@haposoft/cafekit 0.16.0-rc.6 → 0.16.0-rc.7

package/src/opencode/plugins/docs-sync.ts

@@ -1,175 +0,0 @@
-/**
- * Copyright (c) 2026 Haposoft. MIT License.
- *
- * OpenCode Plugin — docs-sync.ts
- *
- * Port of .claude/hooks/docs-sync.cjs.
- *
- * Behavior:
- * - On session.created: detect if project has source code but no docs/, or if
- *   docs/.sync_hash is stale relative to current source-only git hash.
- * - Write banner to `.opencode/session-banner.md` so AGENTS.md / skills can
- *   surface it (OpenCode event console.log does not flow into assistant
- *   context, only the server log).
- * - Also print to stderr so the OpenCode server log records it.
- *
- * Disable via `.opencode/runtime.json` { "docsSync": false }.
- */
-
-import type { Plugin } from "@opencode-ai/plugin";
-import {
-  existsSync,
-  readFileSync,
-  writeFileSync,
-  mkdirSync,
-  appendFileSync,
-} from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { execSync } from "node:child_process";
-
-const PLUGIN_DIR = dirname(fileURLToPath(import.meta.url));
-const BANNER_SECTION_START = "<!-- CAFEKIT DOCS SYNC START -->";
-const BANNER_SECTION_END = "<!-- CAFEKIT DOCS SYNC END -->";
-
-function readRuntime(cwd: string): Record<string, any> {
-  try {
-    const file = join(cwd, ".opencode", "runtime.json");
-    return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
-  } catch {
-    return {};
-  }
-}
-
-function resolveDocsDir(cwd: string, runtime: Record<string, any>): string {
-  const configured = runtime.paths?.docs;
-  return join(cwd, typeof configured === "string" && configured ? configured : "docs");
-}
-
-function hasSourceCode(cwd: string): boolean {
-  return (
-    existsSync(join(cwd, "src")) ||
-    existsSync(join(cwd, "app")) ||
-    existsSync(join(cwd, "lib")) ||
-    existsSync(join(cwd, "package.json")) ||
-    existsSync(join(cwd, "index.js")) ||
-    existsSync(join(cwd, "main.py"))
-  );
-}
-
-function currentSourceHash(cwd: string): string {
-  try {
-    return execSync('git log -1 --format="%H" -- . ":(exclude)docs"', {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
-  } catch {
-    return "";
-  }
-}
-
-function buildMissingDocsBanner(): string {
-  return [
-    "### Missing docs/",
-    "> Source exists but `docs/` does not. Create baseline docs first:",
-    "> 1. `docs/system-architecture.md` — system architecture and flows",
-    "> 2. `docs/project-overview-pdr.md` — overview, goals, features",
-    '> 3. Write current hash to `docs/.sync_hash` via `git log -1 --format="%H" -- . ":(exclude)docs"`',
-  ].join("\n");
-}
-
-function buildStaleDocsBanner(currentHash: string, lastSyncHash: string): string {
-  return [
-    "### Docs sync needed",
-    `> Source changed (\`${currentHash}\`) since last docs sync (\`${lastSyncHash || "none"}\`).`,
-    `> 1. Review recent changes (\`git diff ${lastSyncHash} ${currentHash}\` or \`git log\`).`,
-    "> 2. Update architecture/code-standards docs and changelog as needed.",
-    `> 3. Write \`${currentHash}\` to \`docs/.sync_hash\` when done.`,
-  ].join("\n");
-}
-
