Adds question: allow to the permission: frontmatter of core/openagent and core/opencoder, so the OpenCode runtime permits the built-in question tool for the two interactive primary agents.
Distinct from #269, which added 'question' to the compatibility layer's ToolAccessSchema (the tools: access layer used for Claude/Windsurf translation). This is the permission: layer read by the OpenCode runtime — the two are complementary.
Verified 'question' is a first-class key in OpenCode's PermissionConfig with "allow" a valid PermissionActionConfig.
find_project_root used [ -d "$dir/.git" ], which fails in a git worktree where .git is a file containing a gitdir: pointer rather than a directory. Switches to -e (a strict superset, so the normal-repo case is unaffected; submodules are fixed for free).
Also changes return 1 to return 0 in the fallback branch: PROJECT_ROOT="$(find_project_root)" takes the command substitution's exit status, so under set -e the script aborted after the fallback value had already been computed, producing silent no-output.
Mainly affects non-Node projects consuming OAC from a worktree; this repo's root package.json masks the bug.
update.sh's .md and .sh scan loops lacked the -not -path "*/node_modules/*" exclusion that the .ts loop already had, causing spurious update failures for third-party node_modules files that aren't OAC-managed. Brings all three loops in line.
Verified the exclusion filters nested node_modules at any depth, not just top-level, and no tracked files live under any node_modules/ path.
Fixes#308.
Registers the typescript.md, csharp.md, and csharp-project-structure.md context docs in registry.json. install.sh's expand_context_wildcard resolves context:core/* against registry entries rather than the filesystem, so unregistered docs could never install for the developer/full/advanced profiles.
Also fixes validate-registry.sh, which exits 1 and aborts silently on main: adds the missing skill: dependency mapping (parity with validate-registry.ts) and a return 0 guard on the trailing loop. Verified: 241 paths checked, 0 missing.
Fixes#322.
Evidence-based validation of the hardened workflows (no GitHub test state
created; no branch or worktree created or deleted). All six fork-safety
claims were independently re-derived and CONFIRMED:
- No live pull_request_target trigger (the only match is Task 02's warning
comment; validate-registry.yml parses to pull_request + workflow_dispatch).
- Fork-reachable surface is exactly 5 workflows, each with top-level
contents: read and no job-level override.
- Zero secret references in any fork-reachable workflow.
- Every secret-bearing workflow is unreachable from a fork (push /
workflow_dispatch, or issue_comment gated to OWNER/MEMBER).
- Internal validation: PR #334's failed Build & Validate blocked the PR
Checks Summary (exit 1); #336's 7 checks all executed and passed.
Gaps found and closed:
- Add persist-credentials: false to the 7 checkouts missing it
(installer-checks 6, validate-test-suites 1), so all 11 checkouts across
the fork-reachable surface now avoid persisting the token to .git/config.
- Remove validate-test-suites.yml's failure-path PR comment step. It called
issues.createComment, which needs issues: write. This was a regression
introduced by Task 05: the workflow previously had no permissions block
and inherited the repository's write default, so the step worked; adding
the correct contents: read broke it. Deleted rather than granting write to
a fork-reachable workflow — for fork PRs GitHub forces a read-only token,
so the step could never work there anyway. Failures stay visible via the
red check and the uploaded report.
Repository setting changed (approved, read-back verified, recorded in the
doc): default_workflow_permissions write -> read and
can_approve_pull_request_reviews true -> false, so future workflows without
an explicit permissions block default to read-only. No current workflow
relied on the write default.
* ci(security): run deterministic eval tests in affected-area CI (Task 04)
The build-check job validated build + suite structure but never ran the
tests, and its summary referenced a `test:ci` script that did not exist.
Make affected-area CI meaningful:
- Add `test:ci` to evals/framework running the offline, deterministic
Vitest allowlist (7 files / 112 tests) — no model, network, or paid
execution.
- Add a required "Run deterministic tests" step to build-check; a failure
fails the job and the existing PR summary gate (which keys on
build-check.result) fails closed.
- Correct the summary note to state test:ci runs the deterministic
allowlist and that model/network agent suites are excluded on PRs.
The broader deterministic suite has 3 pre-existing failing files
(framework-confidence, logger, test-runner; confirmed failing before this
work) which are intentionally out of the allowlist and tracked separately.
Validated locally: build, validate:suites:all, and test:ci all exit 0.
* ci(security): least privilege permissions + pin actions to SHAs (Task 05)
Harden all 9 GitHub Actions workflows:
Least privilege:
- Add explicit top-level `permissions: contents: read` to installer-checks,
validate-test-suites, and opencode (opencode's job keeps the writes it
needs; the top level now defaults to read).
- Every workflow now declares an explicit top-level permissions block.
- Write scopes retained only where justified (releases, doc/registry
commits, follow-up PRs, and sync-docs' issues.create).
Immutable action pinning:
- Pin every `uses:` to a full 40-char commit SHA with a version comment,
including first-party actions/* (checkout, github-script, setup-node,
upload-artifact) and third-party (oven-sh/setup-bun).
- Replace the two mutable refs that could change under us at any push:
ludeeus/action-shellcheck@master and sst/opencode/github@latest.
Record all SHAs, versions, and permission justifications in
docs/maintenance/repository-recovery/action-pin-inventory.md.
Verified: all 9 workflows parse as valid YAML; no floating tag/branch refs
remain; every workflow has a top-level permissions block.
* docs(security): add SECURITY.md and private-reporting checklist (Task 06)
- Add root SECURITY.md: supported versions (0.7.x), private reporting via
GitHub's "Report a vulnerability", best-effort response expectations,
coordinated disclosure, and no-secret guidance.
- Add private-vulnerability-reporting checklist that separates repository
file work (this PR) from GitHub settings changes that require their own
approval (Task 07: enabling private vulnerability reporting).
No external links to validate; the reporting path uses the repo Security
tab. SECURITY.md documents the private reporting path ahead of Task 07
enabling it.
* ci(security): add dependency governance and ownership controls (Task 08)
- .github/dependabot.yml: weekly grouped github-actions updates (keeps the
Task 05 SHA pins current). Scoped to actions only — the primary lockfile
is bun.lock and Dependabot's npm ecosystem would desync it; npm
dependency risk is covered by dependency-review below.
