@otto-assistant/bridge 0.4.92

package/src/otto/branding.ts

@@ -0,0 +1,23 @@
+/**
+ * Otto branding overrides
+ *
+ * These values can be used throughout the distribution
+ * to customize the CLI appearance and messaging.
+ */
+export const OTTO_BRANDING = {
+  /** Display name shown in UI */
+  name: "Otto",
+  /** Short description */
+  tagline: "AI agent distribution",
+  /** Organization URL */
+  homepage: "https://github.com/otto-assistant/otto",
+  /** Version of the otto distribution (updated by CI) */
+  ottoVersion: "0.1.0",
+} as const
+
+/**
+ * Check if running as Otto distribution
+ */
+export function isOttoDistribution(): boolean {
+  return true // This file only exists in the Otto fork
+}

package/src/otto/index.ts

@@ -0,0 +1,22 @@
+/**
+ * Otto distribution extensions
+ *
+ * Custom branding, features, and integrations for the Otto AI distribution.
+ * This module is imported by the upstream entry point.
+ * Upstream code is NOT modified beyond a single import line at the end of cli.ts.
+ */
+export { OTTO_BRANDING } from "./branding.js"
+
+/**
+ * Otto-specific configuration for the distribution
+ */
+export const OTTO_CONFIG = {
+  /** GitHub organization */
+  org: "otto-assistant",
+  /** Upstream repository */
+  upstream: "remorses/kimaki",
+  /** Distribution name */
+  distributionName: "Otto",
+  /** Homepage */
+  homepage: "https://github.com/otto-assistant/otto",
+} as const

package/src/parse-permission-rules.test.ts

@@ -0,0 +1,127 @@
+// Tests for parsePermissionRules() from opencode.ts
+import { describe, test, expect } from 'vitest'
+import { parsePermissionRules } from './opencode.js'
+
+describe('parsePermissionRules', () => {
+  test('simple tool:action format', () => {
+    expect(parsePermissionRules(['bash:deny'])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "deny",
+          "pattern": "*",
+          "permission": "bash",
+        },
+      ]
+    `)
+  })
+
+  test('multiple rules', () => {
+    expect(parsePermissionRules(['bash:deny', 'edit:deny', 'read:allow'])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "deny",
+          "pattern": "*",
+          "permission": "bash",
+        },
+        {
+          "action": "deny",
+          "pattern": "*",
+          "permission": "edit",
+        },
+        {
+          "action": "allow",
+          "pattern": "*",
+          "permission": "read",
+        },
+      ]
+    `)
+  })
+
+  test('tool:pattern:action format', () => {
+    expect(parsePermissionRules(['bash:git *:allow'])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "allow",
+          "pattern": "git *",
+          "permission": "bash",
+        },
+      ]
+    `)
+  })
+
+  test('wildcard permission', () => {
+    expect(parsePermissionRules(['*:deny'])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "deny",
+          "pattern": "*",
+          "permission": "*",
+        },
+      ]
+    `)
+  })
+
+  test('case-insensitive action', () => {
+    expect(parsePermissionRules(['bash:DENY', 'edit:Allow'])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "deny",
+          "pattern": "*",
+          "permission": "bash",
+        },
+        {
+          "action": "allow",
+          "pattern": "*",
+          "permission": "edit",
+        },
+      ]
+    `)
+  })
+
+  test('trims whitespace', () => {
+    expect(parsePermissionRules([' bash : deny '])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "deny",
+          "pattern": "*",
+          "permission": "bash",
+        },
+      ]
+    `)
+  })
+
+  test('skips invalid entries', () => {
+    expect(parsePermissionRules(['', 'bash', 'bash:invalid', ':deny'])).toMatchInlineSnapshot(`[]`)
+  })
+
+  test('handles non-array input defensively', () => {
+    expect(parsePermissionRules(undefined)).toMatchInlineSnapshot(`[]`)
+    expect(parsePermissionRules(null)).toMatchInlineSnapshot(`[]`)
+    expect(parsePermissionRules('bash:deny')).toMatchInlineSnapshot(`[]`)
+    expect(parsePermissionRules(123)).toMatchInlineSnapshot(`[]`)
+  })
+
+  test('handles non-string array items', () => {
+    expect(parsePermissionRules([123, null, 'bash:deny'])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "deny",
+          "pattern": "*",
+          "permission": "bash",
+        },
+      ]
+    `)
+  })
+
+  test('ask action', () => {
+    expect(parsePermissionRules(['webfetch:ask'])).toMatchInlineSnapshot(`
+      [
+        {
+          "action": "ask",
+          "pattern": "*",
+          "permission": "webfetch",
+        },
+      ]
+    `)
+  })
+})

