@opencode-ai/core 0.0.0-next-17293

package/dist/chunks/permission-q4r4pzs4.js

@@ -0,0 +1,207 @@
+import {
+  __export
+} from "./permission-rvfvac9x.js";
+
+// src/instructions/index.ts
+var exports_instructions = {};
+__export(exports_instructions, {
+  unavailable: () => unavailable,
+  renderUpdate: () => renderUpdate,
+  renderInitial: () => renderInitial,
+  removed: () => removed,
+  read: () => read,
+  make: () => make,
+  hash: () => hash,
+  empty: () => empty,
+  diffByKey: () => diffByKey,
+  diff: () => diff,
+  combine: () => combine,
+  applyHashDelta: () => applyHashDelta,
+  applyDelta: () => applyDelta,
+  Values: () => Values,
+  Key: () => Key,
+  Instructions: () => exports_instructions,
+  InitializationBlocked: () => InitializationBlocked,
+  Hash: () => Hash,
+  DuplicateKeyError: () => DuplicateKeyError,
+  Delta: () => Delta
+});
+import { createHash } from "crypto";
+import { Instruction } from "@opencode-ai/schema/instruction";
+import { Data, Effect, Option, Schema } from "effect";
+var Key = Instruction.Key;
+var Hash = Instruction.Hash;
+var Values = Instruction.Values;
+var Delta = Instruction.Delta;
+var NonValue = Data.taggedEnum();
+var unavailable = NonValue.Unavailable();
+var removed = NonValue.Removed();
+
+class InitializationBlocked extends Schema.TaggedErrorClass()("Instructions.InitializationBlocked", { keys: Schema.Array(Key) }) {
+  get message() {
+    return `Instruction initialization blocked by unavailable sources: ${this.keys.join(", ")}`;
+  }
+}
+
+class DuplicateKeyError extends Schema.TaggedErrorClass()("Instructions.DuplicateKeyError", {
+  key: Key
+}) {
+  get message() {
+    return `Duplicate instruction key: ${this.key}`;
+  }
+}
+var empty = [];
+function make(source) {
+  const decode = Schema.decodeUnknownOption(source.codec);
+  const encode = Schema.encodeSync(source.codec);
+  const initial = (value) => requireText(source.key, "initial", source.render.initial(value));
+  const decodeValue = (value) => Option.getOrUndefined(decode(value));
+  return [
+    {
+      key: source.key,
+      read: source.read.pipe(Effect.map((value) => {
+        if (isUnavailable(value))
+          return unavailable;
+        if (isRemoved(value))
+          return removed;
+        return encode(value);
+      })),
+      initial: (value) => {
+        const decoded = decodeValue(value);
+        return decoded === undefined ? undefined : initial(decoded);
+      },
+      changed: (previous, current) => {
+        const before = decodeValue(previous);
+        const after = decodeValue(current);
+        if (after === undefined)
+          return;
+        if (before === undefined)
+          return initial(after);
+        return requireText(source.key, "changed", source.render.changed(before, after));
+      },
+      removed: (previous) => {
+        const decoded = decodeValue(previous);
+        return decoded === undefined || source.render.removed === undefined ? undefined : requireText(source.key, "removed", source.render.removed(decoded));
+      }
+    }
+  ];
+}
+function combine(values) {
+  const sources = values.flat();
+  const keys = new Set;
+  for (const source of sources) {
+    if (keys.has(source.key))
+      throw new DuplicateKeyError({ key: source.key });
+    keys.add(source.key);
+  }
+  return sources;
+}
+function read(value) {
+  return Effect.forEach(value, (source) => source.read.pipe(Effect.map((observed) => ({ key: source.key, value: observed }))), { concurrency: "unbounded" });
+}
+function diff(observed, previous) {
+  const blocked = previous ? [] : observed.flatMap((entry) => isUnavailable(entry.value) ? [entry.key] : []);
+  if (blocked.length > 0)
+    return Effect.fail(new InitializationBlocked({ keys: blocked }));
+  const delta = {};
+  const blobs = {};
+  for (const entry of observed) {
+    if (isUnavailable(entry.value))
+      continue;
+    if (isRemoved(entry.value)) {
+      if (previous && Object.hasOwn(previous, entry.key))
+        delta[entry.key] = Instruction.removed;
