feat(ack): support OMP workers

tests/test_ack_omp_worker.py

@@ -0,0 +1,136 @@
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+ACK_SCRIPTS = REPO_ROOT / "skills" / "ack" / "scripts"
+sys.path.insert(0, str(ACK_SCRIPTS))
+
+import launch_worker  # noqa: E402
+import worker_profiles  # noqa: E402
+
+
+def omp_profile(*, role: str = "developer", permission: str = "workspace-write") -> dict:
+    return {
+        "role": role,
+        "cli": "omp",
+        "tier": "standard",
+        "model": "opencode-go/gpt-5.6-luna",
+        "reasoningEffort": "low",
+        "permissionMode": permission,
+    }
+
+
+def omp_orchestration() -> dict:
+    return {
+        "profileVersion": 1,
+        "mode": "orca",
+        "allowedWorktrees": ["/repo/demo"],
+        "modelAllowlist": {
+            "omp": {
+                "developer": {"standard": ["opencode-go/gpt-5.6-luna"]},
+                "test": {"standard": ["opencode-go/gpt-5.6-luna"]},
+            }
+        },
+        "profiles": {
+            "omp-dev-standard": omp_profile(),
+            "omp-test-standard": omp_profile(role="test"),
+        },
+        "defaults": {
+            "developer": "omp-dev-standard",
+            "test": "omp-test-standard",
+        },
+    }
+
+
+class OmpProfileValidationTests(unittest.TestCase):
+    def test_omp_profile_and_provider_model_allowlist_are_valid(self) -> None:
+        self.assertEqual(worker_profiles.validate_orchestration(omp_orchestration()), [])
+
+    def test_opencode_is_not_an_omp_worker_cli(self) -> None:
+        routing = omp_orchestration()
+        routing["profiles"]["omp-dev-standard"]["cli"] = "opencode"
+        routing["modelAllowlist"]["opencode"] = routing["modelAllowlist"].pop("omp")
+        errors = worker_profiles.validate_orchestration(routing)
+        self.assertTrue(any("must be" in error and "omp" in error for error in errors))
+
+    def test_test_cannot_use_strong_omp_profile(self) -> None:
+        routing = omp_orchestration()
+        routing["profiles"]["omp-test-standard"]["tier"] = "strong"
+        routing["modelAllowlist"]["omp"]["test"]["strong"] = [
+            "opencode-go/gpt-5.6-luna"
+        ]
+        errors = worker_profiles.validate_orchestration(routing)
+        self.assertTrue(any("Test may only use standard" in error for error in errors))
+        self.assertTrue(any("Test cannot define a strong allowlist" in error for error in errors))
+
+
+class OmpArgvTests(unittest.TestCase):
+    def test_workspace_write_uses_write_approval_and_no_session(self) -> None:
+        argv = worker_profiles.render_worker_argv(
+            omp_profile(), "/usr/local/bin/omp", "/repo/demo"
+        )
+        self.assertEqual(
+            argv,
+            [
+                "/usr/local/bin/omp",
+                "--model",
+                "opencode-go/gpt-5.6-luna",
+                "--thinking",
+                "low",
+                "--approval-mode",
+                "yolo",
+                "--cwd",
+                "/repo/demo",
+                "--no-session",
+            ],
+        )
+        self.assertNotIn("--auto-approve", argv)
+        self.assertIn("yolo", argv)
+        self.assertNotIn("--plan-yolo", argv)
+
+    def test_read_only_uses_always_ask_approval(self) -> None:
+        argv = worker_profiles.render_worker_argv(
+            omp_profile(permission="read-only"), "/usr/local/bin/omp", "/repo/demo"
+        )
+        self.assertIn("--approval-mode", argv)
+        self.assertEqual(argv[argv.index("--approval-mode") + 1], "always-ask")
+        self.assertEqual(argv[-2:], ["/repo/demo", "--no-session"])
+
+    def test_omp_executable_identity_matches_only_omp(self) -> None:
+        self.assertTrue(worker_profiles.executable_basename_matches_cli("/bin/omp", "omp"))
+        self.assertFalse(
+            worker_profiles.executable_basename_matches_cli("/bin/opencode", "omp")
+        )
+
+
+class OmpEnvironmentTests(unittest.TestCase):
+    def test_environment_passes_only_omp_provider_credential(self) -> None:
+        with mock.patch.dict(
+            os.environ,
+            {
+                "OPENCODE_API_KEY": "omp-secret",
+                "OPENAI_API_KEY": "must-not-pass",
+                "CURSOR_API_KEY": "must-not-pass",
+                "UNRELATED_SECRET": "must-not-pass",
+            },
+            clear=True,
+        ):
+            environment = launch_worker.worker_environment("omp")
+        self.assertEqual(environment["OPENCODE_API_KEY"], "omp-secret")
+        self.assertNotIn("OPENAI_API_KEY", environment)
+        self.assertNotIn("CURSOR_API_KEY", environment)
+        self.assertNotIn("UNRELATED_SECRET", environment)
+
+    def test_unknown_cli_environment_fails_closed(self) -> None:
+        with self.assertRaises(launch_worker.LaunchError):
+            launch_worker.worker_environment("opencode")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_ack_skill.py

@@ -131,7 +131,7 @@ class AckSkillContentTests(unittest.TestCase):
         ):
             self.assertTrue((ack_dir / relative_path).is_file(), relative_path)
         version = (ack_dir / "VERSION").read_text(encoding="utf-8").strip()
-        self.assertEqual(version, "0.17.1")
+        self.assertEqual(version, "0.18.0")
         self.assertIn(
             f'ackVersion: "{version}"',
             (ack_dir / "examples" / "tasks.example.yaml").read_text(encoding="utf-8"),