@elliotsystems/eai 0.1.1 → 0.1.3

package/plugin/opencode-plugin/src/classifier.ts

@@ -0,0 +1,238 @@
+/**
+ * Shell-command classification — the policy intelligence glob patterns cannot express.
+ *
+ * Ported (adapted, not copied wholesale) from `elliot-cli/src/tools/bash-policy.ts`,
+ * which is pure and dependency-free. Three things here are beyond what OpenCode's
+ * native `permission.bash` globs can represent, which is exactly why this file exists:
+ *
+ *   1. **Category labels** (READ/TEST/BUILD/MUTATION/DESTRUCTIVE/UNKNOWN) — a glob
+ *      yields a verdict, never a reason. A human approving a prompt deserves the reason.
+ *   2. **Chain-splitting with worst-case ranking** — OpenCode does decompose pipelines
+ *      per command node (`tool/shell.ts:408`), but the *classification* of a compound
+ *      command as "only as safe as its most dangerous segment" is ours.
+ *   3. **The credential-exfiltration heuristic** — a relationship between two tokens
+ *      ("names a secret-shaped path" AND "invokes a network tool") in one command line.
+ *      No prefix pattern can see a relationship.
+ *
+ * Failure direction is inherited deliberately from the original: over-trigger toward
+ * `ask`, never under-trigger. A spurious prompt is a cost; a missed bypass is an
+ * incident. Notably `CHAIN_SPLIT_RE` is a naive split, not a shell parser — a literal
+ * `;` inside a quoted commit message can cause an extra prompt. That is the correct
+ * trade.
+ *
+ * Nothing here is repository-specific: every pattern is a generic command shape.
+ */
+
+export type Category = "READ" | "TEST" | "BUILD" | "MUTATION" | "DESTRUCTIVE" | "UNKNOWN"
+
+function firstToken(cmd: string): string {
+  return cmd.trim().split(/\s+/)[0] ?? ""
+}
+
+/**
+ * git is classified by SUBCOMMAND and flags, never lumped together: `git status` and
+ * `git push --force` share a prefix and share nothing else.
+ */
+function classifyGit(cmd: string): Category {
+  const rest = cmd.trim().replace(/^git\s+/i, "")
+  const sub = firstToken(rest).toLowerCase()
+
+  if (/(^|\s)(--force|-f)(\s|$)/i.test(rest) && sub === "push") return "DESTRUCTIVE"
+  if (sub === "push") return "MUTATION"
+  if (sub === "reset" && /--hard/i.test(rest)) return "DESTRUCTIVE"
+  if (sub === "reset") return "MUTATION"
+  if (sub === "clean" && /-\w*f/i.test(rest)) return "DESTRUCTIVE"
+  if (sub === "clean") return "MUTATION"
+  if (["commit", "checkout", "merge", "rebase", "stash", "branch"].includes(sub)) {
+    // Listing branches is a read; deleting one is not.
+    if (sub === "branch") return /(^|\s)-[dD]\b/.test(rest) ? "MUTATION" : "READ"
+    return "MUTATION"
+  }
+  if (["status", "log", "diff", "show", "remote"].includes(sub)) return "READ"
+  return "UNKNOWN"
+}
+
+const READ_PATTERNS: RegExp[] = [
+  /^(ls|dir)\b/i, /^cat\b/i, /^type\b/i, /^head\b/i, /^tail\b/i, /^wc\b/i,
+  /^pwd$/i, /^cd\b/i, /^echo\b/i,
+  /^find\b(?!.*(-delete|-exec))/i,
+  /^(which|where)\b/i,
+  /^node\s+(-v|--version)$/i,
+  /^npm\s+(ls|list)\b/i,
+  // Read-only pipeline filters. Present because OpenCode asks about every node of a
+  // pipeline, so an unclassified filter would drag an otherwise-READ pipeline to UNKNOWN.
+  // `sed`/`awk`/`xargs` are deliberately absent: `sed -i` writes, `awk` has
+  // `print > file` and `system()`, `xargs` executes whatever follows.
