@rynfar/meridian 1.64.0 → 1.65.1

package/plugin/meridian.ts

@@ -14,10 +14,19 @@
  *   { "plugin": ["/absolute/path/to/plugin/meridian.ts"] }
  */
 
-type AgentInput = string | { name?: string; mode?: string }
+import {
+  PRIORITY_ATTESTATION_HEADER,
+  createPriorityAttestation,
+  deleteHeader,
+  getHeader,
+  setHeader,
+} from "./priority-attestation"
+
+type AgentInput = string | { name?: string; mode?: string; hidden?: boolean }
+type ConfigAgent = { mode?: string; hidden?: boolean }
 
 type Plugin = (input: any) => Promise<{
-  config?: (cfg: { agent?: Record<string, { mode?: string } | undefined> }) => Promise<void> | void
+  config?: (cfg: { agent?: Record<string, ConfigAgent | undefined> }) => Promise<void> | void
   "chat.headers"?: (
     input: {
       sessionID: string
@@ -26,7 +35,7 @@ type Plugin = (input: any) => Promise<{
       // passes just the agent NAME as a string. Handle both.
       agent: AgentInput
       model: { providerID: string }
-      message: { id: string }
+      message: { id: string; sessionID?: string; time?: { created?: number } }
     },
     output: { headers: Record<string, string> }
   ) => Promise<void>
@@ -50,10 +59,33 @@ const BUILTIN_AGENT_MODES: Record<string, string> = {
   compaction: "subagent",
 }
 
-const MeridianPlugin: Plugin = async () => {
-  // Modes from the merged config, per plugin instance. Replaced wholesale on
-  // every config-hook fire so a reload can't leave stale entries behind.
-  let configModes: Record<string, string> = {}
+const INTERNAL_AGENT_IDS = new Set(["title", "summary", "compaction"])
+const ROOT_SESSION_CACHE_MAX = 256
+const ROOT_SESSION_CACHE_TTL_MS = 5_000
+const LOOKUP_TIMEOUT_MS = 250
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+async function withTimeout<T>(pending: Promise<T>, timeoutMs: number): Promise<T | undefined> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const timedOut = new Promise<undefined>((resolve) => {
+    timer = setTimeout(() => resolve(undefined), timeoutMs)
+    timer.unref?.()
+  })
+  try {
+    return await Promise.race([pending, timedOut])
+  } finally {
+    if (timer) clearTimeout(timer)
+  }
+}
+
+const MeridianPlugin: Plugin = async (pluginInput) => {
+  // Agent traits from the merged config, per plugin instance. Replaced
+  // wholesale on reload so routing eligibility cannot use stale visibility.
+  let configAgents: Record<string, ConfigAgent> = {}
+  const rootSessionCache = new Map<string, { expiresAt: number; pending: Promise<boolean> }>()
 
   const resolve = (agent: AgentInput): { name: string; mode: string } => {
     if (typeof agent === "object" && agent !== null) {
@@ -63,38 +95,111 @@ const MeridianPlugin: Plugin = async () => {
     // OpenCode >= 1.17: agent is the name string. Resolve the mode from the
     // merged config (captured in the config hook) + built-in defaults.
     const name = String(agent)
-    return { name, mode: configModes[name] ?? BUILTIN_AGENT_MODES[name] ?? "primary" }
+    return { name, mode: configAgents[name]?.mode ?? BUILTIN_AGENT_MODES[name] ?? "primary" }
+  }
+
+  const isStrictVisiblePrimary = (agent: AgentInput): boolean => {
+    const name = typeof agent === "string" ? agent : agent.name
+    if (!name || INTERNAL_AGENT_IDS.has(name)) return false
+    if (typeof agent === "object") {
+      return agent.mode === "primary" && agent.hidden !== true
+    }
+    const configured = configAgents[name]
+    if (configured) return configured.mode === "primary" && configured.hidden !== true
+    return BUILTIN_AGENT_MODES[name] === "primary"
+  }
+
+  const isRootSession = async (sessionID: string): Promise<boolean> => {
+    const cached = rootSessionCache.get(sessionID)
+    if (cached && cached.expiresAt > Date.now()) return cached.pending
+    const pending = (async (): Promise<boolean> => {
+      if (!isRecord(pluginInput) || !isRecord(pluginInput.client)) return false
+      const sessionApi = pluginInput.client.session
+      if (!isRecord(sessionApi) || typeof sessionApi.get !== "function") return false
+      const controller = new AbortController()
+      try {
+        const lookup = Promise.resolve(Reflect.apply(sessionApi.get, sessionApi, [
+          { path: { id: sessionID }, signal: controller.signal },
+        ]) as unknown)
+        const result = await withTimeout(lookup, LOOKUP_TIMEOUT_MS)
+        if (!isRecord(result)) return false
+        const data = isRecord(result.data) ? result.data : result
+        return data.id === sessionID && data.parentID === undefined && data.fork === undefined
+      } catch {
+        return false
+      } finally {
+        controller.abort()
+      }
+    })()
+    rootSessionCache.delete(sessionID)
+    rootSessionCache.set(sessionID, { expiresAt: Date.now() + ROOT_SESSION_CACHE_TTL_MS, pending })
+    while (rootSessionCache.size > ROOT_SESSION_CACHE_MAX) {
+      const oldest = rootSessionCache.keys().next().value
+      if (oldest === undefined) break
+      rootSessionCache.delete(oldest)
+    }
+    const eligible = await pending
+    if (!eligible && rootSessionCache.get(sessionID)?.pending === pending) rootSessionCache.delete(sessionID)
+    return eligible
   }
 