- .github/workflows/dependency-review.yml: runs on PRs with contents: read,
SHA-pinned actions, fail-on-severity: high to block newly introduced
high-severity vulnerabilities (exceptions documented inline).
- .github/CODEOWNERS: default owner @darrenhinde with explicit ownership of
security-sensitive paths (workflows, dependabot, CODEOWNERS, SECURITY.md,
scripts/validation).
Verified: dependabot.yml and dependency-review.yml are valid YAML;
dependency-review actions are SHA-pinned with contents: read; CODEOWNERS
owner is the repository owner.
* docs(security): record GitHub security settings evidence (Task 07)
Enable private vulnerability reporting and record read-back evidence.
Settings changed (each approved immediately before, verified by read-back):
- Private vulnerability reporting: enabled=false -> enabled=true. The
Security tab now offers "Report a vulnerability", making the path
documented in SECURITY.md live.
- Dependency Graph / Dependabot alerts: 404 -> 204. This was an
undocumented prerequisite of Task 08's dependency-review.yml, which
failed with "Dependency graph is not enabled"; the Dependency Review
check on PR #336 went fail -> pass after enabling it.
No other repository setting was modified; secret scanning and push
protection are unchanged, and dependabot_security_updates remains disabled
(out of scope, would need its own approval). Both changes are reversible
via the corresponding DELETE calls.
Marks Part B of the private-vulnerability-reporting checklist complete.
* fix(evals): repair six eval-framework behavioral regressions
Restore the deterministic eval baseline by fixing false-negatives and
identity/discovery bugs across the framework:
- error-handling: correct severity-boundary fixtures so mixed-severity
cases actually cross the >1000 warning threshold (deterministic
error/warning/info), plus explicit 1000-vs-1001 boundary tests.
- context-loading-evaluator: emit `no-context-loaded` and
`context-loaded-after-execution` as errors so missing/late context
fails (was a passing warning); update focused test accordingly.
- tool-usage-evaluator: enforce dedicated tools — bash `cat`/`ls`/`ls -la`
now fail as `bash-antipattern-*` errors (ls de-allowlisted); npm/git/
piped commands still pass.
- test-case-loader: canonicalize legacy agent ids via normalizeAgentId
(`openagent` -> `core/openagent`), preserving canonical/unknown ids.
- suite-validator: accept category-based agent ids, resolve test paths
under the canonical dir, add requested-vs-declared conflict detection;
new suite-validator.test.ts.
- validate-suites-cli: recursive suite discovery (nested <cat>/<agent>/
config), deterministic order, fail-closed on zero suites; new
validate-suites-cli.test.ts.
Deterministic Vitest allowlist green; validate:suites:all non-vacuous
and exits 0. No model/network/eval:sdk execution.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(evals): clear pre-existing TypeScript build errors (tsc 39 -> 0)
`npm run build` (tsc) failed on 39 pre-existing errors in files outside
the behavioral-repair scope, blocking the baseline gate. Root causes:
- glob: drop obsolete @types/glob ^8 so glob v13's own types (globSync)
resolve (fixes run-sdk-tests.ts).
- task-type-detector: introduce a local DetectedTaskType union for this
(dead/unused) detector; shared TaskType union left unchanged.
- behavior-evaluator: the expectedResponse check filtered a nonexistent
`message` event type and was silently dead — route through
base-evaluator.getAssistantMessages (assistant_message/text). Adds
three deterministic tests exercising the now-live check.
- integration tests: remove unused `expectedOutcome` fixture metadata
(not on TestCase, never asserted) and add the required `category`
field the excess-property error had masked.
tsc now exits 0. Vitest allowlist 112/112. Lint remains unconfigured in
evals/framework (no ESLint config has ever existed) and is deferred to a
separate follow-up; it is not part of this change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(evals): sync bun.lock after @types/glob removal
The previous commit removed @types/glob via npm, updating package-lock.json
but leaving the primary bun.lock stale, which broke CI's
`bun install --frozen-lockfile`. Regenerate bun.lock so both lockfiles
agree (drops @types/glob and its transitive @types/minimatch only).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci(evals): add evals/framework/package-lock.json for build-check
The pr-checks `build-check` job caches on and runs `npm ci` in
evals/framework, but that workspace had no local lockfile, so the job
failed at Setup Node.js ("Some specified paths were not resolved") and
would fail `npm ci`. Add a standalone, in-sync package-lock.json
(lockfileVersion 3, no @types/glob) so the job's cache path resolves and
`npm ci` succeeds. Validated locally with `npm ci --dry-run`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The 'question' tool is a built-in OpenCode tool used to ask users
to make decisions, but it was missing from the ToolAccessSchema in
types.ts and the isValidOACTool() function in ToolMapper.ts.
This prevented OpenCoder/OpenAgent agents from accessing the tool
even when explicitly configured.