+  /^(grep|findstr|cut|sort|uniq|tr|jq)\b/i,
+]
+
+const TEST_PATTERNS: RegExp[] = [
+  /^npm\s+test\b/i, /^npm\s+run\s+test/i, /^(yarn|pnpm)\s+test\b/i,
+  /^python\s+-m\s+pytest\b/i, /^pytest\b/i, /^jest\b/i, /^vitest\b/i,
+  /^npx\s+vitest\b/i, /^go\s+test\b/i, /^cargo\s+test\b/i, /^mvn\s+test\b/i,
+  /^dotnet\s+test\b/i, /^make\s+test\b/i,
+]
+
+const BUILD_PATTERNS: RegExp[] = [
+  /^npm\s+run\s+build\b/i, /^(yarn|pnpm)\s+build\b/i, /^tsc\b/i,
+  /^go\s+build\b/i, /^cargo\s+build\b/i, /^mvn\s+package\b/i, /^make(\s+build)?$/i,
+]
+
+const MUTATION_PATTERNS: RegExp[] = [
+  /^npm\s+(install|uninstall|ci)\b/i, /^pip\s+(install|uninstall)\b/i,
+  /^mv\b/i, /^cp\b/i, /^mkdir\b/i, /^touch\b/i, /^chmod\b/i, /^chown\b/i,
+  /^docker\s+(run|stop|rm)\b/i, /^kill\b/i, /^taskkill\b/i,
+  // A single, non-recursive delete — real but bounded. `rm -rf` is caught as
+  // DESTRUCTIVE before this list is consulted.
+  /^rm\b/i, /^del\b/i,
+]
+
+/**
+ * Catastrophic and with no legitimate interactive use. Confirmation adds no safety
+ * against a runaway loop, so these are refused outright. Intentionally tiny — broad
+ * denial belongs to the DESTRUCTIVE default (`ask`), not here.
+ */
+const HARD_DENY_PATTERNS: RegExp[] = [
+  /:\(\)\s*\{\s*:\|\s*:&\s*\}\s*;\s*:/,      // classic fork bomb
+  /^rm\s+-rf?\s+(\/|~)(\s|$)/i,              // rm -rf /   |   rm -rf ~
+  /^rm\s+-rf?\s+\/\*(\s|$)/i,                // rm -rf /*
+  /^rmdir\s+\/s\s+\/q\s+[a-z]:\\?\s*$/i,     // rmdir /s /q C:\
+  /^mkfs\b/i,
+  /^format\s+[a-z]:/i,                        // Windows format C:
+]
+
+const DESTRUCTIVE_PATTERNS: RegExp[] = [
+  /^rm\s+-rf?\b/i, /^rmdir\s+\/s\b/i, /^del\b.*(\/f|\/s|\/q|\*)/i,
+  /\b(drop|truncate)\s+(table|database)\b/i, /\bdelete\s+from\b/i,
+  /^format\b/i, /^mkfs\b/i, /^dd\s+if=/i,
+  /^(shutdown|reboot|halt)\b/i, /^chmod\s+-R\s+777\s+\//i,
+  /(curl|wget)\b.*\|\s*(sh|bash|powershell)\b/i,  // pipe remote script into a shell
+]
+
+/**
+ * Process-kill tools, and the process names Elliot itself runs under.
+ *
+ * `eai` is an npm bin shim, so the launcher IS a `node.exe` process and the
+ * runtime is `opencode.exe`. That makes a by-name kill self-inflicted: asked to
+ * restart a dev stack, the agent reached for
+ *
+ *     Get-Process node | Stop-Process -Force
+ *
+ * which matched its own host and terminated the session mid-command. Because
+ * `Stop-Process -Force` maps to TerminateProcess, no signal handler, `finally`
+ * or `exit` hook runs -- so the terminal was also left in mouse-reporting mode,
+ * flooding the next shell with escape sequences. It killed every unrelated
+ * `node.exe` on the machine too.
+ *
+ * Denied outright rather than asked, because the confirmation prompt does not
+ * convey the real consequence: someone approving "restart the project" is not
+ * agreeing to kill the session asking the question.
+ */
+// `spps` and bare `kill` are PowerShell aliases for Stop-Process, so the same
+// self-kill works spelled either way; both are word-bounded, so `kill` matches
+// only the standalone verb and not `taskkill`/`pkill`/`killall`.
