@kal-elsam/kairo-runtime 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -5,6 +5,39 @@ Historical entries below may reference the legacy `@kal-elsam/harness` package n
 
 ## Unreleased
 
+## 0.26.0 — 2026-09-19 (Kairo Runtime)
+
+Minor release. ASK is now ready for every real automatic adapter.
+
+### Changed
+
+- ASK can now call OpenCode Go/Zen too — via Kairo's own real,
+  verified read-only agent ("kairo-ask"), idempotently ensured in the
+  user's global `opencode.json` (merged non-destructively). OpenCode's
+  real CLI has no flag-driven read-only mode, so this is what makes a
+  genuinely portable, config-independent guarantee possible. Live-
+  verified: it answers correctly and genuinely refuses to write a file
+  when asked directly.
+- Every real automatic PROJECT TEAM adapter (Codex, Claude, Cursor,
+  OpenCode Go, OpenCode Zen) is now ASK-capable — a role's real
+  assignment routes to ASK regardless of which one it lands on.
+
+## 0.25.0 — 2026-09-19 (Kairo Runtime)
+
+Minor release. Cursor joins ASK.
+
+### Changed
+
+- ASK can now call Cursor, via its real, documented read-only mode
+  (`cursor-agent --mode ask`, verified live) — never combined with
+  `--force`/`--yolo`. PROJECT TEAM roles assigned to Cursor (Architect/
+  Builder/Debugger in this project's own team) are now real ASK
+  candidates, not just execution candidates.
+- OpenCode (Go/Zen) stays excluded from ASK: verified its CLI has no
+  portable, flag-driven read-only mode — its permission model is
+  project/user-config-driven, so a read-only call can't be guaranteed
+  safe across different installs.
+
 ## 0.24.0 — 2026-09-18 (Kairo Runtime)
 
 Minor release. ASK mode joins PROJECT TEAM.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kal-elsam/kairo-runtime",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Kairo Runtime — local agent operating system for Codex, Cursor, Claude, Pi, Engram, and Graphify.",
   "type": "module",
   "homepage": "https://github.com/Kal-elSam/harness#readme",

package/src/global/conversation/project-strategy.js

@@ -21,14 +21,23 @@ import { ROLE_CAPABILITIES } from "../intelligence/role-profiles.js";
 import { computeRoleEvaluations } from "../intelligence/capability-scoring.js";
 
 // The Bootstrap Analyst investigates read-only via askProvider
-// (intelligence/quick-ask.js), which only actually supports these two
+// (intelligence/quick-ask.js), which only actually supports these
 // providers today — offering any other real candidate as an "alternative"
 // here would be a menu item Kairo can't actually run. Exported: ASK mode's
 // own real-time routing (service.js's planAsk) needs this exact same real
 // constraint when it tries to route a plain question through a PROJECT
-// TEAM role — a role assigned to, say, opencode-go is a real, valid team
-// assignment, just not one askProvider can call.
-export const ASK_SUPPORTED_ADAPTERS = new Set(["codex", "claude"]);
+// TEAM role.
+//
+// Pure CAPABILITY (can askProvider invoke this adapter's CLI at all?),
+// never a cost-risk judgment — OpenCode Zen's real PAYG billing risk is
+// deliberately NOT re-litigated here; that's checkCandidate's own job
+// (it hard-excludes opencode-zen unconditionally), and the real
+// eligibility this module receives already reflects that exclusion. Both
+// opencode-go and opencode-zen genuinely run through the same real
+// askOpencode call (Kairo's own read-only agent — see
+// intelligence/opencode-ask-agent.js), same as real execution routing
+// already treats capability and cost-risk as two separate layers.
+export const ASK_SUPPORTED_ADAPTERS = new Set(["codex", "claude", "cursor", "opencode-go", "opencode-zen"]);
 