Changes:
- Add question: z.boolean().optional() to ToolAccessSchema
- Add 'question' to validTools array in isValidOACTool()
Fixes#268
Co-authored-by: BillionClaw <267901332+BillionClaw@users.noreply.github.com>
- Add MiniMax prompt variant (minimax.md) for M2.7 and M2.7-highspeed models
- Register MiniMax model behaviors in eval framework (response times, completion patterns)
- Add MINIMAX_API_KEY environment variable to env.example
- Update prompt variants README with MiniMax capabilities matrix entry
- Update main README to include MiniMax in model-agnostic provider list
- Add 35 tests (unit + integration) for model behaviors, prompt variant, and config
Co-authored-by: PR Bot <pr-bot@minimaxi.com>
Co-authored-by: Darren Hinde <107584450+darrenhinde@users.noreply.github.com>
* 📝 docs: add C# and ASP.NET Core context files for agent guidance
* 📝 docs: add C# / .NET to supported languages across docs
* docs: bump C# project structure to v1.4.0 with project initialization section
* feat(cli): migrate packages/cli to Bun-first with full test suite
- Replace fs-extra with Bun.file/Bun.write/node:fs/promises across all 9 source files
- Fix --help fast-path so all 8 subcommands are visible
- Replace tsup/tsx/vitest with bun build/bun run/bun:test
- Replace __dirname with import.meta.dir; use JSON import assertion for version
- Fix hardcoded OAC_VERSION in add.ts; add hashesMatch import to status.ts
- Replace computeFileHash with Bun.file().bytes() in sha256.ts
- Rename checkNodeVersion → checkBunVersion; parallelise doctor checks
- Fix TypeScript void-inference errors in update.ts, list.ts, status.ts
by replacing .catch() with let/try-catch where result is used downstream
- Add ManifestError named error class; remove unsafe type casts
- Add 43 bun:test unit tests (sha256, manifest, installer, version) — 0 failures
* fix(cli): resolve critical bugs and standards violations found in review
Critical bug fixes:
- ide-detect.ts: replace Bun.file(dir).exists() with stat().isDirectory()
for all directory checks — Bun.file().exists() always returns false for
directories, breaking Cursor/Windsurf/OpenCode/Claude detection entirely
- bundled.ts: add registry.json exclusion anchor to findPackageRoot() to
prevent monorepo root from matching before the CLI package root
Standards cleanup (§4.1, §5.1, §6.1, §15.3, §21.1):
- status.ts: parallelise findModifiedFiles + detectIdes with Promise.all
- apply.ts: fix duplicate warn/limit messages; remove else after return in
reportWarnings; remove redundant mkdir before Bun.write
- version.ts: remove unnecessary (pkgJson as {version?:string}) cast
- manifest.ts: remove redundant mkdir before Bun.write; remove as unknown cast
- installer.ts: remove redundant mkdir calls before Bun.write throughout
- add.ts: add comment explaining why node:fs/promises rm is used
Tests (43 → 142, +99 new tests across 4 new files):
- ide-detect.test.ts: 26 tests covering all 4 IDEs, both claude indicators,
detectIdes parallel, isIdePresent — directly validates the directory fix
- bundled.test.ts: 27 tests for classifyBundledFile, findPackageRoot,
listBundledFiles, getBundledFilePath, bundledFileExists
- config.test.ts: 25 tests for readConfig/writeConfig round-trips,
createDefaultConfig, mergeConfig, isYoloMode, isAutoBackup
- installer-update.test.ts: 14 tests covering all 5 updateFiles decision
branches (install/update/skip/yolo/dry-run) plus isProjectRoot
- sha256.test.ts: +4 tests for empty file, large file, binary content
* fix(cli): fix P0 bugs — global flags, .git detection, package root resolution
- Remove duplicate --dry-run/--yolo/--verbose from parent program; Commander.js
global option stealing caused all safety flags to be silently dropped in every
subcommand action callback
- Fix isProjectRoot() to use stat() for .git detection; Bun.file().exists()
returns false for directories, breaking oac init in standard git repos
- Add OAC_PACKAGE_ROOT env var override to getPackageRoot() for dev/monorepo mode;
registry.json heuristic excluded the repo root causing oac init/add/update to
throw when run from source
- Fix build script: remove --banner flag that caused double shebang in dist/index.js
- Rewrite bin/oac.js to invoke bun instead of node (dist is bun-only target)
- Refactor installer.ts let accumulators to const using Promise.all + reduce
- Add MVP planning docs (00-MVP-PLAN.md, master synthesis, project breakdown)
* fix(install.sh): handle both singular and plural component type formats
The get_registry_key() function was always adding 's' to the type,
causing 'contexts' to become 'contextss' which doesn't exist in registry.json.
Now handles:
- Singular forms: context → contexts, agent → agents, skill → skills
- Plural forms: contexts → contexts (unchanged), agents → agents
- Config stays singular
- Fallback for any type ending in 's'
Fixes#257
* feat(plugin): add settings.json with opusplan model for Claude Code plugin
Adds plugins/claude-code/settings.json with { "model": "opusplan" } so
the OAC plugin automatically uses Opus for planning/orchestration and
Sonnet for subagent execution — matching OAC's plan-first workflow.
Plugin-scoped settings.json takes priority over global/user settings
when the plugin is loaded (marketplace install or --plugin-dir).
Subagents that need a lighter model continue to override at the agent
level (external-scout → haiku, task-manager/test-engineer/coder-agent → sonnet).
Closes#35
* chore(plugin): bump version to 1.0.2 for marketplace pickup
* fix: correct task-delegation reference in session-context-pattern
- Changed outdated reference from task-delegation.md to task-delegation-basics.md
- The file task-delegation-basics.md exists, task-delegation.md does not
- This caused 'file not found' errors during installation via install.sh
* feat: add install-fork.sh for fork-based installation
- Creates install-fork.sh that installs from digi4care/OpenAgentsControl fork
- Allows users to install the forked version with fixes before upstream merge
- Usage: bash install-fork.sh or curl directly from fork repo
* docs: add root README.md and CONTRIBUTING.md for GitHub best practices
- Add README.md in repository root (GitHub requirement)
- Add CONTRIBUTING.md in repository root with contribution guidelines
- Both files redirect to detailed documentation in docs/ directory
- Fixes installer 404 error for readme config item
- Follows GitHub community standards for repository structure
* chore: remove fork-specific files per maintainer request
---------
Co-authored-by: Chris Engelhard <chris@chrisengelhard.nl>
* fix(install): resolve non-.md context paths like paths.json (closes#251)
resolve_component_path() was appending .md to all slash-containing context
IDs, so context:core/config/paths.json was looked up as paths.json.md and
returned empty, triggering the 'Could not find path' warning on install.
Now tries the .md path first (preserving existing behaviour for all markdown
context files), then falls back to the bare path for non-markdown files.
* fix(shellcheck): use read -ra for word-split array assignment (SC2206)
Replace local arr=($var) with read -ra arr <<< "$var" in
install-context.sh to satisfy ShellCheck SC2206 and unblock CI.
* fix(shellcheck): declare and assign separately in router.sh (SC2155)
* feat(plugin): enhance context management and skill invocation
- Update .context-manifest.json to include profile and detailed source information.
- Revise context-scout.md to clarify context root discovery and navigation.
- Modify commands to replace deprecated skills with updated ones (brainstorming → approach, systematic-debugging → debugger).