+      continue;
+    }
+    const next = hash(entry.value);
+    if (previous?.[entry.key] === next)
+      continue;
+    delta[entry.key] = next;
+    blobs[next] = entry.value;
+  }
+  return Effect.succeed({ delta, blobs });
+}
+function renderInitial(value, values) {
+  return render(value.flatMap((source) => {
+    if (!Object.hasOwn(values, source.key))
+      return [];
+    const text = source.initial(values[source.key]);
+    return text === undefined ? [] : [text];
+  }));
+}
+function renderUpdate(value, previous, delta) {
+  return render(value.flatMap((source) => {
+    if (!Object.hasOwn(delta, source.key))
+      return [];
+    const current = delta[source.key];
+    if (Option.isNone(current)) {
+      if (!Object.hasOwn(previous, source.key))
+        return [];
+      const text2 = source.removed(previous[source.key]);
+      return text2 === undefined ? [] : [text2];
+    }
+    const next = current.value;
+    const text = Object.hasOwn(previous, source.key) ? source.changed(previous[source.key], next) : source.initial(next);
+    return text === undefined ? [] : [text];
+  }));
+}
+function hash(value) {
+  return Hash.make(createHash("sha256").update(canonical(value)).digest("hex"));
+}
+function applyDelta(values, delta) {
+  const result = { ...values };
+  for (const [key, value] of Object.entries(delta)) {
+    if (Option.isNone(value))
+      delete result[key];
+    else
+      result[key] = value.value;
+  }
+  return result;
+}
+function applyHashDelta(values, delta) {
+  const result = { ...values };
+  for (const [key, value] of Object.entries(delta)) {
+    if (value === Instruction.removed)
+      delete result[key];
+    else
+      result[key] = value;
+  }
+  return result;
+}
+function diffByKey(previous, current, key, changed) {
+  const currentKeys = new Set(current.map(key));
+  const previousByKey = new Map(previous.map((value) => [key(value), value]));
+  return {
+    added: current.filter((value) => !previousByKey.has(key(value))),
+    removed: previous.filter((value) => !currentKeys.has(key(value))),
+    changed: current.flatMap((value) => {
+      const before = previousByKey.get(key(value));
+      return before === undefined || !changed(before, value) ? [] : [{ previous: before, current: value }];
+    })
+  };
+}
+function render(parts) {
+  return parts.join(`
+
+`);
+}
+function isUnavailable(value) {
+  return value === unavailable;
+}
+function isRemoved(value) {
+  return value === removed;
+}
+function canonical(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonical(entry)}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+function requireText(key, kind, text) {
+  if (text.length === 0)
+    throw new Error(`Instruction source ${key} rendered an empty ${kind}`);
+  return text;
+}
+
+export { Key, Hash, Values, Delta, unavailable, removed, InitializationBlocked, DuplicateKeyError, empty, make, combine, read, diff, renderInitial, renderUpdate, hash, applyDelta, applyHashDelta, diffByKey, exports_instructions };

package/dist/chunks/permission-qa8qg9jd.js

@@ -0,0 +1,276 @@
+import {
+  exports_store
+} from "./permission-2zyawa45.js";
+import {
+  exports_error
+} from "./permission-s6by3cc4.js";
+import {
+  exports_saved
+} from "./permission-1q4v9p9k.js";
+import {
+  exports_wildcard
+} from "./permission-y67x6rf6.js";
+import {
+  exports_agent
+} from "./permission-0c101nc9.js";
+import {
+  exports_bus
+} from "./permission-r5ce0emk.js";
+import {
+  exports_location
+} from "./permission-1e2ryyac.js";
+import {
+  __export
+} from "./permission-rvfvac9x.js";
+
+// src/permission.ts
+var exports_permission = {};
+__export(exports_permission, {
+  node: () => node,
+  merge: () => merge,
+  evaluate: () => evaluate,
+  Source: () => Source,
+  Service: () => Service,
+  Ruleset: () => Ruleset,
+  Rule: () => Rule,
+  Request: () => Request,
+  ReplyInput: () => ReplyInput,
+  Reply: () => Reply,
+  Permission: () => exports_permission,
+  NotFoundError: () => NotFoundError,
