@plainconceptsplatform/agent-harness 3.8.0 → 3.8.2

package/cli/steps/copy/agents.js

@@ -2,7 +2,7 @@ import fse from 'fs-extra'
 import path from 'path'
 import { fileURLToPath } from 'url'
 import { info, success, warn } from '../../utils/exec.js'
-import { ContractError, loadContract } from '../../../harness/.opencode/scripts/platform-contract.mjs'
+import { ContractError, isTemplateSource, loadContract } from '../../../harness/.opencode/scripts/platform-contract.mjs'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const agentsContent = await fse.readJson(path.resolve(__dirname, '../../presets/agents-content.json'))
@@ -74,7 +74,7 @@ function replaceBetween(content, start, end, replacement) {
   return content.replace(pattern, () => (body ? `${start}\n${body}\n${end}` : `${start}\n${end}`))
 }
 
-export function reuseBlock(contract) {
+export function reuseBlock(contract, templateSource = false) {
   const { docs = [], packages = [], names = [] } = contract?.reuse ?? {}
   if (!docs.length && !packages.length && !names.length) return ''
   const code = list => list.map(item => `\`${item}\``).join(', ')
@@ -86,13 +86,14 @@ export function reuseBlock(contract) {
     ...(docs.length ? [`- Never design something new before reading ${code(docs)}.`] : []),
     ...(packages.length ? [`- Never re-implement an export of ${code(packages)}; import it.`] : []),
     ...(names.length ? [`- Never write your own ${code(names)}; reuse the existing one.`] : []),
-    `- Never edit a path listed under \`owned\`. Ask for the change at ${contract.source.changes}, or add a dated exception to \`${contract.exceptions}\`.`,
+    ...(templateSource ? [] : [`- Never edit a path listed under \`owned\`. Ask for the change at ${contract.source.changes}, or add a dated exception to \`${contract.exceptions}\`.`]),
   ].join('\n')
 }
 
 function contractBlock(cwd) {
   try {
-    return reuseBlock(loadContract(cwd))
+    const contract = loadContract(cwd)
+    return reuseBlock(contract, isTemplateSource(cwd, contract))
   } catch (err) {
     if (!(err instanceof ContractError)) throw err
     warn(`${err.message} The "Reuse before you build" block in AGENTS.md was left as it was.`)

package/harness/.opencode/plugins/pc-system-reminders.js

@@ -18,7 +18,7 @@ import { execFile } from "node:child_process"
 import fs from "node:fs/promises"
 import path from "node:path"
 import { promisify } from "node:util"
-import { ContractError, describeOwner, isOwned, loadContract } from "../scripts/platform-contract.mjs"
+import { ContractError, describeOwner, isOwned, isTemplateSource, loadContract } from "../scripts/platform-contract.mjs"
 
 const GUARDRAILS_SKILL = "pc-guardrails-generic"
 const TIER_SUFFIX = /\.(?:build|fast|plan)$/
@@ -210,7 +210,7 @@ async function checkPlatform(event, root) {
     return deny(event, error.message, "Fix that file before editing anything else: until it reads, nothing can tell which files the template owns.")
   }
   const owned = contract ? event.resources.filter(target => isOwnedTarget(target, root, contract)) : []
-  if (!owned.length || await syncInProgress(root, contract.sync.marker)) return
+  if (!owned.length || isTemplateSource(root, contract) || await syncInProgress(root, contract.sync.marker)) return
   const { owner, fix } = describeOwner(contract)
   return deny(event, `\`${owned[0]}\` is ${owner}.`, fix)
 }

package/harness/.opencode/scripts/check-diff.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { commentBlocks, countLines, isGenerated, kindOf, lineKinds, slopFindings, testStats } from './code-rules.mjs'
-import { ContractError, describeOwner, isOwned, loadContract, nameKey, reusableNames } from './platform-contract.mjs'
+import { ContractError, describeOwner, isOwned, isTemplateSource, loadContract, nameKey, reusableNames } from './platform-contract.mjs'
 
 export const DEFAULT_LIMITS = {
   commentRatio: 0.1,
@@ -213,6 +213,7 @@ export function trackedFiles(root, baseline) {
 