package/src/patch-text-parser.ts

@@ -0,0 +1,107 @@
+// Shared apply_patch text parsing utilities.
+// Used by diff-patch-plugin.ts (file path extraction for snapshots) and
+// message-formatting.ts (per-file addition/deletion counts for Discord display).
+//
+// The apply_patch tool uses three path header formats:
+//   *** Add File: path    — new file
+//   *** Update File: path — existing file edit
+//   *** Delete File: path — file removal
+//   *** Move to: path     — rename destination
+//   --- a/path / +++ b/path — unified diff headers (fallback)
+
+/**
+ * Extract all file paths referenced in a patchText string.
+ * Handles custom apply_patch headers, move targets, and unified diff headers.
+ * Returns deduplicated paths.
+ */
+export function extractPatchFilePaths(patchText: string): string[] {
+  const custom = [
+    ...patchText.matchAll(
+      /^\*\*\* (?:Add|Update|Delete) File:\s+(.+)$/gm,
+    ),
+  ].map((m) => {
+    return (m[1] ?? '').trim()
+  })
+  const moved = [
+    ...patchText.matchAll(/^\*\*\* Move to:\s+(.+)$/gm),
+  ].map((m) => {
+    return (m[1] ?? '').trim()
+  })
+  const unified = [
+    ...patchText.matchAll(/^(?:---|\+\+\+) [ab]\/(.+)$/gm),
+  ].map((m) => {
+    return (m[1] ?? '').trim()
+  })
+  const all = [...custom, ...moved, ...unified].filter(Boolean)
+  return all.filter((v, i, a) => {
+    return a.indexOf(v) === i
+  })
+}
+
+/**
+ * Parse a patchText string and count additions/deletions per file.
+ * Patch format uses `*** Add File:`, `*** Update File:`, `*** Delete File:` headers,
+ * with diff lines prefixed by `+` (addition) or `-` (deletion) inside `@@` hunks.
+ */
+export function parsePatchFileCounts(
+  patchText: string,
+): Map<string, { additions: number; deletions: number }> {
+  const counts = new Map<string, { additions: number; deletions: number }>()
+  const lines = patchText.split('\n')
+  let currentFile = ''
+  let currentType = ''
+  let inHunk = false
+
+  for (const line of lines) {
+    const addMatch = line.match(/^\*\*\* Add File:\s*(.+)/)
+    const updateMatch = line.match(/^\*\*\* Update File:\s*(.+)/)
+    const deleteMatch = line.match(/^\*\*\* Delete File:\s*(.+)/)
+
+    if (addMatch || updateMatch || deleteMatch) {
+      const match = addMatch || updateMatch || deleteMatch
+      currentFile = (match?.[1] ?? '').trim()
+      currentType = addMatch ? 'add' : updateMatch ? 'update' : 'delete'
+      counts.set(currentFile, { additions: 0, deletions: 0 })
+      inHunk = false
+      continue
+    }
+
+    if (line.startsWith('@@')) {
+      inHunk = true
+      continue
+    }
+
+    if (line.startsWith('*** ')) {
+      inHunk = false
+      continue
+    }
+
+    if (!currentFile) {
+      continue
+    }
+
+    const entry = counts.get(currentFile)
+    if (!entry) {
+      continue
+    }
+
+    if (currentType === 'add') {
+      // all content lines in Add File are additions
+      if (line.length > 0 && !line.startsWith('*** ')) {
+        entry.additions++
+      }
+    } else if (currentType === 'delete') {
+      // all content lines in Delete File are deletions
+      if (line.length > 0 && !line.startsWith('*** ')) {
+        entry.deletions++
+      }
+    } else if (inHunk) {
+      if (line.startsWith('+')) {
+        entry.additions++
+      } else if (line.startsWith('-')) {
+        entry.deletions++
+      }
+    }
+  }
+  return counts
+}