   return {
     // Runs with the merged OpenCode config (on init, and again on config
-    // reload). Captures the mode of user-defined agents and built-in
-    // overrides so chat.headers can classify string agent names.
+    // reload). Captures user-defined agents and built-in overrides.
     config: (cfg) => {
-      const next: Record<string, string> = {}
+      const next: Record<string, ConfigAgent> = {}
       for (const [name, def] of Object.entries(cfg?.agent ?? {})) {
-        if (typeof def?.mode === "string") next[name] = def.mode
+        if (!def) continue
+        next[name] = {
+          ...(typeof def.mode === "string" ? { mode: def.mode } : {}),
+          ...(typeof def.hidden === "boolean" ? { hidden: def.hidden } : {}),
+        }
       }
-      configModes = next
+      configAgents = next
     },
 
     "chat.headers": async (incoming, output) => {
-      // Only inject headers for Anthropic provider requests
+      // This is V1's final supported outbound boundary. Remove an earlier
+      // plugin/provider spoof even when this request is not eligible.
+      deleteHeader(output.headers, PRIORITY_ATTESTATION_HEADER)
+      // Only inject headers for Anthropic provider requests.
       if (incoming.model.providerID !== "anthropic") return
 
-      // Session tracking
-      output.headers["x-opencode-session"] = incoming.sessionID
-      output.headers["x-opencode-request"] = incoming.message.id
+      // Session tracking. Replace case-insensitively so the values compared by
+      // the proxy are the same trusted hook inputs that are signed below.
+      setHeader(output.headers, "x-opencode-session", incoming.sessionID)
+      setHeader(output.headers, "x-opencode-request", incoming.message.id)
 
       const { name, mode } = resolve(incoming.agent)
+      const safeName = name.replace(/[^\x20-\x7E]/g, "").trim() || "unknown"
 
       // The proxy expects primary|subagent. "all" agents can act as either;
       // without per-request context, treat them as primary (full tier) to
-      // preserve capability.
-      output.headers["x-opencode-agent-mode"] = mode === "subagent" ? "subagent" : "primary"
+      // preserve capability. This permissive tiering decision is NOT reused as
+      // strict routing eligibility.
+      setHeader(output.headers, "x-opencode-agent-mode", mode === "subagent" ? "subagent" : "primary")
       // Strip non-ASCII characters (e.g. zero-width spaces) that cause
       // "Header has invalid value" errors in Node.js / undici.
-      output.headers["x-opencode-agent-name"] = name.replace(/[^\x20-\x7E]/g, "").trim() || "unknown"
+      setHeader(output.headers, "x-opencode-agent-name", safeName)
+
+      if (getHeader(output.headers, "x-meridian-profile") !== undefined) return
+      if (safeName !== name || !isStrictVisiblePrimary(incoming.agent)) return
+      const createdAt = incoming.message.time?.created
+      if (typeof createdAt !== "number" || !Number.isSafeInteger(createdAt) || createdAt < 0) return
+      const issuedAt = Math.floor(createdAt / 1000)
+      if (incoming.message.sessionID !== undefined && incoming.message.sessionID !== incoming.sessionID) return
+      if (!(await isRootSession(incoming.sessionID))) return
+      // A config reload can complete while the bounded root lookup is in
+      // flight. Re-check visibility at the final signing instant.
+      if (!isStrictVisiblePrimary(incoming.agent)) return
+      const token = createPriorityAttestation({
+        generation: "oc1",
+        sessionId: incoming.sessionID,
+        agentId: safeName,
+        humanMessageId: incoming.message.id,
+        issuedAt,
+      })
+      if (token) setHeader(output.headers, PRIORITY_ATTESTATION_HEADER, token)
     },
   }
 }

