@hybridlabor-api/aos 4.5.1 → 4.5.2

package/.opencode/plugins/bdb-aos.js

@@ -0,0 +1,171 @@
+/**
+ * BDB Agent OS (AOS) plugin for OpenCode.
+ *
+ * Implements:
+ * 1. tool.execute.before: Releases gatekeeper (go-gate). Guards outward-facing
+ *    or hard-to-reverse actions (git push, npm publish, npm version, rm -rf)
+ *    unless the user explicitly authorized it with the literal word "GO".
+ * 2. chat.message: Ambient memory injection (memB). Injects relevant project & user
+ *    memories as ephemeral context from ~/.MemBDB/memb.db via node:sqlite.
+ *
+ * Zero external runtime dependencies. Fails open on memory lookup, fails closed
+ * on unguarded destructive actions.
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const GUARDED_PATTERNS = [
+  /^\s*git\s+push\b/i,
+  /^\s*npm\s+publish\b/i,
+  /^\s*npm\s+version\b/i,
+  /^\s*rm\s+(-\w*[rR]\w*|--recursive)\b/i,
+];
+
+let lastHumanPrompt = '';
+
+function isGuardedCommand(cmd) {
+  if (typeof cmd !== 'string') return false;
+  return GUARDED_PATTERNS.some((re) => re.test(cmd));
+}
+
+function verifyGoAuthorized(lastPrompt) {
+  const trimmed = (lastPrompt || '').trim();
+  return trimmed.toUpperCase() === 'GO';
+}
+
+// Extract ambient memory from local memB database
+async function getMembContext(prompt, currentDir) {
+  const home = os.homedir();
+  const dbPath = path.join(home, '.MemBDB', 'memb.db');
+  if (!existsSync(dbPath)) return null;
+
+  try {
+    const { DatabaseSync } = await import('node:sqlite');
+    const db = new DatabaseSync(dbPath, { readOnly: true });
+    db.exec('PRAGMA busy_timeout = 3000;');
+
+    const contextItems = [];
+
+    // Standing persona facts
+    const personaFile = path.join(home, '.MemBDB', 'ambient-persona.txt');
+    if (existsSync(personaFile)) {
+      try {
+        for (const line of readFileSync(personaFile, 'utf8').split('\n')) {
+          const t = line.trim();
+          if (t && !t.startsWith('#')) contextItems.push(`- ${t}`);
+        }
+      } catch {}
+    }
+
+    // Resolve project ID candidate
+    let projectName = path.basename(currentDir);
+    const pkgPath = path.join(currentDir, 'package.json');
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        if (pkg?.name) projectName = pkg.name;
+      } catch {}
+    }
+
+    // Query project memories
+    try {
+      const sql = `
+        SELECT payload FROM memb_vectors
+        WHERE collection = 'bdb_agent_memory'
+          AND (
+            json_extract(payload, '$.project_id') = ?
+            OR json_extract(payload, '$.metadata.project_id') = ?
+            OR json_extract(payload, '$.project') = ?
+            OR json_extract(payload, '$.metadata.project') = ?
+          )
+        ORDER BY rowid DESC
+        LIMIT 3
+      `;
+      const rows = db.prepare(sql).all(projectName, projectName, projectName, projectName);
+      for (const r of rows) {
+        try {
+          const p = JSON.parse(r.payload);
+          const text = (p.memory || p.data || '').trim().replace(/\s+/g, ' ');
+          if (text.length > 10) {
+            contextItems.push(`- Project [${projectName}]: ${text.slice(0, 180)}`);
+          }
+        } catch {}
+      }
+    } catch {}
+
+    db.close();
+
+    if (contextItems.length === 0) return null;
+    return `[AOS Ambient Memory - memB]\n${contextItems.join('\n')}`;
+  } catch {
+    return null;
+  }
+}
+
+export default async function bdbAosPlugin(input) {
+  const directory = input.directory || process.cwd();
+
+  return {
+    'chat.message': async (msgInput, msgOutput) => {
+      // Capture the user prompt text for GO-gate verification
+      const textParts = (msgOutput.parts || []).filter((p) => p && p.type === 'text' && typeof p.text === 'string');
+      const fullText = textParts.map((p) => p.text).join('\n').trim();
+      if (fullText) {
+        lastHumanPrompt = fullText;
+      }
+
+      // Inject memB ambient memory
+      try {
+        const membContext = await getMembContext(fullText, directory);
+        if (membContext) {
+          msgOutput.parts.unshift({
+            id: `memb-${Date.now()}`,
+            sessionID: msgInput.sessionID,
+            messageID: msgInput.messageID || '',
+            type: 'text',
+            text: membContext,
+            synthetic: true,
+          });
+        }
+      } catch {}
+    },
+
+    'tool.execute.before': async (toolInput, toolOutput) => {
+      const toolName = (toolInput.tool || '').toLowerCase();
+      // Intercept bash, terminal, or command execution tools
+      if (toolName === 'bash' || toolName === 'terminal' || toolName === 'shell' || toolName === 'exec' || toolName === 'run_command') {
+        const cmd = toolOutput?.args?.command || toolOutput?.args?.cmd || toolOutput?.args?.script || '';
+        if (isGuardedCommand(cmd)) {
+          let authorized = verifyGoAuthorized(lastHumanPrompt);
+
+          // If last cached prompt wasn't GO, query recent session messages via OpenCode client as fallback
+          if (!authorized && input.client && toolInput.sessionID) {
+            try {
+              const res = await input.client.session.messages({ path: { id: toolInput.sessionID } });
+              const msgs = res?.data || [];
+              for (let i = msgs.length - 1; i >= 0; i--) {
+                const m = msgs[i];
+                if (m.role === 'user') {
+                  const parts = m.parts || [];
+                  const text = parts.filter((p) => p.type === 'text').map((p) => p.text).join('\n').trim();
+                  if (text) {
+                    authorized = (text.toUpperCase() === 'GO');
+                    break;
+                  }
+                }
+              }
+            } catch {}
+          }
+
+          if (!authorized) {
+            throw new Error(
+              `Blocked by BDB go-gate: Command "${cmd.slice(0, 80)}" is guarded and requires explicit authorization with the literal word "GO" before proceeding.`
+            );
+          }
+        }
+      }
+    },
+  };
+}