-function writeBanner(cwd: string, banner: string | null): void {
-  const target = join(cwd, ".opencode", "session-banner.md");
-  const dir = dirname(target);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-
-  const existing = existsSync(target) ? readFileSync(target, "utf8") : "";
-  const pattern = new RegExp(`${BANNER_SECTION_START}[\\s\\S]*?${BANNER_SECTION_END}\\n?`);
-  const cleaned = existing.replace(pattern, "").trimEnd();
-
-  if (!banner) {
-    if (cleaned !== existing.trimEnd()) {
-      writeFileSync(target, cleaned ? `${cleaned}\n` : "");
-    }
-    return;
-  }
-
-  const block = [BANNER_SECTION_START, banner, BANNER_SECTION_END].join("\n");
-  const next = cleaned ? `${cleaned}\n\n${block}\n` : `${block}\n`;
-  writeFileSync(target, next);
-}
-
-function logCrash(error: unknown): void {
-  try {
-    const logDir = join(PLUGIN_DIR, ".logs");
-    if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
-    appendFileSync(
-      join(logDir, "hook-log.jsonl"),
-      JSON.stringify({
-        ts: new Date().toISOString(),
-        hook: "docs-sync",
-        status: "crash",
-        error: error instanceof Error ? error.message : String(error),
-      }) + "\n",
-    );
-  } catch {
-    // fail-open
-  }
-}
-
-export const DocsSync: Plugin = async ({ directory }) => ({
-  event: async ({ event }) => {
-    try {
-      if (event.type !== "session.created") return;
-
-      const cwd = directory;
-      const runtime = readRuntime(cwd);
-      if (runtime.docsSync === false) return;
-
-      if (!hasSourceCode(cwd)) {
-        writeBanner(cwd, null);
-        return;
-      }
-
-      const docsDir = resolveDocsDir(cwd, runtime);
-
-      if (!existsSync(docsDir)) {
-        const banner = buildMissingDocsBanner();
-        writeBanner(cwd, banner);
-        console.error(banner);
-        return;
-      }
-
-      const currentHash = currentSourceHash(cwd);
-      if (!currentHash) {
-        writeBanner(cwd, null);
-        return;
-      }
-
-      const syncFile = join(docsDir, ".sync_hash");
-      const lastSyncHash = existsSync(syncFile) ? readFileSync(syncFile, "utf8").trim() : "";
-
-      if (lastSyncHash === currentHash) {
-        writeBanner(cwd, null);
-        return;
-      }
-
-      const banner = buildStaleDocsBanner(currentHash, lastSyncHash);
-      writeBanner(cwd, banner);
-      console.error(banner);
-    } catch (error) {
-      logCrash(error);
-    }
-  },
-});

package/src/opencode/plugins/inspect-block.ts

@@ -1,164 +0,0 @@
-/**
- * Copyright (c) 2026 Haposoft. MIT License.
- *
- * OpenCode Plugin — inspect-block.ts
- *
- * Port of .claude/hooks/inspect-block.cjs.
- *
- * Behavior:
- * - Block reads/writes/globs/greps that target heavy directories (node_modules,
- *   .git, dist, build, .next, .venv, vendor, target, coverage, ...).
- * - Block excessively broad glob patterns (e.g. **\/* alone).
- * - Allow approved build/package-manager bash commands.
- *
- * Disable via `.opencode/runtime.json` { "inspect": { "enabled": false } }
- * or `.opencode/runtime.json` { "scout": { "enabled": false } }.