+const PROCESS_KILL_TOOL = /\b(Stop-Process|spps|taskkill|pkill|killall|kill)\b/i
+
+/** Word-bounded so `node_exporter` and `mynode` are not caught. */
+const AGENT_RUNTIME_NAME = /\b(node|bun|opencode|eai)(\.exe)?\b/i
+
+/**
+ * An explicit numeric PID means the caller already identified one process, which
+ * is the safe way to do this and stays allowed.
+ */
+const SCOPED_BY_PID = /(-Id\b|\/PID\b)\s*:?\s*\d+/i
+
+/**
+ * True when a command would kill processes by NAME and that name matches the
+ * runtime Elliot is running inside.
+ *
+ * Killing `uvicorn`, `vite` or any other dev process by name stays allowed --
+ * this is not a ban on process management, only on the shape that takes the
+ * agent down with it.
+ */
+export function killsAgentRuntime(command: string): boolean {
+  if (!PROCESS_KILL_TOOL.test(command)) return false
+  if (SCOPED_BY_PID.test(command)) return false
+  return AGENT_RUNTIME_NAME.test(command)
+}
+
+/** Secret-shaped paths and network tools — the two halves of the exfil heuristic. */
+const SECRET_PATH_PATTERN = /(\.env\b|id_rsa|\.aws\b|\.ssh\b|credentials|\.pem\b|\.p12\b)/i
+const NETWORK_TOOL_PATTERN = /\b(curl|wget|nc|ncat|scp|ftp|Invoke-WebRequest|Invoke-RestMethod)\b/i
+
+/**
+ * True when one command line both names a secret-shaped path AND invokes a network
+ * tool. Best-effort by design: it cannot prove intent, and it is the one rule here
+ * that no glob pattern could ever approximate.
+ */
+export function looksLikeCredentialExfiltration(command: string): boolean {
+  return SECRET_PATH_PATTERN.test(command) && NETWORK_TOOL_PATTERN.test(command)
+}
+
+/** Classify ONE command with no shell chaining in it. */
+function classifySingle(command: string): Category {
+  const cmd = command.trim()
+  if (!cmd) return "UNKNOWN"
+
+  if (/^git\b/i.test(cmd)) return classifyGit(cmd)
+
+  if (HARD_DENY_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (DESTRUCTIVE_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (looksLikeCredentialExfiltration(cmd)) return "DESTRUCTIVE"
+
+  if (TEST_PATTERNS.some((re) => re.test(cmd))) return "TEST"
+  if (BUILD_PATTERNS.some((re) => re.test(cmd))) return "BUILD"
+  if (MUTATION_PATTERNS.some((re) => re.test(cmd))) return "MUTATION"
+  if (READ_PATTERNS.some((re) => re.test(cmd))) return "READ"
+
+  return "UNKNOWN"
+}
+
+/** How restrictive each category is — used to pick the worst segment of a chain. */
+const RANK: Record<Category, number> = {
+  READ: 0, TEST: 0, BUILD: 0,
+  MUTATION: 1, UNKNOWN: 1,
+  DESTRUCTIVE: 2,
+}
+
+function worstOf(categories: Category[]): Category {
+  return categories.reduce((worst, c) => (RANK[c] > RANK[worst] ? c : worst))
+}
+
+/**
+ * Metacharacters that chain, pipe, substitute, or redirect — each hands control to a
+ * SECOND command the anchored (`^`) patterns above would never see. Without splitting,
+ * `git status ; rm -rf /` classifies as the READ head alone and the tail rides along.
+ */
+const CHAIN_SPLIT_RE = /(?:&&|\|\||>>|;|\||`|\$\(|\n|>|<|&)/
+
+function segmentsOf(command: string): string[] {
+  return command.trim().split(CHAIN_SPLIT_RE).map((s) => s.trim()).filter(Boolean)
+}
+
+export function classifyCommand(command: string): Category {
+  const cmd = command.trim()
+  if (!cmd) return "UNKNOWN"
+
+  // Whole-string checks first: a catastrophic or exfil shape is caught wherever it sits
+  // relative to a chaining operator.