 /**
  * The Bootstrap Analyst as a temporary, read-only WORKFLOW — deliberately

package/src/global/intelligence/opencode-ask-agent.js

@@ -0,0 +1,74 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { writeAtomicJson } from "../runtime/write-atomic-json.js";
+
+// OpenCode's real CLI (`opencode run --help`) has no flag-driven read-only
+// mode — its permission model lives only in opencode.json (verified via
+// its own published schema, https://opencode.ai/config.json, and a real
+// working precedent already present in this machine's own global config:
+// gentle-ai/sdd's "explore" agent, which uses this exact same
+// bash/edit/task/write-deny shape to stay read-only). So a genuinely
+// portable read-only ASK call needs Kairo to own one real agent entry in
+// the user's GLOBAL opencode.json — never per-project (would pollute
+// every repo it touches) — merged in non-destructively and never
+// overwriting anything else already there.
+export const KAIRO_ASK_AGENT_NAME = "kairo-ask";
+
+// No "model" field on purpose — the real model comes from askOpencode's
+// own `--model` CLI flag per call, exactly like askCodex/askClaude/
+// askCursor already do; this agent only ever fixes the PERMISSION shape.
+// No "read" key: the same real, working "explore" agent precedent above
+// carries no explicit "read" entry either — omitted means allowed.
+//
+// Deliberately NO "__managed_by" marker (unlike the sibling "explore"
+// agent's convention this was modeled on) — verified live that it isn't
+// a real AgentConfig property at all: the real opencode.ai/config.json
+// schema never defines it, and a live `opencode run` call with it present
+// failed outright ("Unsupported parameter(s): `__managed_by`" from the
+// real upstream API, which apparently receives it verbatim). Ownership is
+// tracked by the unique key name (KAIRO_ASK_AGENT_NAME) instead.
+export const KAIRO_ASK_AGENT_CONFIG = Object.freeze({
+  description: "Kairo's own real, read-only agent for ASK mode — investigates and answers, never edits, writes, or runs shell commands.",
+  hidden: true,
+  mode: "primary",
+  permission: Object.freeze({ bash: "deny", edit: "deny", task: "deny", write: "deny" })
+});
+
+function deepEqual(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+
+export function resolveOpencodeConfigPath(homeDir = homedir()) {
+  return join(homeDir, ".config", "opencode", "opencode.json");
+}
+
+/**
+ * Idempotently ensures the real, global opencode.json carries Kairo's own
+ * read-only "kairo-ask" agent — merged non-destructively (every other real
+ * key, including every other agent, is preserved byte-for-byte) and only
+ * ever written when actually missing or drifted, never on every call.
+ * A missing config file is created fresh with just $schema + this agent —
+ * never treated as an error (a real, common first-run state).
+ * @param {{homeDir?: string, readFileImpl?: Function, writeAtomicJsonImpl?: Function}} [deps]
+ * @returns {Promise<{changed: boolean, configPath: string}>}
+ */
+export async function ensureKairoAskAgent({
+  homeDir = homedir(), readFileImpl = readFile, writeAtomicJsonImpl = writeAtomicJson
+} = {}) {
+  const configPath = resolveOpencodeConfigPath(homeDir);
+  let config = { $schema: "https://opencode.ai/config.json" };
+  try {
+    const raw = await readFileImpl(configPath, "utf8");
+    config = JSON.parse(raw);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  const existing = config.agent?.[KAIRO_ASK_AGENT_NAME];
+  if (deepEqual(existing, KAIRO_ASK_AGENT_CONFIG)) {
+    return { changed: false, configPath };
+  }
+  const updated = { ...config, agent: { ...(config.agent ?? {}), [KAIRO_ASK_AGENT_NAME]: KAIRO_ASK_AGENT_CONFIG } };
+  await writeAtomicJsonImpl(configPath, updated);
+  return { changed: true, configPath };
+}

package/src/global/intelligence/quick-ask.js

@@ -3,6 +3,8 @@ import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { buildClaudeExecutionEnv } from "../runtime/execution-adapters/claude.js";
+import { ensureKairoAskAgent, KAIRO_ASK_AGENT_NAME } from "./opencode-ask-agent.js";
+import { toRuntimeModelRef } from "./transport-registry.js";
 