- */
-
-import type { Plugin } from "@opencode-ai/plugin";
-import { existsSync, readFileSync, mkdirSync, appendFileSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const BLOCKED_DIRS = [
-  "node_modules",
-  "dist",
-  "build",
-  ".next",
-  ".nuxt",
-  ".output",
-  "__pycache__",
-  ".venv",
-  "venv",
-  ".env",
-  "vendor",
-  "target",
-  ".git",
-  "coverage",
-  ".nyc_output",
-];
-
-const BROAD_GLOB = [/^\*\*\/\*$/, /^\*\*\.\w+$/, /^\*\*\/\*\.\w+$/];
-
-const ALLOWED_CMD =
-  /^(npm|pnpm|yarn|bun|npx|pnpx|bunx|tsc|vite|esbuild|webpack|rollup|turbo|nx|jest|vitest|eslint|prettier|go|cargo|make|mvn|gradle|dotnet|docker|kubectl|helm|python3?|pip|uv|deno|bundle|rake|php|composer|ruby|mix)\b/;
-const VENV_EXEC = /(^|[\/\\])\.?venv[\/\\](bin|Scripts)[\/\\]/;
-const VENV_CREATE = /^(python3?|py)\s+.*-m\s+venv\s+|^uv\s+venv(\s|$)/;
-
-const GATED_TOOLS = new Set(["read", "write", "edit", "glob", "grep", "bash"]);
-
-const PLUGIN_DIR = dirname(fileURLToPath(import.meta.url));
-
-function isAllowedCommand(cmd: string): boolean {
-  const stripped = cmd
-    .trim()
-    .replace(/^(\w+=\S+\s+)+/, "")
-    .replace(/^(sudo|env|time)\s+/, "")
-    .trim();
-  return ALLOWED_CMD.test(stripped) || VENV_EXEC.test(stripped) || VENV_CREATE.test(stripped);
-}
-
-function isBlockedPath(p: string): string | null {
-  const segments = p.replace(/\\/g, "/").split("/");
-  return segments.find((seg) => BLOCKED_DIRS.includes(seg)) ?? null;
-}
-
-function isBroadGlob(p: string): boolean {
-  return BROAD_GLOB.some((rule) => rule.test(p.trim()));
-}
-
-function extractPaths(tool: string, args: Record<string, unknown>): string[] {
-  const out: string[] = [];
-  if (!args) return out;
-
-  if (typeof args.filePath === "string") out.push(args.filePath);
-  if (typeof args.path === "string") out.push(args.path);
-  if (typeof args.pattern === "string" && tool === "glob") out.push(args.pattern);
-
-  if (tool === "bash" && typeof args.command === "string") {
-    const matches = args.command.match(/(?:cat|ls|find|head|tail)\s+(\S+)/g);
-    if (matches) {
-      for (const m of matches) {
-        const tail = m.trim().split(/\s+/).pop();
-        if (tail) out.push(tail);
-      }
-    }
-  }
-
-  return out.filter(Boolean);
-}
-
-function readRuntime(cwd: string): Record<string, any> {
-  try {
-    const file = join(cwd, ".opencode", "runtime.json");
-    return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
-  } catch {
-    return {};
-  }
-}
-
-function logCrash(error: unknown): void {
-  try {
-    const logDir = join(PLUGIN_DIR, ".logs");
-    if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
-    appendFileSync(
-      join(logDir, "hook-log.jsonl"),
-      JSON.stringify({
-        ts: new Date().toISOString(),
-        hook: "inspect-block",
-        status: "crash",
-        error: error instanceof Error ? error.message : String(error),
-      }) + "\n",
-    );
-  } catch {
-    // fail-open
-  }
-}
-
-export const InspectBlock: Plugin = async ({ directory }) => ({
-  "tool.execute.before": async (input, output) => {
-    try {
-      if (!GATED_TOOLS.has(input.tool)) return;
-
-      const runtime = readRuntime(directory);
-      if (runtime.scout?.enabled === false || runtime.inspect?.enabled === false) return;
-
-      const args = (output.args ?? {}) as Record<string, unknown>;
-
-      if (input.tool === "bash" && typeof args.command === "string") {
-        const cmds = args.command.split(/\s*(?:&&|\|\||;)\s*/).filter(Boolean);
-        if (cmds.every((c) => isAllowedCommand(c))) return;
-      }
-
-      if (input.tool === "glob" && typeof args.pattern === "string" && isBroadGlob(args.pattern)) {
-        throw new Error(
-          [
-            "SCOPE LIMIT EXCEEDED: Glob pattern is excessively broad",
-            `Requested Pattern: ${args.pattern}`,
-            "",
-            "Please narrow your scope (e.g., src/**/*.ts rather than **/*.ts).",
-          ].join("\n"),
-        );
-      }
-
-      const paths = extractPaths(input.tool, args);
-      for (const p of paths) {
-        const blocked = isBlockedPath(p);
-        if (blocked) {
-          throw new Error(
-            [
-              `SCOPE LIMIT EXCEEDED: Directory "${blocked}/" is explicitly forbidden`,
-              `Requested Path: ${p}`,
-              `Restricted zones: ${BLOCKED_DIRS.join(", ")}`,
-            ].join("\n"),
-          );
-        }
-      }
-    } catch (error) {
-      if (error instanceof Error && error.message.startsWith("SCOPE LIMIT EXCEEDED")) {
-        throw error;
-      }
-      logCrash(error);
-    }
-  },
-});

package/src/opencode/plugins/privacy-block.ts

@@ -1,182 +0,0 @@
-/**
- * Copyright (c) 2026 Haposoft. MIT License.