+  if (HARD_DENY_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (DESTRUCTIVE_PATTERNS.some((re) => re.test(cmd))) return "DESTRUCTIVE"
+  if (looksLikeCredentialExfiltration(cmd)) return "DESTRUCTIVE"
+  // Checked whole-string: the kill tool and the process name routinely sit on
+  // opposite sides of a pipe, so per-segment classification would see neither.
+  if (killsAgentRuntime(cmd)) return "DESTRUCTIVE"
+
+  const segments = segmentsOf(cmd)
+  if (segments.length <= 1) return classifySingle(cmd)
+
+  // A compound command is only as safe as its most dangerous segment.
+  return worstOf(segments.map(classifySingle))
+}
+
+export function isHardDenied(command: string): boolean {
+  const cmd = command.trim()
+  if (HARD_DENY_PATTERNS.some((re) => re.test(cmd))) return true
+  // A hard-deny command can hide as one segment of a chain.
+  return segmentsOf(cmd).some((seg) => HARD_DENY_PATTERNS.some((re) => re.test(seg)))
+}

package/plugin/opencode-plugin/src/elliot-auth.ts

@@ -0,0 +1,133 @@
+/**
+ * Elliot token read + refresh — the credential half of the proxy provider.
+ *
+ * Ported (trimmed, not imported) from `elliot-cli/src/auth/refresh.ts` and
+ * `elliot-cli/src/config.ts`: same `~/.elliot/config.json` shape, same
+ * refresh endpoint contract (`POST {backend_url}/auth/refresh` ->
+ * `{access_token, expires_in_seconds}`), same "never throw" discipline. This
+ * file exists inside `opencode-plugin` rather than importing the CLI package
+ * because the plugin ships and is loaded independently of `elliot-cli` — see
+ * `docs/superpowers/plans/2026-09-03-eai-proxy-auth.md`.
+ *
+ * `freshToken` is the only export the proxy provider's `auth.loader`/`fetch`
+ * needs: it never throws, so a stale/missing/corrupt config degrades to "no
+ * token" (the proxy 401s) rather than crashing OpenCode's model call.
+ */
+import * as fs from "node:fs"
+import * as os from "node:os"
+import * as path from "node:path"
+
+export interface ElliotConfig {
+  jwt_token?: string
+  refresh_token?: string
+  backend_url?: string
+  access_token_expires_at?: string
+  [k: string]: unknown
+}
+
+/** `${ELLIOT_HOME}/config.json`, or `~/.elliot/config.json` when unset. */
+export function elliotConfigPath(): string {
+  const home = process.env.ELLIOT_HOME ?? path.join(os.homedir(), ".elliot")
+  return path.join(home, "config.json")
+}
+
+/** Parsed config, or null when absent, unreadable, or not valid JSON. */
+export function readElliotConfig(): ElliotConfig | null {
+  try {
+    const raw = fs.readFileSync(elliotConfigPath(), "utf-8")
+    return JSON.parse(raw) as ElliotConfig
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Persist the config, owner-only (0600) — this file holds a live bearer
+ * token. Creates `~/.elliot` (0700) if it doesn't exist yet.
+ */
+export function writeElliotConfig(cfg: ElliotConfig): void {
+  const configPath = elliotConfigPath()
+  const configDir = path.dirname(configPath)
+  if (!fs.existsSync(configDir)) {
+    fs.mkdirSync(configDir, { recursive: true, mode: 0o700 })
+  }
+  fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2), { mode: 0o600 })
+  fs.chmodSync(configPath, 0o600)
+}
+
+/** `exp` (seconds since epoch) from a JWT's middle segment, or null. */
+function decodeJwtExp(token: string): number | null {
+  try {
+    const parts = token.split(".")
+    if (parts.length < 2) return null
+    const payload = JSON.parse(Buffer.from(parts[1], "base64").toString("utf-8"))
+    return typeof payload?.exp === "number" ? payload.exp : null
+  } catch {
+    return null
+  }
+}
+
+const REFRESH_SKEW_MS = 60_000
+
+/**
+ * True if the access token is expired or within `REFRESH_SKEW_MS` of
+ * expiring. Prefers the stored `access_token_expires_at`; falls back to
+ * decoding `jwt_token`'s `exp` claim; true (treat as expired -> refresh) when
+ * neither is decodable.