 // A real, read-only question -> answer call — no task, no plan, no
 // approval gate. This spends real provider usage (unlike the zero-cost
@@ -33,6 +35,22 @@ function buildCodexExecutionEnv(sourceEnv = process.env) {
   return env;
 }
 
+// Same real scrubbing principle as Codex/Claude above — CURSOR_API_KEY/
+// CURSOR_API_ENDPOINT are cursor-agent's own documented real auth env
+// vars (verified via `cursor-agent -p --help`), never a guess.
+const CURSOR_SAFE_ENV_KEYS = Object.freeze([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE",
+  "TMPDIR", "TERM", "CURSOR_API_KEY", "CURSOR_API_ENDPOINT", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+  "http_proxy", "https_proxy", "no_proxy", "NODE_EXTRA_CA_CERTS"
+]);
+function buildCursorExecutionEnv(sourceEnv = process.env) {
+  const env = Object.create(null);
+  for (const key of CURSOR_SAFE_ENV_KEYS) {
+    if (sourceEnv[key] != null && sourceEnv[key] !== "") env[key] = sourceEnv[key];
+  }
+  return env;
+}
+
 function unknown(error) {
   return { status: "error", answer: null, error: String(error) };
 }
@@ -102,6 +120,146 @@ function askClaude({ question, model, cwd, spawn, timeoutMs, env }) {
   });
 }
 