- Streamline install-context.md for clarity and remove interactive profile selection.
- Improve oac-status.md to provide a more comprehensive status report.
- Add OAC system paths to session-start.sh for better context management.
- Remove obsolete skills and improve documentation for existing commands.
* fix(plugin): fix hook JSON escaping and unconditional session firing
- Fix double-escaped skill catalogue: use $'\n' real newlines instead of
literal \n strings so escape_for_json encodes them correctly as \n in JSON
- Fix OAC_SYSTEM_PATHS embedded raw into JSON string: build with real newlines
and pass through escape_for_json before interpolation
- Remove SessionStart matcher so hook fires on every session start
unconditionally (startup, resume, clear, compact and any future types)
- Remove redundant async:false field; add explicit timeout:30
* fix(plugin): add Windows hook wrapper, fix manifest check, remove bundled context
- Add run-hook.cmd polyglot wrapper for Windows compatibility — routes
session-start through bash on Windows (Git Bash, MSYS2, Cygwin) and
falls back silently if no bash found so plugin still loads
- Fix warning manifest check to look in correct locations: project-local
.claude/.context-manifest.json and global ~/.claude/.context-manifest.json
instead of the plugin root (which is never writable for marketplace users)
- Update warning message skill name: install-context -> context-setup
- Restore SessionStart matcher (startup|resume|clear|compact) for explicit
session type filtering
- Remove bundled scripts/context/ tree (250+ files) — context is downloaded
at runtime via /install-context, not shipped with the plugin
* fix(plugin): invoke hook via bash to avoid +x permission requirement
Plugin files installed from marketplace are copied with 644 permissions
(no execute bit). Invoking session-start.sh directly requires +x, which
fails silently. Using 'bash "${CLAUDE_PLUGIN_ROOT}/hooks/session-start.sh"'
bypasses the execute bit entirely — bash reads the file, not executes it.
- hooks.json: replace run-hook.cmd indirection with direct bash invocation
- hooks.json: add explicit timeout:30, remove async:false (default)
- Remove run-hook.cmd and extensionless session-start (no longer needed)
- Ensure session-start.sh tracked as 100644 (read-only) in git
- plugin.json: bump version 1.0.0 -> 1.0.1 so marketplace picks up changes
- plugin.json: update description to OpenAgentsControl branding
* fix(shellcheck): declare and assign separately in router.sh (SC2155)
* feat(plugin): enhance context management and skill invocation
- Update .context-manifest.json to include profile and detailed source information.
- Revise context-scout.md to clarify context root discovery and navigation.
- Modify commands to replace deprecated skills with updated ones (brainstorming → approach, systematic-debugging → debugger).
- Streamline install-context.md for clarity and remove interactive profile selection.
- Improve oac-status.md to provide a more comprehensive status report.
- Add OAC system paths to session-start.sh for better context management.
- Remove obsolete skills and improve documentation for existing commands.
* fix(plugin): fix hook JSON escaping and unconditional session firing
- Fix double-escaped skill catalogue: use $'\n' real newlines instead of
literal \n strings so escape_for_json encodes them correctly as \n in JSON
- Fix OAC_SYSTEM_PATHS embedded raw into JSON string: build with real newlines
and pass through escape_for_json before interpolation
- Remove SessionStart matcher so hook fires on every session start
unconditionally (startup, resume, clear, compact and any future types)
- Remove redundant async:false field; add explicit timeout:30
* fix(plugin): add Windows hook wrapper, fix manifest check, remove bundled context
- Add run-hook.cmd polyglot wrapper for Windows compatibility — routes
session-start through bash on Windows (Git Bash, MSYS2, Cygwin) and
falls back silently if no bash found so plugin still loads
- Fix warning manifest check to look in correct locations: project-local
.claude/.context-manifest.json and global ~/.claude/.context-manifest.json
instead of the plugin root (which is never writable for marketplace users)
- Update warning message skill name: install-context -> context-setup
- Restore SessionStart matcher (startup|resume|clear|compact) for explicit
session type filtering
- Remove bundled scripts/context/ tree (250+ files) — context is downloaded
at runtime via /install-context, not shipped with the plugin
* fix(shellcheck): declare and assign separately in router.sh (SC2155)
* feat(plugin): enhance context management and skill invocation
- Update .context-manifest.json to include profile and detailed source information.
- Revise context-scout.md to clarify context root discovery and navigation.
- Modify commands to replace deprecated skills with updated ones (brainstorming → approach, systematic-debugging → debugger).
- Streamline install-context.md for clarity and remove interactive profile selection.
- Improve oac-status.md to provide a more comprehensive status report.
- Add OAC system paths to session-start.sh for better context management.
- Remove obsolete skills and improve documentation for existing commands.
* fix(plugin): fix hook JSON escaping and unconditional session firing
- Fix double-escaped skill catalogue: use $'\n' real newlines instead of
literal \n strings so escape_for_json encodes them correctly as \n in JSON
- Fix OAC_SYSTEM_PATHS embedded raw into JSON string: build with real newlines
and pass through escape_for_json before interpolation
- Remove SessionStart matcher so hook fires on every session start
unconditionally (startup, resume, clear, compact and any future types)
- Remove redundant async:false field; add explicit timeout:30
* fix(shellcheck): declare and assign separately in router.sh (SC2155)
* feat(plugin): enhance context management and skill invocation
- Update .context-manifest.json to include profile and detailed source information.
- Revise context-scout.md to clarify context root discovery and navigation.
- Modify commands to replace deprecated skills with updated ones (brainstorming → approach, systematic-debugging → debugger).
- Streamline install-context.md for clarity and remove interactive profile selection.
- Improve oac-status.md to provide a more comprehensive status report.
- Add OAC system paths to session-start.sh for better context management.
- Remove obsolete skills and improve documentation for existing commands.