+ */
+export function isExpired(cfg: ElliotConfig, nowMs = Date.now()): boolean {
+  if (cfg.access_token_expires_at) {
+    const expiresAtMs = new Date(cfg.access_token_expires_at).getTime()
+    if (Number.isFinite(expiresAtMs)) {
+      return expiresAtMs - REFRESH_SKEW_MS <= nowMs
+    }
+  }
+  const exp = cfg.jwt_token ? decodeJwtExp(cfg.jwt_token) : null
+  if (exp === null) return true
+  return exp * 1000 - REFRESH_SKEW_MS <= nowMs
+}
+
+interface RefreshResponse {
+  access_token: string
+  expires_in_seconds: number
+}
+
+interface FreshTokenDeps {
+  fetchImpl?: typeof fetch
+  write?: (cfg: ElliotConfig) => void
+}
+
+/**
+ * A valid access token, refreshing + persisting when expired and a
+ * `refresh_token`/`backend_url` are present. NEVER throws: any failure
+ * (network, non-2xx, malformed response) falls back to the existing
+ * `jwt_token` — the proxy 401s on a stale token rather than this crashing the
+ * model call.
+ */
+export async function freshToken(
+  cfg: ElliotConfig,
+  deps?: FreshTokenDeps,
+): Promise<string | null> {
+  try {
+    if (cfg.jwt_token && !isExpired(cfg)) return cfg.jwt_token
+    if (!cfg.refresh_token || !cfg.backend_url) return cfg.jwt_token ?? null
+
+    const fetchImpl = deps?.fetchImpl ?? fetch
+    const write = deps?.write ?? writeElliotConfig
+
+    const response = await fetchImpl(`${cfg.backend_url}/auth/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: cfg.refresh_token }),
+    })
+    if (!response.ok) return cfg.jwt_token ?? null
+
+    const data = (await response.json()) as RefreshResponse
+    cfg.jwt_token = data.access_token
+    cfg.access_token_expires_at = new Date(Date.now() + data.expires_in_seconds * 1000).toISOString()
+    write(cfg)
+    return data.access_token
+  } catch {
+    return cfg.jwt_token ?? null
+  }
+}

package/plugin/opencode-plugin/src/index.ts

@@ -0,0 +1,199 @@
+/**
+ * @elliotsystems/opencode-plugin — Elliot AI's OpenCode integration.
+ *
+ * Phase C2 scope: exactly one job. The Elliot backend serves `knowledge_search`
+ * over the native MCP + OAuth boundary (agent-visible as
+ * `elliot_knowledge_search`); this plugin injects the session's repository
+ * scope into that tool's arguments so retrieval can be repo-focused — while the
+ * model itself never names a repository, and the backend's `resolve_repo_scope`
+ * remains the only authorizer.
+ *
+ * What this plugin deliberately does NOT do:
+ *   - no tokens: OAuth lifecycle (login, storage, refresh) is OpenCode's native
+ *     MCP client, verified end-to-end against this backend;
+ *   - no transport: there is no tool-invoke server route at v1.18.19, and
+ *     reading mcp-auth.json would create a second credential path;
+ *   - no prompt stuffing: knowledge arrives when the agent elects the tool.
+ *
+ * Loading (any of): opencode.json `"plugin": [["@elliotsystems/opencode-plugin",
+ * {"serverNames": ["elliot"]}]]`, a path spec during development, or a
+ * `.opencode/plugin/` file re-export.
+ */
+import { isElliotKnowledgeTool, parseOptions, shellVerdict } from "./policy.js"
+import { ELLIOT_PROVIDER_ID, configHook, makeAuthHook } from "./proxy-provider.js"
+import { readElliotConfig } from "./elliot-auth.js"
+import { formatScope, scopeForWorktree } from "./scope.js"
+
+// Structural mirrors of the host types (packages/plugin/src/index.ts @
+// v1.18.19). Declared locally so this package type-checks and unit-tests
+// without the opencode workspace on the module path; the host validates
+// plugins structurally (`readV1Plugin`), so compatibility is by shape, not by
+// nominal import.