+/**
+ * cursor-agent's own real, documented read-only mode (verified via
+ * `cursor-agent -p --help`): "ask: Q&A style for explanations and
+ * questions (read-only)" — never combined with --force/--yolo, which
+ * would grant real write/shell access. A real invalid-model failure
+ * (verified live) exits non-zero with a plain-text error on stderr, no
+ * JSON at all — unlike Claude's/Codex's own failure shapes, so a failed
+ * JSON parse here reports the real stderr text, never a generic guess.
+ * @param {{question:string, model:string|null, cwd:string, spawn:Function, timeoutMs:number, env:object}} args
+ */
+function askCursor({ question, model, cwd, spawn, timeoutMs, env }) {
+  const args = ["-p", question, "--mode", "ask", "--output-format", "json"];
+  if (model) args.push("--model", model);
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn("cursor-agent", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+    } catch (error) {
+      resolve(unknown(error?.message ?? error));
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let finished = false;
+    const clearIdleTimer = armIdleTimeout(child, timeoutMs, () => finish(unknown(`cursor-agent idle-timed out after ${timeoutMs}ms with no output`)));
+    function finish(result) {
+      if (finished) return;
+      finished = true;
+      clearIdleTimer();
+      try { child.kill?.(); } catch { /* best effort */ }
+      resolve(result);
+    }
+    child.stdout?.on("data", (chunk) => { stdout += chunk; });
+    child.stderr?.on("data", (chunk) => { stderr += chunk; });
+    child.once?.("error", (error) => finish(unknown(error?.message ?? error)));
+    child.once?.("close", (code) => {
+      let parsed;
+      try { parsed = JSON.parse(stdout); } catch {
+        return finish(unknown(stderr.trim() || `cursor-agent exited ${code} with no parseable output`));
+      }
+      if (parsed?.is_error === true || typeof parsed?.result !== "string") {
+        return finish(unknown(parsed?.result ?? stderr.trim() ?? "cursor-agent returned no answer"));
+      }
+      finish({ status: "answered", answer: parsed.result, error: null });
+    });
+  });
+}
+
+// Same real scrubbing principle as the others — OPENCODE_API_KEY is
+// opencode's own documented real auth env var (types.js's
+// OPENCODE_API_KEY_ENV).
+const OPENCODE_SAFE_ENV_KEYS = Object.freeze([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE",
+  "TMPDIR", "TERM", "OPENCODE_API_KEY", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+  "http_proxy", "https_proxy", "no_proxy", "NODE_EXTRA_CA_CERTS"
+]);
+function buildOpencodeExecutionEnv(sourceEnv = process.env) {
+  const env = Object.create(null);
+  for (const key of OPENCODE_SAFE_ENV_KEYS) {
+    if (sourceEnv[key] != null && sourceEnv[key] !== "") env[key] = sourceEnv[key];
+  }
+  return env;
+}
+
+/**
+ * OpenCode's real CLI has no flag-driven read-only mode (verified via
+ * `opencode run --help`) — its permission model lives only in
+ * opencode.json, so this always runs against Kairo's own real, verified
+ * read-only agent (see opencode-ask-agent.js's own doc — live-verified
+ * both that it genuinely blocks a real write attempt and that
+ * `--agent`/`--model` compose correctly), ensured to exist in the user's
+ * global config before every call (cheap idempotent check — no real
+ * write unless actually missing or drifted).
+ *
+ * Verified live (`opencode run --agent kairo-ask --format json`): the
+ * real NDJSON stream emits `type: "text"` events carrying the real
+ * answer in `part.text` (possibly across multiple steps — accumulated in
+ * order) and a real `type: "error"` event on failure, both handled
+ * per-line as chunks arrive, mirroring the same idle-reset principle as
+ * every other ask call here.
+ * @param {{question:string, model:string|null, cwd:string, spawn:Function, timeoutMs:number, env:object}} args
+ */
+async function askOpencode({ question, model, cwd, spawn, timeoutMs, env, ensureAgent = ensureKairoAskAgent }) {
+  try {
+    await ensureAgent();
+  } catch (error) {
+    return unknown(`could not ensure Kairo's read-only OpenCode agent: ${error?.message ?? error}`);
+  }
+  const args = ["run", "--agent", KAIRO_ASK_AGENT_NAME, "--format", "json"];
+  if (model) args.push("--model", model);
+  args.push(question);
+
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn("opencode", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+    } catch (error) {
+      resolve(unknown(error?.message ?? error));
+      return;
+    }
+    let buffer = "";
+    const answerParts = [];
+    let realError = null;
+    let stderr = "";
+    let finished = false;
+    const clearIdleTimer = armIdleTimeout(child, timeoutMs, () => finish(unknown(`opencode run idle-timed out after ${timeoutMs}ms with no output`)));
+    function finish(result) {
+      if (finished) return;
+      finished = true;
+      clearIdleTimer();
+      try { child.kill?.(); } catch { /* best effort */ }
+      resolve(result);
+    }
+    function handleLine(line) {
+      let parsed;
+      try { parsed = JSON.parse(line); } catch { return; }
+      if (parsed?.type === "text" && typeof parsed?.part?.text === "string") {
+        answerParts.push(parsed.part.text);
+      } else if (parsed?.type === "error") {
+        realError = parsed.error?.data?.message ?? parsed.error?.name ?? "opencode run returned a real error event";
+      }
+    }
+    child.stdout?.on("data", (chunk) => {
+      buffer += String(chunk);
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) if (line.trim()) handleLine(line.trim());
+    });
+    child.stderr?.on("data", (chunk) => { stderr += chunk; });
+    child.once?.("error", (error) => finish(unknown(error?.message ?? error)));
+    child.once?.("close", (code) => {
+      if (buffer.trim()) handleLine(buffer.trim());
+      if (realError) return finish(unknown(realError));
+      const answer = answerParts.join("").trim();
+      if (!answer) return finish(unknown(stderr.trim() || `opencode run exited ${code} with no real text output`));
+      finish({ status: "answered", answer, error: null });
+    });
+  });
+}
+
 /** @param {{question:string, model:string|null, cwd:string, spawn:Function, timeoutMs:number, env:object}} args */
 async function askCodex({ question, model, cwd, spawn, timeoutMs, env }) {
   let outDir;
@@ -158,18 +316,39 @@ async function askCodex({ question, model, cwd, spawn, timeoutMs, env }) {
 