package/installer.js

@@ -3213,6 +3213,24 @@ function installGlobalHooks() {
         copyDirRecursiveSync(workflowsSrc, codexWorkflowsDir);
     }
     mergeCodexTomlHooks(path.join(homeDir, '.codex', 'config.toml'));
+
+    // 4. OpenCode CLI
+    const opencodeDir = process.platform === 'win32'
+        ? path.join(process.env.APPDATA || homeDir, 'opencode')
+        : path.join(homeDir, '.config', 'opencode');
+    const opencodePluginSrc = path.join(srcDir, '.opencode', 'plugins', 'bdb-aos.js');
+    if (fs.existsSync(opencodePluginSrc)) {
+        const opencodePluginsDir = path.join(opencodeDir, 'plugins');
+        const opencodePluginDest = path.join(opencodePluginsDir, 'bdb-aos.js');
+        try {
+            fs.mkdirSync(opencodePluginsDir, { recursive: true });
+            fs.copyFileSync(opencodePluginSrc, opencodePluginDest);
+            try { fs.chmodSync(opencodePluginDest, 0o644); } catch (e) { logDebug(e, 'chmod opencode plugin'); }
+            log.step(`Installed OpenCode plugin to ${opencodePluginDest}`);
+        } catch (e) {
+            log.warn(`Could not install OpenCode plugin: ${e.message}`);
+        }
+    }
 }
 