+export interface PluginInput {
+  directory: string
+  worktree: string
+  project?: unknown
+  client?: {
+    auth?: {
+      set: (input: { path: { id: string }; body: Record<string, unknown> }) => Promise<unknown>
+    }
+    [k: string]: unknown
+  }
+  serverUrl?: URL
+  $?: unknown
+}
+
+/** The host's Permission payload — only the fields this plugin reads. */
+export interface PermissionInput {
+  type: string
+  pattern?: string | string[]
+  metadata?: Record<string, unknown>
+}
+
+/** Structural mirror of the host's `AuthHook` (packages/plugin/src/index.ts). */
+export interface AuthHook {
+  provider: string
+  methods: unknown[]
+  loader?: (auth: () => Promise<unknown>, provider: unknown) => Promise<Record<string, any>>
+}
+
+export interface Hooks {
+  "tool.execute.before"?: (
+    input: { tool: string; sessionID: string; callID: string },
+    output: { args: Record<string, unknown> },
+  ) => Promise<void>
+  "permission.ask"?: (
+    input: PermissionInput,
+    output: { status: "ask" | "deny" | "allow" },
+  ) => Promise<void>
+  config?: (input: any) => Promise<void>
+  auth?: AuthHook
+  dispose?: () => Promise<void>
+}
+
+export type Plugin = (input: PluginInput, options?: Record<string, unknown>) => Promise<Hooks>
+
+export const ElliotPlugin: Plugin = async (input, rawOptions) => {
+  // Fail loudly at load on bad options — a plugin that limps with a typo'd
+  // config is worse than one that says why it refused to start.
+  const options = parseOptions(rawOptions)
+
+  // Session truth, resolved once. The worktree comes from OpenCode itself —
+  // the one source the model cannot influence.
+  const worktree = input.worktree || input.directory
+
+  // Seed a placeholder auth entry for the `elliot` provider so the host's
+  // auth loader fires at all (`provider.ts:1584` skips the loader entirely
+  // when nothing is stored for its provider id — see Task-1 findings). The
+  // value itself is never the credential that reaches the wire; the auth
+  // loader's `fetch` attaches the live bearer token per request. Guarded so
+  // a client-RPC failure never breaks plugin init, and skipped outright when
+  // the user isn't logged into Elliot.
+  if (readElliotConfig()) {
+    try {
+      await input.client?.auth?.set({
+        path: { id: ELLIOT_PROVIDER_ID },
+        body: { type: "api", key: "elliot-managed" },
+      })
+    } catch {
+      // Never break plugin init on a seeding failure — the auth loader
+      // simply won't fire this session, same as the no-login path.
+    }
+  }
+
+  return {
+    /**
+     * One handler, two jobs — a JS object literal may carry only one
+     * `tool.execute.before` key, and a second would silently shadow the first.
+     *   (a) the Elliot knowledge tool -> inject worktree-derived repo scope
+     *   (b) the shell tool            -> enforce org hard-deny / credential policy
+     */
+    "tool.execute.before": async (hookInput, output) => {
+      // (a) Knowledge-tool scope injection. The model never names a repository;
+      // this value comes from the session worktree, and the backend authorizes it.
+      if (isElliotKnowledgeTool(hookInput.tool, options)) {
+        const scope = await scopeForWorktree(worktree)
+        if (scope) {
+          // Unconditional overwrite: session truth beats anything already in args.
+          // The backend schema forbids model-supplied scope, but if one ever slipped
+          // through a future contract change, it dies here first.
+          output.args["repo_scope_hint"] = formatScope(scope)
+        } else {
+          // No derivable scope -> guarantee none is smuggled either. Tenant-wide
+          // search is the correct degradation (authorized, just unfocused).
+          delete output.args["repo_scope_hint"]
+        }
+        return
+      }
+
+      // (b) Shell policy, enforced HERE rather than in `permission.ask`.
+      //
+      // Forced by upstream reality, verified by scanning every `plugin.trigger(...)`
+      // site in v1.18.19: thirteen hooks are triggered and `permission.ask` is NOT
+      // among them. It is declared in the public plugin API
+      // (packages/plugin/src/index.ts:261) but never invoked, so a handler there is
+      // dead code in this version. `tool.execute.before` IS triggered
+      // (session/prompt.ts), and throwing from it aborts the tool call — the only
+      // plugin-side hard stop available today.