 /**
  * Asks the given provider a real, read-only question and returns its real
- * answer text. Supports Codex and Claude today; any other provider yields
- * an honest "unsupported" result rather than a guess.
+ * answer text — every real automatic PROJECT TEAM adapter today (Codex,
+ * Claude, Cursor, OpenCode Go, OpenCode Zen); any other provider yields
+ * an honest "unsupported" result rather than a guess. OpenCode's real CLI
+ * has no flag-driven read-only mode (verified via `opencode run --help`:
+ * `--auto` only ever loosens permissions further, never restricts them),
+ * so it always runs against Kairo's own real, verified read-only agent
+ * instead (see opencode-ask-agent.js) — a project/user-config-independent
+ * guarantee, never relying on whatever the local opencode.json happens to
+ * already allow.
  * @param {object} args
- * @param {"codex"|"claude"} args.provider
+ * @param {"codex"|"claude"|"cursor"|"opencode-go"|"opencode-zen"} args.provider
  * @param {string} args.question
  * @param {string|null} [args.model]
  * @param {string} args.cwd
  */
 export async function askProvider({
-  provider, question, model = null, cwd, spawn = defaultSpawn, timeoutMs = DEFAULT_TIMEOUT_MS, sourceEnv = process.env
+  provider, question, model = null, cwd, spawn = defaultSpawn, timeoutMs = DEFAULT_TIMEOUT_MS, sourceEnv = process.env,
+  ensureOpencodeAskAgent = ensureKairoAskAgent
 }) {
   if (provider === "claude") return askClaude({ question, model, cwd, spawn, timeoutMs, env: buildClaudeExecutionEnv(sourceEnv) });
   if (provider === "codex") return askCodex({ question, model, cwd, spawn, timeoutMs, env: buildCodexExecutionEnv(sourceEnv) });
+  if (provider === "cursor") return askCursor({ question, model, cwd, spawn, timeoutMs, env: buildCursorExecutionEnv(sourceEnv) });
+  if (provider === "opencode-go" || provider === "opencode-zen") {
+    // The real catalog stores bare model ids (see opencode-models.js's
+    // normalizeModel) — the CLI needs the real, fully-qualified
+    // "opencode-go/<id>" (or "opencode/<id>" for Zen) ref to
+    // deterministically route to the intended product, exactly like
+    // service.js's executePlan already does for real task execution.
+    const runtimeModel = model ? toRuntimeModelRef(provider === "opencode-go" ? "go" : "zen", model) : null;
+    return askOpencode({
+      question, model: runtimeModel, cwd, spawn, timeoutMs, env: buildOpencodeExecutionEnv(sourceEnv),
+      ensureAgent: ensureOpencodeAskAgent
+    });
+  }
   return { status: "unsupported", answer: null, error: `ASK is not supported for provider "${provider}" yet.` };
 }

package/src/global/observability/codex-models.js

@@ -89,7 +89,7 @@ export async function readCodexModels({
     child.once?.("close", () => { if (!finished) finish(unknown("codex app-server closed before model list")); });
 
     writeRequest(child, 1, "initialize", {
-      clientInfo: { name: "kairo", title: "Kairo", version: "0.24.0" },
+      clientInfo: { name: "kairo", title: "Kairo", version: "0.26.0" },
       capabilities: {}
     });
   });

package/src/global/observability/codex-usage.js

@@ -151,7 +151,7 @@ export async function readCodexUsage({
     child.once?.("close", () => { if (!finished) finish(unknown("codex app-server closed before rate limits")); });
 
     writeRequest(child, 1, "initialize", {
-      clientInfo: { name: "kairo", title: "Kairo", version: "0.24.0" },
+      clientInfo: { name: "kairo", title: "Kairo", version: "0.26.0" },
       capabilities: {}
     });
   });