 @@ // END_MODULE_MAP // // START_CHANGE_SUMMARY -// LAST_CHANGE: [v0.5.0 - Removed two creative-role managed subagents. Only executor subagents remain.] +// LAST_CHANGE: [Instruction deduplication - The bundled vv-controller template no longer carries working_state, assumption_discipline, editing_workflow, or reroute_on_evidence; the system-context-injection plugin's universal sections are their single source.] // END_CHANGE_SUMMARY import { readFile } from "node:fs/promises"; diff --git a/src/plugins/system-context-injection.integration.test.ts b/src/plugins/system-context-injection.integration.test.ts index 34d214c..b3f128b 100644 --- a/src/plugins/system-context-injection.integration.test.ts +++ b/src/plugins/system-context-injection.integration.test.ts @@ -2,8 +2,8 @@ // VERSION: 2.0.0 // START_MODULE_CONTRACT // PURPOSE: Verify native universal primary guidance injection, including correctness obligations and evidence discipline, and bound-family concrete vv-controller orchestration policy injection into native system parts. -// SCOPE: Correctness-obligations delivery, settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, per-profile controller context, primary isolation, explore guidance, built-in/managed/configured subagent exclusion, duplicate prevention, native-registry mode exclusion, and unknown/disabled no-op. -// DEPENDS: [bun:test, src/lib/orchestration.ts, src/lib/vvoc-config.ts, src/plugins/system-context-injection/index.ts] +// SCOPE: Correctness-obligations delivery, settled-conclusion reopen triggers, false-premise handling, pressure-versus-evidence distinction, per-profile controller context, primary isolation, explore guidance, built-in/managed/configured subagent exclusion, duplicate prevention, assembled vv-controller template plus injection dedup with each universal section exactly once and the merged template-only editing_workflow lines, native-registry mode exclusion, and unknown/disabled no-op. +// DEPENDS: [bun:test, src/lib/managed-agents.ts, src/lib/orchestration.ts, src/lib/vvoc-config.ts, src/plugins/system-context-injection/index.ts] // LINKS: [M-PLUGIN-SYSTEM-CONTEXT-INJECTION, M-ORCHESTRATION-PROFILES, V-M-PLUGIN-SYSTEM-CONTEXT-INJECTION] // ROLE: TEST // MAP_MODE: LOCALS @@ -19,11 +19,12 @@ // END_MODULE_MAP // // START_CHANGE_SUMMARY -// LAST_CHANGE: [C-SNAPSHOT-ANCHORING-REDESIGN T-007 - Static guidance is asserted in the system prefix while the variable orchestration policy is asserted at the request tail.] +// LAST_CHANGE: [Instruction deduplication - The injected editing_workflow section absorbed the template-only contract-reading and speculative-reroute lines, and an assembled vv-controller template plus injection test pins each formerly duplicated universal section to exactly one occurrence.] // END_CHANGE_SUMMARY import { describe, expect, test } from "bun:test"; import type { OrchestrationProfile } from "../lib/orchestration.js"; +import { loadManagedAgentPromptTemplate } from "../lib/managed-agents.js"; import { createDefaultVvocConfig, type VvocConfig } from "../lib/vvoc-config.js"; import { createSystemContextInjectionPlugin } from "./system-context-injection/index.js"; @@ -375,6 +376,36 @@ describe("SystemContextInjectionPlugin", () => { expect(tail.match(/Keep architecture, critical code reading/g)).toHaveLength(1); }); + test("assembled vv-controller template plus injection keeps each universal section once", async () => { + const harness = await makeHarness({ profile: "balanced" }); + const handler = harness.hooks.get("context"); + if (handler === undefined) throw new Error("no context hook registered"); + const template = await loadManagedAgentPromptTemplate("vv-controller"); + const event: NativeContextEvent = { + sessionID: "session-vv-controller-assembled", + agent: "vv-controller", + system: [{ type: "text", text: template }], + messages: [{ role: "user", content: [] }], + }; + await handler(event); + + const system = systemText(event); + // The bundled vv-controller template carries no copies of the four formerly + // duplicated sections; the universal injection is their single source, so + // the assembled system contains each tag exactly once. + for (const tag of [ + "", + "", + "", + "", + ]) { + expect(system.split(tag).length - 1).toBe(1); + } + expect(system).toContain( + "Reserve `bash` for tests, builds, git, and other non-file-edit commands.", + ); + }); + test("skips plugin-managed and managed subagents", async () => { const harness = await makeHarness(); for (const agent of ["guardian", "vv-implementer"]) { @@ -468,6 +499,12 @@ describe("SystemContextInjectionPlugin", () => { expect(text).toContain( "Reserve `bash` for tests, builds, git, and other non-file-edit commands.", ); + expect(text).toContain( + "Before editing, understand the relevant local contract, nearby tests, and surrounding code.", + ); + expect(text).toContain( + "If direct editing reveals unclear behavior or unexpectedly broad scope, stop and reroute instead of continuing speculatively.", + ); expect(text).toContain( "inspect relevant index entries before debugging, fixing, changing behavior, operating on, architecting, or investigating repository-specific issues.", ); diff --git a/src/plugins/system-context-injection/index.ts b/src/plugins/system-context-injection/index.ts index 620b8c4..4d6e6b4 100644 --- a/src/plugins/system-context-injection/index.ts +++ b/src/plugins/system-context-injection/index.ts @@ -2,7 +2,7 @@ // VERSION: 2.1.0 // START_MODULE_CONTRACT // PURPOSE: Inject universal primary guidance, including correctness obligations and evidence discipline for behavior changes, and one bound-family-resolved concrete orchestration policy into vv-controller without polluting subagent prompts, through the native session context hook. -// SCOPE: Universal instructions with correctness obligations, material-assumption discipline, settled-conclusion reopen triggers, false-premise handling, and pressure-versus-evidence distinction; vv-controller policy selection