- *
- * OpenCode Plugin — privacy-block.ts
- *
- * Port of .claude/hooks/privacy-block.cjs to OpenCode plugin protocol.
- *
- * Behavior:
- * - Match tool input paths against RESTRICTED_PATTERNS.
- * - For `bash`: log warning and allow (caller may have user approval already).
- * - For other tools: throw with @@PRIVACY_PROMPT_START@@ marker payload so the
- *   assistant prompts the user before retrying via bash cat.
- *
- * Disable via `.opencode/runtime.json` { "privacyBlock": false }.
- */
-
-import type { Plugin } from "@opencode-ai/plugin";
-import { existsSync, readFileSync, mkdirSync, appendFileSync } from "node:fs";
-import { join, basename, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const RESTRICTED_PATTERNS: RegExp[] = [
-  /^\.env(\.|$)/i,
-  /^credentials/i,
-  /secrets?\.(ya?ml|json)$/i,
-  /\.pem$/i,
-  /\.key$/i,
-  /\.p12$/i,
-  /\.pfx$/i,
-  /^id_(rsa|ed25519|ecdsa|dsa)$/i,
-  /\.netrc$/i,
-  /\.pgpass$/i,
-  /kubeconfig/i,
-  /\.keystore$/i,
-  /\.jks$/i,
-  /auth\.json$/i,
-  /token(s)?\.json$/i,
-];
-
-const ALLOWED_EXEMPTIONS: RegExp[] = [/\.env\.(example|sample|template|test)$/i];
-
-const GATED_TOOLS = new Set(["read", "write", "edit", "glob", "grep", "bash"]);
-
-const PLUGIN_DIR = dirname(fileURLToPath(import.meta.url));
-
-function readRuntime(cwd: string): Record<string, unknown> {
-  try {
-    const file = join(cwd, ".opencode", "runtime.json");
-    return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
-  } catch {
-    return {};
-  }
-}
-
-function isSafe(filePath: string): boolean {
-  const base = basename(filePath);
-  return ALLOWED_EXEMPTIONS.some((rule) => rule.test(base) || rule.test(filePath));
-}
-
-function isSensitive(filePath: string): boolean {
-  const base = basename(filePath);
-  return RESTRICTED_PATTERNS.some((rule) => rule.test(base) || rule.test(filePath));
-}
-
-function extractBashPaths(command: string): string[] {
-  const paths: string[] = [];
-  const regex = /(?:cat|less|more|head|tail|source|\.)\s+(?:"([^"]+)"|'([^']+)'|([^\s]+))/g;
-  let match: RegExpExecArray | null;
-  while ((match = regex.exec(command)) !== null) {
-    const value = match[1] || match[2] || match[3];
-    if (value) paths.push(value);
-  }
-  return paths;
-}
-
-function extractPaths(tool: string, args: Record<string, unknown>): string[] {
-  const paths: string[] = [];
-  if (!args) return paths;
-
-  const filePath = typeof args.filePath === "string" ? args.filePath.trim() : "";
-  if (filePath) paths.push(filePath);
-
-  const path = typeof args.path === "string" ? args.path.trim() : "";
-  if (path) paths.push(path);
-
-  if (tool === "bash" && typeof args.command === "string") {
-    paths.push(...extractBashPaths(args.command));
-  }
-
-  return paths.filter(Boolean);
-}
-
-function formatBlockMessage(filePath: string): string {
-  const fileBase = basename(filePath);
-  const promptData = {
-    type: "PRIVACY_PROMPT",
-    file: filePath,
-    basename: fileBase,
-    question: {
-      header: "File Access",
-      text: `I need to read "${fileBase}" which may contain sensitive data (API keys, passwords, tokens). Do you approve?`,
-      options: [
-        {
-          label: "Yes, approve access",