package/plugin/priority-attestation.ts

@@ -0,0 +1,150 @@
+/**
+ * OpenCode-side signer for Meridian priority failback attestations.
+ *
+ * This file lives under plugin/ because the V1 plugin is shipped as TypeScript.
+ * The V2 build bundles it into dist/meridian-v2.js.
+ */
+
+import { createHash, createHmac } from "node:crypto"
+import { readFileSync } from "node:fs"
+import { homedir } from "node:os"
+import { join } from "node:path"
+
+export const PRIORITY_ATTESTATION_HEADER = "x-meridian-opencode-turn"
+export const PRIORITY_ATTESTATION_KEY_ENV = "MERIDIAN_OPENCODE_ATTESTATION_KEY"
+export const PRIORITY_ATTESTATION_KEY_FILE = "opencode-turn.key"
+
+const TOKEN_PREFIX = "v1"
+const MAC_DOMAIN = "meridian.opencode.turn.v1\0"
+const TURN_DOMAIN = "meridian.opencode.human.v1\0"
+const MAX_HEADER_BYTES = 768
+const MAX_PAYLOAD_BYTES = 384
+const TURN_DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/
+const SAFE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/
+export type OpenCodeAttestationGeneration = "oc1" | "oc2b18314"
+
+export interface PriorityAttestationSignInput {
+  readonly generation: OpenCodeAttestationGeneration
+  readonly sessionId: string
+  readonly agentId: string
+  readonly humanMessageId: string
+  /** Immutable OpenCode user-message creation time, in whole Unix seconds. */
+  readonly issuedAt: number
+}
+
+function configDirectory(): string {
+  return process.env.MERIDIAN_CONFIG_DIR ?? join(homedir(), ".config", "meridian")
+}
+
+export function priorityAttestationKeyPath(): string {
+  return join(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE)
+}
+
+function isSafeAgentId(value: string): boolean {
+  return value.length >= 1
+    && value.length <= 64
+    && value.trim() === value
+    && /^[\x20-\x7E]+$/.test(value)
+}
+
+function decodeCanonicalBase64Url(raw: string): Buffer | undefined {
+  if (!/^[A-Za-z0-9_-]+$/.test(raw)) return undefined
+  const decoded = Buffer.from(raw, "base64url")
+  return decoded.toString("base64url") === raw ? decoded : undefined
+}
+
+export function decodePriorityAttestationKey(raw: string | undefined): Buffer | undefined {
+  if (raw === undefined) return undefined
+  const normalized = raw.trim()
+  const decoded = decodeCanonicalBase64Url(normalized)
+  return decoded?.length === 32 ? decoded : undefined
+}
+
+export function loadPriorityAttestationKey(): Buffer | undefined {
+  const fromEnv = process.env[PRIORITY_ATTESTATION_KEY_ENV]
+  if (fromEnv !== undefined) return decodePriorityAttestationKey(fromEnv)
+  try {
+    return decodePriorityAttestationKey(readFileSync(priorityAttestationKeyPath(), "utf8"))
+  } catch {
+    return undefined
+  }
+}
+
+export function computePriorityTurnDigest(input: {
+  readonly generation: OpenCodeAttestationGeneration
+  readonly sessionId: string
+  readonly humanMessageId: string
+}): string | undefined {
+  if (!SAFE_ID_PATTERN.test(input.sessionId) || !SAFE_ID_PATTERN.test(input.humanMessageId)) {
+    return undefined
+  }
+  return createHash("sha256")
+    .update(TURN_DOMAIN)
+    .update(input.generation)
+    .update("\0")
+    .update(input.sessionId)
+    .update("\0")
+    .update(input.humanMessageId)
+    .digest("base64url")
+}
+
+
+
+export function createPriorityAttestation(
+  input: PriorityAttestationSignInput,
+  key: Buffer = loadPriorityAttestationKey() ?? Buffer.alloc(0),
+): string | undefined {
+  if (key.length !== 32) return undefined
+  if (!SAFE_ID_PATTERN.test(input.sessionId) || !isSafeAgentId(input.agentId)) return undefined
+  const turnDigest = computePriorityTurnDigest(input)
+  if (!turnDigest || !TURN_DIGEST_PATTERN.test(turnDigest)) return undefined
+  const issuedAt = input.issuedAt
+  if (!Number.isSafeInteger(issuedAt) || issuedAt < 0) return undefined
+
+  // Fixed insertion order is part of the wire contract. The proxy reconstructs
+  // this exact JSON and rejects non-canonical or extensible payloads.
+  const payload = JSON.stringify({
+    v: 1,
+    g: input.generation,
+    s: input.sessionId,
+    a: input.agentId,
+    t: turnDigest,
+    iat: issuedAt,
+  })
+  if (Buffer.byteLength(payload) > MAX_PAYLOAD_BYTES) return undefined
+  const encodedPayload = Buffer.from(payload).toString("base64url")
+  const mac = createHmac("sha256", key)
+    .update(MAC_DOMAIN)
+    .update(payload)
+    .digest("base64url")
+  const token = `${TOKEN_PREFIX}.${encodedPayload}.${mac}`
+  return Buffer.byteLength(token) <= MAX_HEADER_BYTES ? token : undefined
+}
+
+export type MutableHeaders = Record<string, string> | Headers
+
+export function deleteHeader(headers: MutableHeaders, name: string): void {
+  if (headers instanceof Headers) {
+    headers.delete(name)
+    return
+  }
+  const lower = name.toLowerCase()
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === lower) delete headers[key]
+  }
+}
+
+export function getHeader(headers: MutableHeaders, name: string): string | undefined {
+  if (headers instanceof Headers) return headers.get(name) ?? undefined
+  const lower = name.toLowerCase()
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === lower) return value
+  }
+  return undefined
+}
+
+export function setHeader(headers: MutableHeaders, name: string, value: string): void {
+  deleteHeader(headers, name)
+  if (headers instanceof Headers) headers.set(name, value)
+  else headers[name] = value
+}