 // A diff that changes the sync marker is a template sync, the one change allowed to rewrite owned files.
 export function platformViolations(root, base, paths, contract) {
+  if (isTemplateSource(root, contract)) return []
   const touched = new Set(untrackedFiles(root))
   for (const { status, from, to } of changes(root, base)) {
     touched.add(to)

package/harness/.opencode/scripts/platform-contract.mjs

@@ -1,3 +1,4 @@
+import { execFileSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
 
@@ -8,50 +9,102 @@ const LEGACY_MANIFEST = '.platform/manifest'
 
 export class ContractError extends Error {}
 
-const escapeRegExp = text => text.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')
-
-export function globToRegExp(glob) {
-  const directory = glob.endsWith('/')
-  const body = glob.replace(/\/$/, '')
-  const anchored = body.includes('/')
-  const pattern = body.replace(/^\//, '')
-  let source = ''
-  for (let i = 0; i < pattern.length; i++) {
-    const c = pattern[i]
-    if (c === '*' && pattern[i + 1] === '*' && (i === 0 || pattern[i - 1] === '/')) {
-      if (i + 2 === pattern.length) {
-        source += '.*'
-        i += 1
-        continue
-      }
-      if (pattern[i + 2] === '/') {
-        source += '(?:.*/)?'
-        i += 2
-        continue
-      }
+function bracket(segment, start) {
+  const end = segment.indexOf(']', start + 2)
+  if (end === -1) return null
+  let body = segment.slice(start + 1, end)
+  const negated = body[0] === '!' || body[0] === '^'
+  if (negated) body = body.slice(1)
+  const ranges = []
+  for (let i = 0; i < body.length; i++) {
+    const from = body[i] === '\\' && i + 1 < body.length ? body[++i] : body[i]
+    let to = from
+    if (body[i + 1] === '-' && i + 2 < body.length) {
+      i += 2
+      to = body[i] === '\\' && i + 1 < body.length ? body[++i] : body[i]
     }
+    ranges.push([from, to])
+  }
+  return { token: { negated, ranges }, end }
+}
+
+const STAR = Symbol('*')
+
+function segmentTokens(segment) {
+  const tokens = []
+  for (let i = 0; i < segment.length; i++) {
+    const c = segment[i]
+    const set = c === '[' ? bracket(segment, i) : null
     if (c === '*') {
-      source += '[^/]*'
-      while (pattern[i + 1] === '*') i++
-    } else if (c === '?') source += '[^/]'
-    else if (c === '[' && pattern.indexOf(']', i + 2) !== -1) {
-      const end = pattern.indexOf(']', i + 2)
-      source += `[${pattern.slice(i + 1, end).replace(/^!/, '^')}]`
-      i = end
-    } else if (c === '\\' && i + 1 < pattern.length) source += escapeRegExp(pattern[++i])
-    else source += escapeRegExp(c)
+      if (tokens.at(-1) !== STAR) tokens.push(STAR)
+    } else if (c === '?') tokens.push({ negated: true, ranges: [] })
+    else if (set) {
+      tokens.push(set.token)
+      i = set.end
+    } else tokens.push(c === '\\' && i + 1 < segment.length ? segment[++i] : c)
+  }
+  return tokens
+}
+
+const tokenMatches = (token, c) => typeof token === 'string'
+  ? token === c
+  : token.ranges.some(([from, to]) => from <= c && c <= to) !== token.negated
+
+function matchSegment(tokens, text) {
+  let t = 0
+  let i = 0
+  let star = -1
+  let resume = 0
+  while (i < text.length) {
+    if (tokens[t] === STAR) {
+      star = t++
+      resume = i
+    } else if (t < tokens.length && tokenMatches(tokens[t], text[i])) {
+      t++
+      i++
+    } else if (star !== -1) {
+      t = star + 1
+      i = ++resume
+    } else return false
   }
-  return new RegExp(`^${anchored ? '' : '(?:.*/)?'}${source}${directory ? '/.*' : '(?:/.*)?'}$`)
+  while (tokens[t] === STAR) t++
+  return t === tokens.length
+}
+
+// gitwildmatch over `/` segments; a RegExp built from contract text is a blocking finding in the apps' Semgrep scan.
+export function compileGlob(glob) {
+  const directory = glob.endsWith('/')
+  const body = directory ? glob.slice(0, -1) : glob
+  const segments = (body.startsWith('/') ? body.slice(1) : body).split('/')
+  return { anchored: body.includes('/'), directory, segments: segments.map(s => (s === '**' ? s : segmentTokens(s))) }
+}
+
+function matchFrom(segments, s, parts, p, directory) {
+  if (s === segments.length) return parts.length - p >= (directory ? 1 : 0)
+  if (segments[s] !== '**') return p < parts.length && matchSegment(segments[s], parts[p]) && matchFrom(segments, s + 1, parts, p + 1, directory)
+  for (let next = s + 1 === segments.length ? p + 1 : p; next <= parts.length; next++) {
+    if (matchFrom(segments, s + 1, parts, next, directory)) return true
+  }
+  return false
+}
+
+export function matchGlob(compiled, file) {
+  const { anchored, directory, segments } = typeof compiled === 'string' ? compileGlob(compiled) : compiled
+  const parts = file.split('/')
+  for (let start = 0; start < (anchored ? 1 : parts.length); start++) {
+    if (matchFrom(segments, 0, parts, start, directory)) return true
+  }
+  return false
 }
 