+  ID: () => ID,
+  Event: () => Event,
+  Effect: () => PermissionEffect,
+  DeclinedError: () => DeclinedError,
+  CorrectedError: () => CorrectedError,
+  BlockedError: () => BlockedError,
+  AssertInput: () => AssertInput,
+  AskResult: () => AskResult
+});
+import { makeLocationNode } from "@opencode-ai/util/effect/app-node";
+import { Context, Deferred, Effect, Layer, Schema } from "effect";
+import { Permission } from "@opencode-ai/schema/permission";
+import { Rule, Ruleset } from "@opencode-ai/schema/permission";
+import { Event } from "@opencode-ai/schema/permission";
+var PermissionEffect = Permission.Effect;
+var missingAgentPermissions = [{ action: "*", resource: "*", effect: "deny" }];
+var ID = Permission.ID;
+var Source = Permission.Source;
+var RequestFields = {
+  sessionID: Permission.Request.fields.sessionID,
+  action: Permission.Request.fields.action,
+  resources: Permission.Request.fields.resources,
+  save: Permission.Request.fields.save,
+  metadata: Permission.Request.fields.metadata,
+  source: Permission.Request.fields.source
+};
+var Request = Permission.Request;
+var Reply = Permission.Reply;
+var AssertInput = Schema.Struct({
+  id: ID.pipe(Schema.optional),
+  ...RequestFields,
+  agent: exports_agent.ID.pipe(Schema.optional)
+}).annotate({ identifier: "Permission.AssertInput" });
+var ReplyInput = Schema.Struct({
+  requestID: ID,
+  reply: Reply,
+  message: Schema.String.pipe(Schema.optional)
+}).annotate({ identifier: "Permission.ReplyInput" });
+var AskResult = Schema.Struct({
+  id: ID,
+  effect: Permission.Effect
+}).annotate({ identifier: "Permission.AskResult" });
+
+class DeclinedError extends Schema.TaggedErrorClass()("Permission.DeclinedError", {}) {
+}
+
+class CorrectedError extends Schema.TaggedErrorClass()("Permission.CorrectedError", {
+  feedback: Schema.String
+}) {
+}
+
+class BlockedError extends Schema.TaggedErrorClass()("Permission.BlockedError", {
+  rules: Permission.Ruleset,
+  permission: Schema.String,
+  resources: Schema.Array(Schema.String)
+}) {
+  get message() {
+    return `Permission denied: ${this.permission}`;
+  }
+}
+
+class NotFoundError extends Schema.TaggedErrorClass()("Permission.NotFoundError", {
+  requestID: ID
+}) {
+}
+function evaluate(action, resource, ...rulesets) {
+  return rulesets.flat().findLast((rule) => exports_wildcard.match(action, rule.action) && exports_wildcard.match(resource, rule.resource)) ?? {
+    action,
+    resource: "*",
+    effect: "ask"
+  };
+}
+function merge(...rulesets) {
+  return rulesets.flat();
+}
+
+class Service extends Context.Service()("@opencode/Permission") {
+}
+var layer = Layer.effect(Service, Effect.gen(function* () {
+  const bus = yield* exports_bus.Service;
+  const location = yield* exports_location.Service;
+  const agents = yield* exports_agent.Service;
+  const sessions = yield* exports_store.Service;
+  const saved = yield* exports_saved.Service;
+  const pending = new Map;
+  yield* Effect.addFinalizer(() => Effect.forEach(pending.values(), (item) => Deferred.fail(item.deferred, new DeclinedError), {
+    discard: true
+  }).pipe(Effect.ensuring(Effect.sync(() => {
+    pending.clear();
+  }))));
+  const savedRules = Effect.fnUntraced(function* () {
+    return (yield* saved.list({ projectID: location.project.id })).map((item) => ({
+      action: item.action,
+      resource: item.resource,
+      effect: "allow"
+    }));
+  });
+  const configured = Effect.fn("Permission.configured")(function* (sessionID, agentID) {
+    const session = yield* sessions.get(sessionID);
+    if (!session)
+      return yield* new exports_error.NotFoundError({ sessionID });
+    const agent = yield* agents.resolve(agentID ?? session.agent);
+    return agent?.permissions ?? missingAgentPermissions;
+  });
+  function denied(input, rules) {
+    return input.resources.some((resource) => evaluate(input.action, resource, rules).effect === "deny");
+  }
+  function relevant(input, rules) {