Resolves#224 — update.sh now mirrors install.sh path resolution:
- Auto-detects local (.opencode/) then global (~/.config/opencode) installs
- Adds --install-dir PATH flag and OPENCODE_BRANCH/OPENCODE_INSTALL_DIR env vars
- Adds trap for .backup cleanup on SIGINT/SIGTERM
- Fixes set -e + arithmetic counter bug (uses $((n+1)) form)
- Adds path traversal guard and write-permission check
- Adds RED color variable; fixes print_error hardcoded escape code
- Renames 'skipped' counter to 'failed' for accuracy
- README: adds one-liner Keep Updated section in Quick Start
- Add shellcheck disable directive for SC2034 (unused variable)
- YELLOW color code is reserved for future warning messages
- Fixes CI failure in installer-checks workflow when install.sh is modified
- Resolves blocking issue for PR #198
* fix: ContextScout falls back to global core/ when local core/ missing
Users who install OAC globally have core standards at
~/.config/opencode/context/core/ but no local core/ directory.
ContextScout now does a one-time check on startup: if local
core/navigation.md doesn't exist, it checks the global path
from paths.json. This resolves the ENOENT errors when agents
try to read core/standards/ files that only exist globally.
- paths.json: enabled global path (~/.config/opencode/context)
- contextscout.md: added global_fallback rule with 2-glob cap
- Fallback is ONLY for core/ files, never project-intelligence
* docs: add context resolution explanation to README
Explains how ContextScout resolves context files: local-first,
global fallback only for core/ files, project-intelligence always
local. Includes flow diagram, key rules, and common setup table.
- /add-context now always saves to local .opencode/context/project-intelligence/
with --global flag as opt-in for ~/.config/opencode/ (fixes#175)
- Added Stage 0.5 path resolution, full file preview before writes,
Replace All backup preview, and navigation.md preview (fixes#177)
- Rewrote context-paths.md with resolution order, merging rules, scenarios
- Added /context migrate operation for global-to-local migration
- Added preview/approval gates to creation, harvest, and extract operations
- Updated README, CONTEXT_SYSTEM_GUIDE, platform-compatibility docs
- All stale ~/.opencode/ and project-context.md references removed
Fixed installation error: 'Failed to install context: react-patterns'
Problem:
- Two identical react-patterns.md files existed in different locations
- Registry had duplicate entries with same ID but different paths
- Installation failed due to conflicting entries
Solution:
- Removed duplicate file from development/frontend/react/
- Kept file in ui/web/ (correct location alongside other UI patterns)
- Removed duplicate registry entry
- Now only one react-patterns entry exists
Result:
- ✅ react-patterns installs correctly
- ✅ Registry validation passes
- ✅ No duplicate IDs in registry
* chore: bump version to v0.8.0
* chore: update version to 0.7.1 instead of 0.8.0
* docs: expand comparison table with Oh My OpenCode and additional features
* backup: development context before reorganization
* refactor(context): reorganize development folder
- Remove 7 duplicate files (ui/design files exist in ui/web/)
- Remove 2 redundant READMEs (use navigation.md instead)
- Move react-patterns.md to frontend/react/
- Create frontend/react/navigation.md
- Update 4 navigation files (development, ui, frontend, frontend/react)
- Update developer profile (4 path changes: ui-styling-standards, design-systems, design-assets, animation-patterns)
- Update 3 core context files (visual-development.md, design-iteration.md, file-locations.md)
Result: 29 context files (down from 36), no duplicates, clean structure
Refs: REORGANIZATION_PLAN.md, REORGANIZATION_SUMMARY.md
* docs(context): add frontend delegation guide
- Create when-to-delegate.md with clear decision criteria
- Decision matrix for when to delegate vs. handle directly
- Common patterns and examples
- Red flags and green flags
- Frontend-specialist capabilities reference
- Update frontend and development navigation files
Helps orchestrators decide when to delegate UI work to frontend-specialist subagent.
* feat: enhance developer and advanced profiles with UI, development, and system builder context
- Developer profile: Add UI/UX patterns, development principles, design systems, React patterns, animation patterns, styling standards, and design assets
- Full profile: Add same UI/development context as developer profile for consistency
- Advanced profile: Add comprehensive system builder context including templates, guides, context system standards, and repository management context
- Update profile descriptions to reflect new capabilities
- All context files verified to exist and are properly referenced
* fix: remove duplicate context entries with incorrect paths
- Remove duplicate design-assets, ui-styling-standards, clean-code, animation-patterns, design-systems, react-patterns, and api-design entries that pointed to wrong paths
- Remove non-existent development-readme and mastra-ai-readme entries
- Keep only correct entries with proper file paths
- All registry paths now validated and correct
* feat: add add-context command to registry and all profiles
- Register add-context command in registry.json
- Add command:add-context to all 5 profiles (essential, developer, business, full, advanced)
- Update add-context.md to mention external-context files in .tmp/ directory
- Fix command dependencies to use context IDs instead of full paths
- All registry paths and dependencies validated
* feat: enhance add-context with external context file management
- Add Stage 0: Detect external context files in .tmp/
- Offer options to extract, manage, or harvest external files
- Extract patterns from external context files for use in project intelligence
- Provide management options: update, remove, clean, or harvest
- Add examples showing external context extraction and management
- Update troubleshooting with external context file handling
- Integrate with /context harvest command for permanent context organization
* fix: comprehensive context system audit and restructuring
- Fix 6 command documentation inconsistencies in add-context.md
* Correct /add-context vs /context harvest command references
* Simplify Stage 0 workflow from 4 to 2 options
* Update examples to match actual behavior
* Remove non-existent operations from delegation section
* Fix troubleshooting Q&A section
- Restructure registry.json with 4 major improvements
* Replace 31 duplicate 'navigation' IDs with unique IDs per subfolder
- core-navigation, development-navigation, openagents-repo-navigation, etc.
* Add context:openagents-repo/* to developer and full profiles
- Developers now have repo-specific guides and examples
* Remove context:to-be-consumed/* from essential, developer, business, full
- Keep only in advanced profile for system builders
* Properly scope mastra-ai context via wildcard patterns
Validation Results:
- Registry: 220/220 paths valid, 0 missing dependencies
- Profiles: All appropriately scoped with no duplicate IDs
- Standards: MVI compliance, frontmatter, structure verified
- No regressions: All tests passing
Fixes issues with context organization, command consistency, and profile coverage.