-          description: `Allow reading ${fileBase} this time`,
-        },
-        {
-          label: "No, skip this file",
-          description: "Continue without accessing this file",
-        },
-      ],
-    },
-  };
-
-  return [
-    "NOTE: This is not an error. This block protects sensitive data.",
-    "",
-    "PRIVACY BLOCK: Sensitive file access requires user approval",
-    `File: ${filePath}`,
-    "",
-    "@@PRIVACY_PROMPT_START@@",
-    JSON.stringify(promptData, null, 2),
-    "@@PRIVACY_PROMPT_END@@",
-    "",
-    "OpenCode follow-up:",
-    `- If approved: use bash to read: cat "${filePath}"`,
-    "- If denied: continue without this file",
-  ].join("\n");
-}
-
-function logCrash(error: unknown): void {
-  try {
-    const logDir = join(PLUGIN_DIR, ".logs");
-    if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
-    appendFileSync(
-      join(logDir, "hook-log.jsonl"),
-      JSON.stringify({
-        ts: new Date().toISOString(),
-        hook: "privacy-block",
-        status: "crash",
-        error: error instanceof Error ? error.message : String(error),
-      }) + "\n",
-    );
-  } catch {
-    // fail-open
-  }
-}
-
-export const PrivacyBlock: Plugin = async ({ directory }) => ({
-  "tool.execute.before": async (input, output) => {
-    try {
-      if (!GATED_TOOLS.has(input.tool)) return;
-
-      const runtime = readRuntime(directory);
-      if (runtime.privacyBlock === false) return;
-
-      const args = (output.args ?? {}) as Record<string, unknown>;
-      const paths = extractPaths(input.tool, args);
-      if (paths.length === 0) return;
-
-      for (const filePath of paths) {
-        if (isSafe(filePath)) continue;
-        if (!isSensitive(filePath)) continue;
-
-        if (input.tool === "bash") {
-          console.error(
-            `WARN: Privacy-sensitive file access via bash allowed for approved follow-up: ${basename(filePath)}`,
-          );
-          return;
-        }
-
-        throw new Error(formatBlockMessage(filePath));
-      }
-    } catch (error) {
-      // Re-throw the privacy block error (intentional); only swallow programming errors.
-      if (error instanceof Error && error.message.includes("@@PRIVACY_PROMPT_START@@")) {
-        throw error;
-      }
-      logCrash(error);
-    }
-  },
-});

package/src/opencode/plugins/rules.ts

@@ -1,155 +0,0 @@
-/**
- * Copyright (c) 2026 Haposoft. MIT License.
- *
- * OpenCode Plugin — rules.ts
- *
- * Port of .claude/hooks/rules.cjs adapted to OpenCode.
- *
- * Claude's version injects a per-prompt rules reminder via stdout into
- * the UserPromptSubmit hook. OpenCode has no equivalent per-prompt
- * injection channel, so this plugin renders the same dynamic rules
- * (paths, docs.maxLoc, locale) on every session.created and upserts a
- * managed block inside the project AGENTS.md. OpenCode auto-loads
- * AGENTS.md as instructions on each session, so the rules reach the
- * model context at session start instead of per prompt.
- *
- * Static rules content already lives in AGENTS.md base template — this
- * plugin only refreshes the dynamic block so paths/locale stay in sync
- * with runtime.json.