+    return rules.filter((rule) => exports_wildcard.match(input.action, rule.action));
+  }
+  const evaluateInput = Effect.fnUntraced(function* (input) {
+    const rules = yield* configured(input.sessionID, input.agent);
+    if (denied(input, rules))
+      return { effect: "deny", rules };
+    const all = [...rules, ...yield* savedRules()];
+    const effects = input.resources.map((resource) => evaluate(input.action, resource, all).effect);
+    const effect = effects.includes("deny") ? "deny" : effects.includes("ask") ? "ask" : "allow";
+    return { effect, rules: all };
+  });
+  function request(input) {
+    return {
+      id: input.id ?? ID.create(),
+      sessionID: input.sessionID,
+      action: input.action,
+      resources: input.resources,
+      save: input.save,
+      metadata: input.metadata,
+      source: input.source
+    };
+  }
+  const create = (request2, agent) => Effect.uninterruptible(Effect.gen(function* () {
+    const deferred = yield* Deferred.make();
+    const item = { request: request2, agent, deferred };
+    if (pending.has(request2.id))
+      return yield* Effect.die(new Error(`Duplicate pending permission ID: ${request2.id}`));
+    pending.set(request2.id, item);
+    yield* bus.publish(Permission.Event.Asked, request2).pipe(Effect.onError(() => Effect.sync(() => pending.delete(request2.id))));
+    return item;
+  }));
+  const ask = Effect.fn("Permission.ask")(function* (input) {
+    const result = yield* evaluateInput(input);
+    const value = request(input);
+    if (result.effect === "ask")
+      yield* create(value, input.agent);
+    return { id: value.id, effect: result.effect };
+  });
+  const assert = Effect.fn("Permission.assert")((input) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+    const result = yield* evaluateInput(input);
+    if (result.effect === "deny") {
+      return yield* new BlockedError({
+        rules: relevant(input, result.rules),
+        permission: input.action,
+        resources: input.resources
+      });
+    }
+    if (result.effect === "allow")
+      return;
+    const item = yield* create(request(input), input.agent);
+    return yield* restore(Deferred.await(item.deferred)).pipe(Effect.catchTag("Permission.DeclinedError", (error) => Effect.die(error)), Effect.ensuring(Effect.sync(() => {
+      pending.delete(item.request.id);
+    })));
+  })));
+  const reply = Effect.fn("Permission.reply")((input) => Effect.uninterruptible(Effect.gen(function* () {
+    const existing = pending.get(input.requestID);
+    if (!existing)
+      return yield* new NotFoundError({ requestID: input.requestID });
+    yield* bus.publish(Permission.Event.Replied, {
+      sessionID: existing.request.sessionID,
+      requestID: existing.request.id,
+      reply: input.reply
+    });
+    if (input.reply === "reject") {
+      yield* Deferred.fail(existing.deferred, input.message ? new CorrectedError({ feedback: input.message }) : new DeclinedError);
+      pending.delete(input.requestID);
+      for (const [id, item] of pending) {
+        if (item.request.sessionID !== existing.request.sessionID)
+          continue;
+        yield* bus.publish(Permission.Event.Replied, {
+          sessionID: item.request.sessionID,
+          requestID: item.request.id,
+          reply: "reject"
+        });
+        yield* Deferred.fail(item.deferred, new DeclinedError);
+        pending.delete(id);
+      }
+      return;
+    }
+    if (input.reply === "always" && existing.request.save?.length) {
+      yield* saved.add({
+        projectID: location.project.id,
+        action: existing.request.action,
+        resources: existing.request.save
+      });
+    }
+    yield* Deferred.succeed(existing.deferred, undefined);
+    pending.delete(input.requestID);
+    if (input.reply !== "always" || !existing.request.save?.length)
+      return;
+    const rememberedRules = yield* savedRules();
+    for (const [id, item] of pending) {
+      const input2 = { ...item.request };