* feat: add premium dark UI design system context
- Add comprehensive quick start guide for premium dark UI
- Add visual reference guide with ASCII diagrams
- Includes color palette, components, layouts, and best practices
- Provides glassmorphism and radial glow patterns
- Complete with accessibility guidelines and responsive design
- Ready-to-use code snippets and templates
* docs: update design navigation with premium dark UI guides
* fix: Clean up agent YAML frontmatter and add standards
Fixed YAML frontmatter issues in 18 agent files:
- Removed duplicate YAML keys (e.g., read: true followed by read: {})
- Removed orphaned list items without parent keys
- Fixed field names (permission: → permissions:)
- Removed extra --- delimiter blocks in content
- Cleaned up comments and invalid OpenCode fields
Changes:
- 14 subagent files fixed (core, code, development, system-builder)
- 4 primary/meta agent files fixed (openagent, opencoder, repo-manager, eval-runner)
- Net reduction: 439 lines removed, 116 lines added (cleaner YAML)
Added agent standards documentation:
- .opencode/context/openagents-repo/standards/agent-frontmatter.md
- .opencode/context/openagents-repo/standards/subagent-structure.md
- .opencode/context/openagents-repo/standards/navigation.md
- Updated main navigation.md with standards section
All files follow MVI principles (<200 lines) and document the 5 common
YAML mistakes that were fixed.
Fixes subagent recognition issues where agents were registered as 'all'
mode instead of 'subagent' mode due to malformed YAML.
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* chore: bump version to v0.8.0
* chore: update version to 0.7.1 instead of 0.8.0
* docs: expand comparison table with Oh My OpenCode and additional features
* backup: development context before reorganization
* refactor(context): reorganize development folder
- Remove 7 duplicate files (ui/design files exist in ui/web/)
- Remove 2 redundant READMEs (use navigation.md instead)
- Move react-patterns.md to frontend/react/
- Create frontend/react/navigation.md
- Update 4 navigation files (development, ui, frontend, frontend/react)
- Update developer profile (4 path changes: ui-styling-standards, design-systems, design-assets, animation-patterns)
- Update 3 core context files (visual-development.md, design-iteration.md, file-locations.md)
Result: 29 context files (down from 36), no duplicates, clean structure
Refs: REORGANIZATION_PLAN.md, REORGANIZATION_SUMMARY.md
* docs(context): add frontend delegation guide
- Create when-to-delegate.md with clear decision criteria
- Decision matrix for when to delegate vs. handle directly
- Common patterns and examples
- Red flags and green flags
- Frontend-specialist capabilities reference
- Update frontend and development navigation files
Helps orchestrators decide when to delegate UI work to frontend-specialist subagent.
* feat: enhance developer and advanced profiles with UI, development, and system builder context
- Developer profile: Add UI/UX patterns, development principles, design systems, React patterns, animation patterns, styling standards, and design assets
- Full profile: Add same UI/development context as developer profile for consistency
- Advanced profile: Add comprehensive system builder context including templates, guides, context system standards, and repository management context
- Update profile descriptions to reflect new capabilities
- All context files verified to exist and are properly referenced
* fix: remove duplicate context entries with incorrect paths
- Remove duplicate design-assets, ui-styling-standards, clean-code, animation-patterns, design-systems, react-patterns, and api-design entries that pointed to wrong paths
- Remove non-existent development-readme and mastra-ai-readme entries
- Keep only correct entries with proper file paths
- All registry paths now validated and correct
* feat: add add-context command to registry and all profiles
- Register add-context command in registry.json
- Add command:add-context to all 5 profiles (essential, developer, business, full, advanced)
- Update add-context.md to mention external-context files in .tmp/ directory
- Fix command dependencies to use context IDs instead of full paths
- All registry paths and dependencies validated
* feat: enhance add-context with external context file management
- Add Stage 0: Detect external context files in .tmp/
- Offer options to extract, manage, or harvest external files
- Extract patterns from external context files for use in project intelligence
- Provide management options: update, remove, clean, or harvest
- Add examples showing external context extraction and management
- Update troubleshooting with external context file handling
- Integrate with /context harvest command for permanent context organization
* fix: comprehensive context system audit and restructuring
- Fix 6 command documentation inconsistencies in add-context.md
* Correct /add-context vs /context harvest command references
* Simplify Stage 0 workflow from 4 to 2 options
* Update examples to match actual behavior
* Remove non-existent operations from delegation section
* Fix troubleshooting Q&A section
- Restructure registry.json with 4 major improvements
* Replace 31 duplicate 'navigation' IDs with unique IDs per subfolder
- core-navigation, development-navigation, openagents-repo-navigation, etc.
* Add context:openagents-repo/* to developer and full profiles
- Developers now have repo-specific guides and examples
* Remove context:to-be-consumed/* from essential, developer, business, full
- Keep only in advanced profile for system builders
* Properly scope mastra-ai context via wildcard patterns
Validation Results:
- Registry: 220/220 paths valid, 0 missing dependencies
- Profiles: All appropriately scoped with no duplicate IDs
- Standards: MVI compliance, frontmatter, structure verified
- No regressions: All tests passing
Fixes issues with context organization, command consistency, and profile coverage.
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* chore: bump version to v0.8.0
* chore: update version to 0.7.1 instead of 0.8.0
* docs: expand comparison table with Oh My OpenCode and additional features
* backup: development context before reorganization
* refactor(context): reorganize development folder
- Remove 7 duplicate files (ui/design files exist in ui/web/)
- Remove 2 redundant READMEs (use navigation.md instead)
- Move react-patterns.md to frontend/react/
- Create frontend/react/navigation.md
- Update 4 navigation files (development, ui, frontend, frontend/react)
- Update developer profile (4 path changes: ui-styling-standards, design-systems, design-assets, animation-patterns)
- Update 3 core context files (visual-development.md, design-iteration.md, file-locations.md)
Result: 29 context files (down from 36), no duplicates, clean structure
Refs: REORGANIZATION_PLAN.md, REORGANIZATION_SUMMARY.md
* docs(context): add frontend delegation guide
- Create when-to-delegate.md with clear decision criteria
- Decision matrix for when to delegate vs. handle directly
- Common patterns and examples
- Red flags and green flags
- Frontend-specialist capabilities reference
- Update frontend and development navigation files
Helps orchestrators decide when to delegate UI work to frontend-specialist subagent.