 const toRules = globs => globs.map(glob => {
   const negated = glob.startsWith('!')
-  return { negated, regex: globToRegExp(negated ? glob.slice(1) : glob) }
+  return { negated, glob: compileGlob(negated ? glob.slice(1) : glob) }
 })
 
 function matchesRules(rules, file) {
   let matched = false
-  for (const rule of rules) if (rule.regex.test(file)) matched = !rule.negated
+  for (const rule of rules) if (matchGlob(rule.glob, file)) matched = !rule.negated
   return matched
 }
 
@@ -216,6 +269,32 @@ export function loadContract(root) {
   return { ...contract, rules: toRules(contract.owned), exceptionList: Array.isArray(entries) ? entries.filter(isMapping) : [] }
 }
 
+export function normalizeRepoUrl(url) {
+  return String(url ?? '')
+    .trim()
+    .replace(/^git\+/, '')
+    .replace(/^gh:/, 'https://github.com/')
+    .replace(/^ssh:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?\//, 'https://$1/')
+    .replace(/^git@([^:]+):/, 'https://$1/')
+    .replace(/^(https?:\/\/)[^@/]+@/, '$1')
+    .replace(/^http:\/\//, 'https://')
+    .replace(/\/+$/, '')
+    .replace(/\.git$/, '')
+    .toLowerCase()
+}
+
+// The template repository carries its own contract, and its owned paths are its own to change.
+export function isTemplateSource(root, contract) {
+  if (!contract?.source.url) return false
+  let origin
+  try {
+    origin = execFileSync('git', ['config', '--get', 'remote.origin.url'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+  } catch {
+    return false
+  }
+  return normalizeRepoUrl(origin) !== '' && normalizeRepoUrl(origin) === normalizeRepoUrl(contract.source.url)
+}
+
 const localDate = (now = new Date()) =>
   `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`
 
@@ -223,7 +302,7 @@ export function isOwned(contract, file, today = localDate()) {
   const relative = file.replace(/\\/g, '/').replace(/^\.\//, '')
   if (!matchesRules(contract.rules, relative)) return false
   return !contract.exceptionList.some(e =>
-    isText(e.path) && /^\d{4}-\d{2}-\d{2}$/.test(String(e.expires ?? '')) && e.expires >= today && globToRegExp(e.path).test(relative))
+    isText(e.path) && /^\d{4}-\d{2}-\d{2}$/.test(String(e.expires ?? '')) && e.expires >= today && matchGlob(e.path, relative))
 }
 
 export function describeOwner(contract) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/agent-harness",
-  "version": "3.8.0",
+  "version": "3.8.2",
   "description": "Installs the Plain Concepts Platform Harness into any codebase, and keeps it up to date. Wires OpenCode, OpenSpec, codegraph, and agentmemory into a multi-agent workflow that runs on native parallel subagents.",
   "keywords": [
     "opencode",