- */
-
-import type { Plugin } from "@opencode-ai/plugin";
-import {
-  createHash,
-} from "node:crypto";
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  writeFileSync,
-} from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const PLUGIN_DIR = dirname(fileURLToPath(import.meta.url));
-const RULES_BLOCK_START = "<!-- CAFEKIT DYNAMIC RULES START -->";
-const RULES_BLOCK_END = "<!-- CAFEKIT DYNAMIC RULES END -->";
-
-function resolveProjectDir(directory?: string): string {
-  if (directory && existsSync(directory)) return directory;
-  return dirname(dirname(PLUGIN_DIR));
-}
-
-function readRuntime(cwd: string): Record<string, any> | null {
-  try {
-    const file = join(cwd, ".opencode", "runtime.json");
-    if (existsSync(file)) {
-      return JSON.parse(readFileSync(file, "utf8"));
-    }
-  } catch {
-    /* fail-open */
-    return null;
-  }
-  return null;
-}
-
-function reserveSession(cwd: string, sessionId?: string): boolean {
-  if (!sessionId) return false;
-  try {
-    const key = createHash("sha256").update(sessionId).digest("hex").slice(0, 16);
-    const file = join(cwd, ".opencode", "plugins", ".logs", `rules-${key}.json`);
-    mkdirSync(join(cwd, ".opencode", "plugins", ".logs"), { recursive: true });
-    writeFileSync(file, JSON.stringify({ sessionId }), { encoding: "utf8", flag: "wx", mode: 0o600 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function renderDynamicRules(cwd: string): string | null {
-  const runtime = readRuntime(cwd);
-  if (runtime === null) return null;
-  const thinkLang: string = runtime?.locale?.thinkingLanguage || "";
-  const respondLang: string = runtime?.locale?.responseLanguage || "";
-  const effectThink = thinkLang || (respondLang ? "en" : "");
-  const plansPath = join(cwd, runtime?.paths?.plans || "plans");
-  const docsPath = join(cwd, runtime?.paths?.docs || "docs");
-  const maxLoc: number = runtime?.docs?.maxLoc || 800;
-
-  const lines: string[] = [];
-  lines.push(RULES_BLOCK_START);
-  lines.push("");
-  lines.push("## CafeKit Session Rules (auto-refreshed)");
-  lines.push("");
-
-  const hasThink = effectThink && effectThink !== respondLang;
-  if (hasThink || respondLang) {
-    lines.push("### Language");
-    if (hasThink) lines.push(`- Thinking: Use ${effectThink} for reasoning.`);
-    if (respondLang) lines.push(`- Response: Respond in ${respondLang}.`);
-    lines.push("");
-  }
-
-  lines.push("### Rules");
-  lines.push(`- Markdown files: Plans → "${plansPath}/" | Docs → "${docsPath}/"`);
-  lines.push(
-    "- **DO NOT** create markdown files outside of those directories unless explicitly asked.",
-  );
-  lines.push(`- docs.maxLoc: ${maxLoc} lines max per doc file`);
-  lines.push("");
-  lines.push(RULES_BLOCK_END);
-
-  return lines.join("\n");
-}
-
-function upsertBlock(filePath: string, block: string): boolean {
-  if (!existsSync(filePath)) return false;
-  let content: string;
-  try {
-    content = readFileSync(filePath, "utf8");
-  } catch {
-    return false;
-  }
-
-  const startIdx = content.indexOf(RULES_BLOCK_START);
-  const endIdx = content.indexOf(RULES_BLOCK_END);
-
-  let next: string;
-  if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
-    const before = content.slice(0, startIdx);
-    const after = content.slice(endIdx + RULES_BLOCK_END.length);
-    next = `${before}${block}${after}`;
-  } else {
-    const sep = content.endsWith("\n") ? "" : "\n";
-    next = `${content}${sep}\n${block}\n`;
-  }
-
-  if (next === content) return false;
-  try {
-    writeFileSync(filePath, next);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export const RulesPlugin: Plugin = async ({ directory }) => {
-  const cwd = resolveProjectDir(directory);
-
-  const refresh = (sessionId?: string) => {
-    if (!reserveSession(cwd, sessionId)) return;
-    const agentsFile = join(cwd, "AGENTS.md");
-    const block = renderDynamicRules(cwd);
-    if (block) upsertBlock(agentsFile, block);
-  };
-
-  return {
-    event: async ({ event }) => {
-      if (event.type === "session.created") {
-        refresh(event.properties?.info?.id);
-      }
-    },
-  };
-};
-
-export default RulesPlugin;