* feat: enhance developer and advanced profiles with UI, development, and system builder context
- Developer profile: Add UI/UX patterns, development principles, design systems, React patterns, animation patterns, styling standards, and design assets
- Full profile: Add same UI/development context as developer profile for consistency
- Advanced profile: Add comprehensive system builder context including templates, guides, context system standards, and repository management context
- Update profile descriptions to reflect new capabilities
- All context files verified to exist and are properly referenced
* fix: remove duplicate context entries with incorrect paths
- Remove duplicate design-assets, ui-styling-standards, clean-code, animation-patterns, design-systems, react-patterns, and api-design entries that pointed to wrong paths
- Remove non-existent development-readme and mastra-ai-readme entries
- Keep only correct entries with proper file paths
- All registry paths now validated and correct
* feat: add add-context command to registry and all profiles
- Register add-context command in registry.json
- Add command:add-context to all 5 profiles (essential, developer, business, full, advanced)
- Update add-context.md to mention external-context files in .tmp/ directory
- Fix command dependencies to use context IDs instead of full paths
- All registry paths and dependencies validated
* feat: enhance add-context with external context file management
- Add Stage 0: Detect external context files in .tmp/
- Offer options to extract, manage, or harvest external files
- Extract patterns from external context files for use in project intelligence
- Provide management options: update, remove, clean, or harvest
- Add examples showing external context extraction and management
- Update troubleshooting with external context file handling
- Integrate with /context harvest command for permanent context organization
* fix: comprehensive context system audit and restructuring
- Fix 6 command documentation inconsistencies in add-context.md
* Correct /add-context vs /context harvest command references
* Simplify Stage 0 workflow from 4 to 2 options
* Update examples to match actual behavior
* Remove non-existent operations from delegation section
* Fix troubleshooting Q&A section
- Restructure registry.json with 4 major improvements
* Replace 31 duplicate 'navigation' IDs with unique IDs per subfolder
- core-navigation, development-navigation, openagents-repo-navigation, etc.
* Add context:openagents-repo/* to developer and full profiles
- Developers now have repo-specific guides and examples
* Remove context:to-be-consumed/* from essential, developer, business, full
- Keep only in advanced profile for system builders
* Properly scope mastra-ai context via wildcard patterns
Validation Results:
- Registry: 220/220 paths valid, 0 missing dependencies
- Profiles: All appropriately scoped with no duplicate IDs
- Standards: MVI compliance, frontmatter, structure verified
- No regressions: All tests passing
Fixes issues with context organization, command consistency, and profile coverage.
* feat: make agents OpenCode-compliant with centralized metadata system
- Remove invalid OpenCode fields from agent frontmatter (id, category, type, version, author, tags, dependencies, context, permissions)
- Keep only valid OpenCode fields (name, description, mode, temperature, tools, permission)
- Create centralized metadata file (.opencode/config/agent-metadata.json) for registry metadata
- Update auto-detect script to merge frontmatter + metadata into registry
- Fix YAML parsing errors (orphaned list items after valid fields)
- Add comprehensive documentation for new metadata system
- All 27 agents now OpenCode-compliant and callable by name
Fixes validation errors:
- Extra inputs are not permitted (9 fields)
- Invalid temperature type (string instead of number)
Benefits:
- OpenCode validation passes without errors
- Registry maintains complete metadata (id, name, category, tags, dependencies)
- Single source of truth for agent metadata
- Easier to maintain and update dependencies
- Backward compatible with existing tools
* fix: correct context dependency IDs to match registry
- Update context dependencies to use actual registry IDs
- Fix: context:core/standards/code → context:standards-code
- Fix: context:core/workflows/task-delegation → context:workflows-delegation
- Fix: context:delegation → context:delegation-ref
- Fix: context:review → context:review-ref
- Fix: invalid dependency in agent-metadata.md documentation
- All registry validation now passes
* chore: add navigation files and update workflow context
- Add navigation.md files for all context directories
- Update design-iteration.md and task-delegation.md workflows
- Clean up backup files from metadata fixes
* fix: install dependencies in validate-registry workflow
The validation script requires the 'glob' package which is in devDependencies.
CI was failing because dependencies were never installed before running validation.
* fix: show validation errors in CI logs
Use tee to display validation output in logs while also saving to file.
This makes debugging CI failures much easier.
* fix: remove duplicate pull_request trigger
The workflow was running twice (pull_request + pull_request_target) causing
duplicate checks. Keep only pull_request_target to support bot PRs and allow
writing to PR branches.
* chore: trigger CI re-run with fixed workflow
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
The validation script requires the 'glob' package from devDependencies.
Also improve error visibility by using tee to show output in logs.
Fixes CI failures where validation script fails with module not found error.
* chore: bump version to v0.8.0
* chore: update version to 0.7.1 instead of 0.8.0
* docs: expand comparison table with Oh My OpenCode and additional features
* backup: development context before reorganization
* refactor(context): reorganize development folder
- Remove 7 duplicate files (ui/design files exist in ui/web/)
- Remove 2 redundant READMEs (use navigation.md instead)
- Move react-patterns.md to frontend/react/
- Create frontend/react/navigation.md
- Update 4 navigation files (development, ui, frontend, frontend/react)
- Update developer profile (4 path changes: ui-styling-standards, design-systems, design-assets, animation-patterns)
- Update 3 core context files (visual-development.md, design-iteration.md, file-locations.md)
Result: 29 context files (down from 36), no duplicates, clean structure
Refs: REORGANIZATION_PLAN.md, REORGANIZATION_SUMMARY.md
* docs(context): add frontend delegation guide
- Create when-to-delegate.md with clear decision criteria
- Decision matrix for when to delegate vs. handle directly
- Common patterns and examples
- Red flags and green flags
- Frontend-specialist capabilities reference
- Update frontend and development navigation files
Helps orchestrators decide when to delegate UI work to frontend-specialist subagent.