package/src/plugin-logger.ts

@@ -0,0 +1,68 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import util from 'node:util'
+import { sanitizeSensitiveText, sanitizeUnknownValue } from './privacy-sanitizer.js'
+
+let pluginLogFilePath: string | null = null
+
+export function setPluginLogFilePath(dataDir: string): void {
+  pluginLogFilePath = path.join(dataDir, 'kimaki.log')
+}
+
+function formatArg(arg: unknown): string {
+  if (typeof arg === 'string') {
+    return sanitizeSensitiveText(arg, { redactPaths: false })
+  }
+  const safeArg = sanitizeUnknownValue(arg, { redactPaths: false })
+  return util.inspect(safeArg, { colors: false, depth: 4 })
+}
+
+export function formatPluginErrorWithStack(error: unknown): string {
+  if (error instanceof Error) {
+    return sanitizeSensitiveText(
+      error.stack ?? `${error.name}: ${error.message}`,
+      { redactPaths: false },
+    )
+  }
+  if (typeof error === 'string') {
+    return sanitizeSensitiveText(error, { redactPaths: false })
+  }
+
+  const safeError = sanitizeUnknownValue(error, { redactPaths: false })
+  return sanitizeSensitiveText(util.inspect(safeError, { colors: false, depth: 4 }), {
+    redactPaths: false,
+  })
+}
+
+function writeToFile(level: string, prefix: string, args: unknown[]) {
+  if (!pluginLogFilePath) {
+    return
+  }
+  const timestamp = new Date().toISOString()
+  const message = `[${timestamp}] [${level}] [${prefix}] ${args.map(formatArg).join(' ')}\n`
+  try {
+    fs.appendFileSync(pluginLogFilePath, message)
+  } catch {
+    // Plugin logging must never break the OpenCode plugin process.
+  }
+}
+
+export function createPluginLogger(prefix: string) {
+  return {
+    log: (...args: unknown[]) => {
+      writeToFile('LOG', prefix, args)
+    },
+    info: (...args: unknown[]) => {
+      writeToFile('INFO', prefix, args)
+    },
+    warn: (...args: unknown[]) => {
+      writeToFile('WARN', prefix, args)
+    },
+    error: (...args: unknown[]) => {
+      writeToFile('ERROR', prefix, args)
+    },
+    debug: (...args: unknown[]) => {
+      writeToFile('DEBUG', prefix, args)
+    },
+  }
+}