+      //
+      // Why bother when the org glob policy already asks/denies? Defence in depth
+      // against what globs structurally cannot see: a catastrophic shape hiding
+      // behind a safe-looking chain segment (`git status ; rm -rf /`), and a command
+      // that both names a secret-shaped path and invokes a network tool. If an org
+      // policy is ever loosened by accident, these still do not get through.
+      //
+      // Deliberately narrow: it only ever BLOCKS, and only on the hard-deny and
+      // credential classes. Commands the classifier merely wants confirmed are left
+      // to the host's own ask flow, which already handles them well.
+      if (hookInput.tool !== "bash" && !hookInput.tool.endsWith("_bash")) return
+
+      const command = output.args?.["command"]
+      if (typeof command !== "string") return
+
+      const verdict = shellVerdict(command)
+      if (verdict?.status !== "deny") return
+
+      throw new Error(
+        `Blocked by Elliot organization policy: ${verdict.reason}. Command: ${command}`,
+      )
+    },
+
+    /**
+     * Kept deliberately, though currently INERT: `permission.ask` has no trigger
+     * site in v1.18.19 (verified across every `plugin.trigger` call). When upstream
+     * wires it, policy decisions belong here — a returned status is cleaner than a
+     * thrown tool error — so this is the forward-compatible home. It can only ever
+     * tighten.
+     */
+    "permission.ask": async (permInput, output) => {
+      if (permInput.type !== "bash") return
+      const command = permInput.metadata?.["command"]
+      if (typeof command !== "string") return
+      const verdict = shellVerdict(command)
+      if (!verdict) return
+      if (output.status === "deny") return // never loosen
+      output.status = verdict.status
+    },
+
+    /**
+     * Registers the `elliot` provider (proxy baseURL) and defaults the
+     * model to it — no-op when the user isn't logged into Elliot. See
+     * `proxy-provider.ts`.
+     */
+    config: async (c) => {
+      configHook(c)
+    },
+
+    /**
+     * Self-refreshing auth loader for the `elliot` provider — see
+     * `proxy-provider.ts`. Only fires once the seeding above has stored an
+     * auth entry for `ELLIOT_PROVIDER_ID`.
+     */
+    auth: makeAuthHook(),
+  }
+}
+
+// Both export styles the host loader accepts (`getLegacyPlugins` takes any
+// function export; `PluginModule` prefers `server`).
+export const server = ElliotPlugin
+export default ElliotPlugin

package/plugin/opencode-plugin/src/mcp-keys.ts

@@ -0,0 +1,30 @@
+/**
+ * How OpenCode composes agent-visible MCP tool keys.
+ *
+ * Its own module, with ZERO imports, because two runtimes need it. `policy.ts`
+ * uses it in the server plugin (where zod is available) and `tui/knowledge.ts`
+ * uses it in the TUI plugin runtime — which shares only a fixed list of modules
+ * with plugins (`solid-js`, `@opentui/*`, `bun`; see `tui/host.d.ts`) and would
+ * fail to load a module that reached for `zod` transitively.
+ *
+ * Duplicating the rule in both places was the alternative. A drifted copy of a
+ * key-composition rule fails silently — the tool simply stops being recognised —
+ * so one definition, imported twice, is the safer shape.
+ */
+
+/**
+ * Mirror of OpenCode's `McpCatalog.sanitize` (mcp/catalog.ts:117) so composed
+ * keys are predicted exactly, including server names carrying characters MCP
+ * sanitises away.
+ */
+export function sanitizeKey(value: string): string {
+  return value.replace(/[^a-zA-Z0-9_-]/g, "_")
+}
+
+/** The backend tool behind every Elliot knowledge lookup. */
+export const KNOWLEDGE_TOOL = "knowledge_search"
+
+/** The agent-visible key for `KNOWLEDGE_TOOL` on a given MCP server. */
+export function knowledgeToolKey(serverName: string): string {
+  return `${sanitizeKey(serverName)}_${KNOWLEDGE_TOOL}`
+}