* feat: enhance developer and advanced profiles with UI, development, and system builder context
- Developer profile: Add UI/UX patterns, development principles, design systems, React patterns, animation patterns, styling standards, and design assets
- Full profile: Add same UI/development context as developer profile for consistency
- Advanced profile: Add comprehensive system builder context including templates, guides, context system standards, and repository management context
- Update profile descriptions to reflect new capabilities
- All context files verified to exist and are properly referenced
* fix: remove duplicate context entries with incorrect paths
- Remove duplicate design-assets, ui-styling-standards, clean-code, animation-patterns, design-systems, react-patterns, and api-design entries that pointed to wrong paths
- Remove non-existent development-readme and mastra-ai-readme entries
- Keep only correct entries with proper file paths
- All registry paths now validated and correct
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* chore: bump version to v0.8.0
* chore: update version to 0.7.1 instead of 0.8.0
* docs: expand comparison table with Oh My OpenCode and additional features
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* chore: bump version to v0.8.0
* chore: update version to 0.7.1 instead of 0.8.0
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: darrenhinde <107584450+darrenhinde@users.noreply.github.com>
* feat: add npm package support for @openagents/control
- Convert package to publishable npm package with scoped name @openagents/control
- Add CLI entry point bin/oac.js for global installation
- Create .npmignore to exclude dev files and node_modules
- Configure package.json with proper files, bin, and metadata
- Add comprehensive NPM_PUBLISHING_GUIDE.md with publishing instructions
- Package size: 610KB (2.4MB unpacked) with 353 files
- Includes .opencode/tool/ directory without node_modules
- CLI command: oac (e.g., 'oac developer' or 'oac --help')
Users can install with: npm install -g @openagents/control
* chore: remove telegram bot files from package
- Delete .opencode/_lib/telegram-bot.ts (unused)
- Delete .opencode/plugin/telegram-notify.ts (depends on deleted file)
- Remove _lib directory reference from package.json files field
- Reduces package size from 610KB to 607KB
- Total files: 351 (down from 353)
* chore: remove all telegram references from registry and docs
- Remove telegram-bot and telegram-notify plugin entries from registry.json
- Remove telegram plugin references from all profiles (developer, business, full, advanced)
- Update profile-validation.md to remove telegram from business profile documentation
- Clean package with no telegram dependencies
* docs: enhance README clarity and add configuration examples
- Add Core Philosophy section with 4 key principles
- Add Quick Concepts for First-Time Users (scannable format)
- Add prominent Oh My OpenCode comparison link
- Add comprehensive Model Configuration section
- Add Customizing Agents section with practical examples
- Streamline model selection recommendations
- Add emoji headers for visual consistency
- Remove redundant FAQ entry
Addresses user feedback about documentation clarity and first-time user experience.
* refactor: remove OpenImplementer agent
- Delete OpenImplementer agent file (redundant with OpenAgent)
- Remove from registry.json and all profiles
- Update OpenCoder delegation rules (now handles 1-4 files directly)
- Clean up all context file references
- Remove from commands and documentation
Rationale: OpenImplementer only added 1 file to OpenAgent's capability (3→4 files), creating unnecessary complexity. OpenAgent and OpenCoder provide clearer separation: OpenAgent for general + focused tasks (1-4 files), OpenCoder for complex architecture (4+ files).
* fix: remove stale OpenImplementer reference from OpenCoder
- Remove OpenImplementer from Available Subagents list
- Clarify CoderAgent is used via TaskManager for complex tasks
- Keep delegation rules as-is (execute 1-4 files directly, delegate complex to CoderAgent)
* docs: remove remaining OpenImplementer references
- Update developer profile description (OpenAgent vs OpenCoder)
- Update registry.json profile description
- Update docs/README.md to remove OpenImplementer
- Update CHANGELOG.md to reflect simplified architecture
All OpenImplementer references now removed. Registry validation passes.
* docs: enhance README with first-time user improvements
- Add 'your secret weapon!' to Context System in Quick Concepts
- Add First-Time User Checklist after Get Started section
- Add visual comparison table for AOC vs Oh My OpenCode in FAQ
- Improve scannability and clarity for new users
Based on DocWriter review recommendations.
* docs: clarify project-context.md is created during installation
Minor enhancement to First-Time User Checklist step 2 for extra clarity.
* docs: change 'I' to 'we' for collaborative tone
- Update 'Why I Built This' to 'Why We Built This'
- Change 'I've spent' to 'We've spent'
- Change 'I use this' to 'We use this'
- Makes the project feel more collaborative and team-oriented
* docs: make intro more neutral and objective
- Change 'Why We Built This' to 'Why This Exists'
- Remove personal perspective ('We've spent 14+ years')
- Change 'We use this' to 'It's built for shipping'
- More professional and objective tone
* docs: major README rewrite based on user feedback
Key improvements based on real user confusion:
1. **Clear 'What Is AOC?' section** - Explains scaffold vs plugin approach upfront
2. **Model configuration prominently featured** - Addresses #1 user question
3. **Hook with quantified paradox** - Grabs attention in 15 seconds
4. **Context System promoted** - Moved to top, explains the differentiator
5. **Comparison table** - AOC vs Oh My OpenCode side-by-side
6. **Eliminated 60% redundancy** - Merged overlapping sections
7. **Simplified deep dives** - Model config and customization tightened
Based on user feedback: 'I just expected that behaviour because it was not
documented properly... the only thing really lacking was a clear explanation
of its purpose and how to configure models and adjust agents.'
Addresses: Confusion about scaffold vs plugin, model configuration, and
first-time user expectations.
* chore: publish package as @nextsystems/oac v0.7.0
- Changed package name from @openagents/control to @nextsystems/oac
- Successfully published to npm registry
- Users can install with: npm install -g @nextsystems/oac
- CLI command: oac
* feat: add context path configuration and reorganize documentation
- Add configurable context root via paths.json (@reference support)
- Add /add-context command for interactive context setup
- Move NPM_PUBLISHING_GUIDE.md to context system (guides/npm-publishing.md)
- Add GitHub issues workflow guide
- Update agents to support custom context directories
- Update navigation with new guides and file counts
This enables projects to use custom context directories (e.g., .context, .ai/context)
while maintaining backward compatibility with default .opencode/context/ structure.
Prathik Shetty