from the immutable captured family config; the explore-subagent guidance exception even though native registry mode is subagent; built-in, managed and native-registry subagent exclusion for every other agent; internal title/summary/compaction exclusion; per-request agent-mode reads that never poison on transient failure; idempotent injection into native system parts; lifecycle cleanup. Skill-path registration is NOT delivered here: the old runtime config.skills.paths registration has no native plugin config-transform surface, and the native document `skills: string[]` install/sync writes are owned by T007. +// SCOPE: Universal instructions with correctness obligations, material-assumption discipline, settled-conclusion reopen triggers, false-premise handling, and pressure-versus-evidence distinction, which are the single source for the vv-controller bundled template's working_state, assumption_discipline, editing_workflow, and reroute_on_evidence sections (the bundled template no longer carries them); vv-controller policy selection from the immutable captured family config; the explore-subagent guidance exception even though native registry mode is subagent; built-in, managed and native-registry subagent exclusion for every other agent; internal title/summary/compaction exclusion; per-request agent-mode reads that never poison on transient failure; idempotent injection into native system parts; lifecycle cleanup. Skill-path registration is NOT delivered here: the old runtime config.skills.paths registration has no native plugin config-transform surface, and the native document `skills: string[]` install/sync writes are owned by T007. // DEPENDS: [@opencode/plugin, src/lib/managed-agents.ts, src/lib/orchestration.ts, src/runtime/context.ts, src/runtime/types.ts] // LINKS: [M-PLUGIN-SYSTEM-CONTEXT-INJECTION, M-ORCHESTRATION-PROFILES, M-CLI-MANAGED-AGENTS, M-NATIVE-RUNTIME, V-M-PLUGIN-SYSTEM-CONTEXT-INJECTION] // ROLE: RUNTIME @@ -17,7 +17,7 @@ // END_MODULE_MAP // // START_CHANGE_SUMMARY -// LAST_CHANGE: [C-SNAPSHOT-ANCHORING-REDESIGN T-007 - Static primary guidance stays in the system prefix while the variable orchestration policy is injected at the tail of the last user message only, so a profile change does not invalidate the cached prefix and tool/assistant messages keep their provider payload shape.] +// LAST_CHANGE: [Instruction deduplication - The universal working_state, assumption_discipline, editing_workflow, and reroute_on_evidence sections are now the single source for vv-controller: the bundled template no longer carries them, and the editing_workflow section absorbed the template-only contract-reading and speculative-reroute lines.] // END_CHANGE_SUMMARY import { SystemPart } from "@opencode/ai"; @@ -91,9 +91,11 @@ const UNIVERSAL_PRIMARY_SYSTEM_CONTEXTS = [ ].join("\n"), [ "", + "Before editing, understand the relevant local contract, nearby tests, and surrounding code.", "When editing files, prefer the `edit` tool over shell-based rewrites when it is available.", "Read the file first, then use exact `line#hash#anchor` refs from the latest `read` output when present.", "Reserve `bash` for tests, builds, git, and other non-file-edit commands.", + "If direct editing reveals unclear behavior or unexpectedly broad scope, stop and reroute instead of continuing speculatively.", "", ].join("\n"), [ diff --git a/templates/agents/vv-controller.md b/templates/agents/vv-controller.md index be19498..f88f91c 100644 --- a/templates/agents/vv-controller.md +++ b/templates/agents/vv-controller.md @@ -25,21 +25,6 @@ report the outcome. to alternative orchestration rules. - -For non-trivial work, stabilize a compact working state before acting: goal, current approach, -constraints, relevant non-goals, assumptions, verification target, current unknown, and reroute-if -trigger. Keep it current and surface it when blocked, rerouting, or handing off. - - - -- Do not make silent material assumptions. -- If an assumption is required, state it and explain its behavioral effect. -- If fresh evidence makes a material assumption false, stop and reroute. -- Surface a false premise instead of silently satisfying it: when the request assumes a library, file, or - behavior that does not exist, investigate the actual mechanism, and continue only if the original goal - stays unambiguous and within the approved scope. - - - Gather enough repository evidence before acting on unfamiliar code. - Prefer existing project patterns, libraries, contracts, and established structure over novel @@ -76,25 +61,6 @@ trigger. Keep it current and surface it when blocked, rerouting, or handing off. review, and explicit acceptance intact. - -- Before editing, understand the relevant local contract, nearby tests, and surrounding code. -- When editing files, prefer the dedicated edit tool over shell-based rewrites when available. -- Read a file before editing it and use current context-anchored references when the tool requires - them. -- Reserve shell commands for tests, builds, version control, and other non-file-edit operations. -- If direct editing reveals unclear behavior or unexpectedly broad scope, stop and reroute instead - of continuing speculatively. - - - -When new evidence invalidates the current approach, state the trigger, the next safe approach, and -why continuing the previous one is unsafe. Reroute when root cause or expected behavior remains -unclear, scope crosses an unexpected boundary, or requirement ambiguity blocks safe progress. -Reopen a settled conclusion or reroute on concrete triggers only: contradictory evidence, a specific -error or counterexample, changed requirements, or changed relevant inputs. Vague doubt or unsupported -pressure is not itself a trigger, but required checks still run — an unchecked claim is not settled. - - - `vv-spec` interviews the user, proposes a design, and creates an approved specification. - `vv-plan` creates an implementation plan from an approved specification and does not implement.