- Bump root packageManager via `corepack use pnpm@latest`.
- Sync script bakes the root's packageManager into each template's
package.json, so scaffolded sites auto-track the monorepo pin.
- create-emdash strips packageManager when the user picks npm/yarn/bun
so corepack doesn't force pnpm on a non-pnpm user.
- Drop dead `pnpm.onlyBuiltDependencies` from demo/fixture/template
package.json files; pnpm 11 ignores `package.json#pnpm` and the root
`allowBuilds` already covers these binaries.
- AGENTS.md / auto-implementer.md: drop `--silent` from lint commands;
pnpm 11 prints the `$ command` line to stderr, so JSON pipes cleanly
without it.
The /bonk workflow ran on the default opencode build agent with the
maintainer's comment as the entire prompt, so investigation depth and
reproduction discipline were left to the model. The /review workflow
already gets this right via the auto-reviewer custom agent.
Adds .opencode/agents/auto-implementer.md, mirroring the auto-reviewer
pattern. The agent file holds mode classification, investigation
protocol, TDD reproduction discipline, and EmDash-specific diagnostic
notes (locale filters on content tables, API envelope shape, sibling
bug clustering, requirePerm/requireOwnerPerm, requestCached, globalThis
singletons, dialect-agnostic test setup). Defers AGENTS.md rules to
AGENTS.md instead of duplicating.
Updates bonk.yml to wire in the agent and inject structured trigger
context (kind, number, title, body, head/base SHAs) the same way
review.yml does, so the agent does not need to discover what it is
looking at.
Doc corrections found while validating the agent against current code:
- bonk.yml / review.yml: header comments listed nonexistent gpt and
gemini aliases. The current registry has only opus (default) and
kimi. Updated to match.
- bonk-models.json and resolve-bonk-model.mjs: removed hard-coded
opencode 1.4.6 references; the workflows pin 1.4.11.
- AGENTS.md: globalThis singleton example pointed at
bylines/index.ts (bylinesHolder) which no longer matches; updated
to settings/index.ts (SITE_SETTINGS_CACHE_KEY / holder) which is
the current canonical example. Also fixed the migration
registration path: database/runner.ts to
database/migrations/runner.ts.
- skills/emdash-cli/SKILL.md: field types list was incomplete; added
select, multiSelect, slug, url, file and pointed at
FIELD_TYPE_TO_COLUMN as the source of truth.
* docs(agents): correct stale auth API, error helper names, and structure
The Authorization section pointed at `requireRole(user, Role.X)` from a
`auth/permissions.js` that doesn't exist; the real public API is
`requirePerm(user, "perm:string")` and `requireOwnerPerm(...)` from
`#api/authorize.js`, with permissions defined in `packages/auth/src/rbac.ts`.
Other drift fixed:
- Repo Structure listed only `packages/core`; now lists all 9 packages.
- Handler results: `mapErrorToStatus` does not exist (real name is
`mapErrorStatus`); promotes `unwrapResult()` as the preferred idiom.
- Testing: SQLite-only claim is wrong; documents the postgres helpers and
`describeEachDialect` parity wrapper.
- Drops a stale tasks.md instruction and the `pr` skill reference (skill
isn't shipped in this repo).
* ci: add /ultrareview and /ultrabonk frontier-model triggers
Two new opt-in workflows that mirror /review and /bonk but use Claude Opus 4.7
through the Cloudflare AI Gateway. Use them when the default model isn't strong
enough -- typically high-risk PRs (security-sensitive, architectural, suspected
subtle cross-file bugs) for /ultrareview, or hard fixes/refactors for /ultrabonk.
Other changes ride along:
- Adds `.opencode/agents/auto-reviewer.md`, a real custom agent for the review
workflows. `agent: reviewer` was a no-op (opencode has no built-in
`reviewer` agent and silently fell back to `build`); the prompt was doing
all the work via the inline `prompt:` field. The agent now holds the review
philosophy, severity calibration, and posting protocol so the workflow YAML
stays small.
- Adds `token_permissions: NO_PUSH` to /review (and /ultrareview). Yesterday a
/review run silently committed scratch helpers to the PR branch because
opencode's github wrapper auto-commits any dirty files at the end of the
session. NO_PUSH scopes the installation token to contents:read so the push
fails at the git layer regardless of model behavior. Write tools stay enabled
in the agent so it can scaffold fixes locally to verify reasoning.
- Fixes /bonk silently broken since #758: kimi-k2.6 was added to its model
field but never registered, so opencode would raise
ProviderModelNotFoundError. Adds the same `OPENCODE_CONFIG_CONTENT`
registration we added to /review last night.
- Switches `.opencode/` from a blanket-ignore to a contents-pattern with
`.opencode/agents/` re-included, so the agent file ships with the repo while
personal review notes under `.opencode/reviews/` stay local-only.
Tier matrix: /review (Kimi) + /ultrareview (Opus) for review, /bonk (Kimi)
+ /ultrabonk (Opus) for build/fix. Token scope is NO_PUSH for the review pair
and standard write for the bonk pair.
* consolidate / include fragmented AI configuration files like .claude, .gemini, .agent and .codex into a single, interoperable standard .agents
* feat: add .agents directory for assistant tracking
* feat: add .agents directory with skills symlink
* chore: add .agents/skills scaffold directory to oxlint ignore list
* chore: finalize renaming .opencode to .agents and cleanup ignores
---------
Co-authored-by: Matt Kane <mkane@cloudflare.com>
Matt Kane