 // Merge the BDB hooks -- the two gates plus the memB ambient-memory hook --
@@ -4022,17 +4040,98 @@ async function universalHarnessSync(primaryMcpConfigPath) {
             const existing = readJsoncFile(targetPath);
             const data = existing && existing.mcp ? existing : Object.assign({}, existing || {}, { mcp: {} });
             if (masterMcpData.mcpServers) {
+                // OpenCode provider APIs (e.g. OpenAI-compatible, Console) enforce tool name length limits
+                // (e.g. max 64 chars) and context limits. Loading 20+ MCPs causes provider errors (e.g. 73-char tool names).
+                // OpenCode uses a slim profile: only core servers (memb_mcp, zavora_computer_use) are enabled by default.
+                const OPENCODE_DEFAULT_SLIM = new Set(['memb_mcp', 'zavora_computer_use']);
+                const existingMcp = existing && existing.mcp ? existing.mcp : {};
+                const hasExistingKeys = Object.keys(existingMcp).length > 0;
+
                 for (const [key, val] of Object.entries(masterMcpData.mcpServers)) {
-                    const cmd = Array.isArray(val.command) ? val.command : [val.command];
-                    const args = Array.isArray(val.args) ? val.args : [];
+                    const rawCmd = Array.isArray(val.command) ? val.command : [val.command];
+                    const rawArgs = Array.isArray(val.args) ? val.args : [];
+                    const fullCmd = [...rawCmd, ...rawArgs].map(c => {
+                        if (c === '__PYTHON_BIN__') {
+                            return process.platform === 'win32'
+                                ? path.join(homeDir, '.gemini', 'config', 'mcps', 'memb-mcp', '.venv', 'Scripts', 'python.exe')
+                                : path.join(homeDir, '.gemini', 'config', 'mcps', 'memb-mcp', '.venv', 'bin', 'python');
+                        }
+                        return c;
+                    });
+
+                    const existingEntry = existingMcp[key];
+
+                    // If existing config is intentionally slimmed (has keys, but omitted this one), don't resurrect unless in slim set
+                    if (hasExistingKeys && !existingEntry && !OPENCODE_DEFAULT_SLIM.has(key)) {
+                        continue;
+                    }
+
+                    // Preserve user's explicit enabled/disabled setting; otherwise default to true only for slim set
+                    const isEnabled = existingEntry && typeof existingEntry.enabled === 'boolean'
+                        ? existingEntry.enabled
+                        : OPENCODE_DEFAULT_SLIM.has(key);
+
+                    let envObj = val.environment || val.env;
+                    if (envObj) {
+                        envObj = Object.assign({}, envObj);
+                        for (const [eKey, eVal] of Object.entries(envObj)) {
+                            if (eVal === '__GEMINI_API_KEY__') {
+                                envObj[eKey] = '${GEMINI_API_KEY}';
+                            }
+                        }
+                    }
+
                     data.mcp[key] = {
                         type: "local",
-                        command: [...cmd, ...args],
-                        enabled: true,
-                        ...(val.environment || val.env ? { environment: val.environment || val.env } : {})
+                        command: fullCmd,
+                        enabled: isEnabled,
+                        ...(envObj ? { environment: envObj } : {})
                     };
                 }
             }
+
+            // Wire BDB AOS Plugin for OpenCode
+            const opencodeDir = path.dirname(targetPath);
+            const pluginsDir = path.join(opencodeDir, 'plugins');
+            const pluginFile = path.join(pluginsDir, 'bdb-aos.js');
+            const pluginSrc = path.join(srcDir, '.opencode', 'plugins', 'bdb-aos.js');
+
+            try {
+                if (fs.existsSync(pluginSrc)) {
+                    fs.mkdirSync(pluginsDir, { recursive: true });
+                    fs.copyFileSync(pluginSrc, pluginFile);
+                    try { fs.chmodSync(pluginFile, 0o644); } catch (e) { logDebug(e, 'chmod pluginFile'); }
+                }
+            } catch (pluginErr) {
+                log.warn(`Could not install OpenCode plugin: ${pluginErr.message}`);
+            }
+
+            // Register plugin in opencode.jsonc if plugin file exists
+            if (fs.existsSync(pluginFile)) {
+                if (!Array.isArray(data.plugin)) {
+                    data.plugin = [];
+                }
+                const pluginPathNormalized = pluginFile.replace(/\\/g, '/');
+                const alreadyRegistered = data.plugin.some(p => {
+                    const str = typeof p === 'string' ? p : (Array.isArray(p) ? p[0] : '');
+                    return str.includes('bdb-aos');
+                });
+                if (!alreadyRegistered) {
+                    data.plugin.push(pluginPathNormalized);
+                }
+            }
+
+            // Register skills paths for OpenCode
+            if (!data.skills || typeof data.skills !== 'object') {
+                data.skills = { paths: [".agents/skills"] };
+            } else if (Array.isArray(data.skills.paths)) {
+                if (!data.skills.paths.includes(".agents/skills")) {
+                    data.skills.paths.push(".agents/skills");
+                }
+            } else {
+                data.skills.paths = [".agents/skills"];
+            }
+
             fs.mkdirSync(path.dirname(targetPath), { recursive: true });
             fs.writeFileSync(targetPath, JSON.stringify(data, null, 2), { mode: 0o600 });
             try { fs.chmodSync(targetPath, 0o600); } catch (e) { logDebug(e, 'chmod targetPath'); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.5.1",
+  "version": "4.5.2",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "engines": {