package/src/privacy-sanitizer.ts

@@ -0,0 +1,142 @@
+// Sensitive data redaction helpers for logs and telemetry payloads.
+// Redacts common secrets, identifiers, emails, and can optionally redact paths.
+
+const CORE_SENSITIVE_REPLACEMENTS: Array<{
+  pattern: RegExp
+  replacement: string
+}> = [
+  {
+    pattern: /\bBearer\s+[A-Za-z0-9._-]{10,}\b/gi,
+    replacement: 'Bearer [REDACTED]',
+  },
+  {
+    pattern: /\bsk-[A-Za-z0-9]{16,}\b/g,
+    replacement: '[REDACTED_OPENAI_KEY]',
+  },
+  {
+    pattern: /\bAIza[0-9A-Za-z_-]{20,}\b/g,
+    replacement: '[REDACTED_GOOGLE_KEY]',
+  },
+  {
+    pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,
+    replacement: '[REDACTED_GITHUB_TOKEN]',
+  },
+  {
+    pattern:
+      /([?&](?:token|api[_-]?key|key|secret|password|authorization)=)[^&\s]+/gi,
+    replacement: '$1[REDACTED]',
+  },
+  {
+    pattern:
+      /(\b(?:token|api[_-]?key|secret|password|authorization)\b\s*[:=]\s*")([^"]+)(")/gi,
+    replacement: '$1[REDACTED]$3',
+  },
+  {
+    pattern:
+      /(\b(?:token|api[_-]?key|secret|password|authorization)\b\s*[:=]\s*)([^\s,;]+)/gi,
+    replacement: '$1[REDACTED]',
+  },
+]
+
+const PATH_REPLACEMENTS: Array<{
+  pattern: RegExp
+  replacement: string
+}> = [
+  {
+    pattern: /\/(?:Users|home)\/[^/\s]+\/[^\s'"`)]*/g,
+    replacement: '[REDACTED_PATH]',
+  },
+  {
+    pattern: /[A-Za-z]:\\[^\s'"`)]*/g,
+    replacement: '[REDACTED_PATH]',
+  },
+]
+
+export function sanitizeSensitiveText(
+  value: string,
+  { redactPaths = false }: { redactPaths?: boolean } = {},
+): string {
+  const replacements = redactPaths
+    ? [...CORE_SENSITIVE_REPLACEMENTS, ...PATH_REPLACEMENTS]
+    : CORE_SENSITIVE_REPLACEMENTS
+  return replacements.reduce((current, entry) => {
+    return current.replace(entry.pattern, entry.replacement)
+  }, value)
+}
+
+export function sanitizeUnknownValue(
+  value: unknown,
+  {
+    depth = 0,
+    seen = new WeakSet<object>(),
+    redactPaths = false,
+  }: {
+    depth?: number
+    seen?: WeakSet<object>
+    redactPaths?: boolean
+  } = {},
+): unknown {
+  if (depth > 8) {
+    return '[REDACTED_DEPTH_LIMIT]'
+  }
+
+  if (typeof value === 'string') {
+    return sanitizeSensitiveText(value, { redactPaths })
+  }
+
+  if (
+    typeof value === 'number' ||
+    typeof value === 'boolean' ||
+    value === null ||
+    value === undefined
+  ) {
+    return value
+  }
+
+  if (value instanceof Date) {
+    return value.toISOString()
+  }
+
+  if (value instanceof Error) {
+    const sanitizedStack = value.stack
+      ? sanitizeSensitiveText(value.stack, { redactPaths })
+      : undefined
+    return {
+      name: value.name,
+      message: sanitizeSensitiveText(value.message, { redactPaths }),
+      stack: sanitizedStack,
+      cause: sanitizeUnknownValue(value.cause, {
+        depth: depth + 1,
+        seen,
+        redactPaths,
+      }),
+    }
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item) => {
+      return sanitizeUnknownValue(item, { depth: depth + 1, seen, redactPaths })
+    })
+  }
+
+  if (typeof value === 'object') {
+    if (seen.has(value)) {
+      return '[REDACTED_CIRCULAR]'
+    }
+    seen.add(value)
+
+    const sanitizedEntries = Object.entries(value).map(([key, entryValue]) => {
+      return [
+        key,
+        sanitizeUnknownValue(entryValue, {
+          depth: depth + 1,
+          seen,
+          redactPaths,
+        }),
+      ]
+    })
+    return Object.fromEntries(sanitizedEntries)
+  }
+
+  return sanitizeSensitiveText(String(value), { redactPaths })
+}