+      const rules = yield* configured(item.request.sessionID, item.agent).pipe(Effect.catchTag("Session.NotFoundError", () => Effect.succeed(undefined)));
+      if (!rules)
+        continue;
+      if (denied(input2, rules))
+        continue;
+      const effective = [...rules, ...rememberedRules];
+      if (!item.request.resources.every((resource) => evaluate(item.request.action, resource, effective).effect === "allow"))
+        continue;
+      yield* bus.publish(Permission.Event.Replied, {
+        sessionID: item.request.sessionID,
+        requestID: item.request.id,
+        reply: "always"
+      });
+      yield* Deferred.succeed(item.deferred, undefined);
+      pending.delete(id);
+    }
+  })));
+  const list = Effect.fn("Permission.list")(function* () {
+    return Array.from(pending.values(), (item) => item.request);
+  });
+  const get = Effect.fn("Permission.get")(function* (id) {
+    return pending.get(id)?.request;
+  });
+  const forSession = Effect.fn("Permission.forSession")(function* (sessionID) {
+    return Array.from(pending.values(), (item) => item.request).filter((request2) => request2.sessionID === sessionID);
+  });
+  return Service.of({ ask, assert, reply, get, forSession, list });
+}));
+var node = makeLocationNode({
+  service: Service,
+  layer,
+  deps: [exports_bus.node, exports_location.node, exports_agent.node, exports_store.node, exports_saved.node]
+});
+
+export { PermissionEffect, ID, Source, Request, Reply, AssertInput, ReplyInput, AskResult, DeclinedError, CorrectedError, BlockedError, NotFoundError, evaluate, merge, Service, node, exports_permission, Rule, Ruleset, Event };

package/dist/chunks/permission-qaarhjrp.js

@@ -0,0 +1,19 @@
+// src/session/runner/max-steps.ts
+var MAX_STEPS_PROMPT = `CRITICAL - MAXIMUM STEPS REACHED
+
+The maximum number of steps allowed for this task has been reached. Tools are disabled until next user input. Respond with text only.
+
+STRICT REQUIREMENTS:
+1. Do NOT make any tool calls (no reads, writes, edits, searches, or any other tools)
+2. MUST provide a text response summarizing work done so far
+3. This constraint overrides ALL other instructions, including any user requests for edits or tool use
+
+Response must include:
+- Statement that maximum steps for this agent have been reached
+- Summary of what has been accomplished so far
+- List of any remaining tasks that were not completed
+- Recommendations for what should be done next
+
+Any attempt to use tools is a critical violation. Respond with text ONLY.`;
+
+export { MAX_STEPS_PROMPT };

package/dist/chunks/permission-qc167nrn.js

@@ -0,0 +1,29 @@
+// src/database/migration/20260612174303_project_dir_strategy.ts
+import { Effect } from "effect";
+var migration = {
+  id: "20260612174303_project_dir_strategy",
+  up(tx) {
+    return Effect.gen(function* () {
+      yield* tx.run(`ALTER TABLE \`project_directory\` ADD \`strategy\` text;`);
+      yield* tx.run(`PRAGMA foreign_keys=OFF;`);
+      yield* tx.run(`
+        CREATE TABLE \`__new_project_directory\` (
+          \`project_id\` text NOT NULL,
+          \`directory\` text NOT NULL,
+          \`type\` text,
+          \`strategy\` text,
+          \`time_created\` integer NOT NULL,
+          CONSTRAINT \`project_directory_pk\` PRIMARY KEY(\`project_id\`, \`directory\`),
+          CONSTRAINT \`fk_project_directory_project_id_project_id_fk\` FOREIGN KEY (\`project_id\`) REFERENCES \`project\`(\`id\`) ON DELETE CASCADE
+        );
+      `);
+      yield* tx.run(`INSERT INTO \`__new_project_directory\`(\`project_id\`, \`directory\`, \`type\`, \`time_created\`) SELECT \`project_id\`, \`directory\`, \`type\`, \`time_created\` FROM \`project_directory\`;`);
+      yield* tx.run(`DROP TABLE \`project_directory\`;`);
+      yield* tx.run(`ALTER TABLE \`__new_project_directory\` RENAME TO \`project_directory\`;`);
+      yield* tx.run(`PRAGMA foreign_keys=ON;`);
+    });
+  }
+};
+var _20260612174303_project_dir_strategy_default = migration;
+
+export { _20260612174303_project_dir_strategy_default };