@rynfar/meridian 1.67.0 → 1.69.0

package/dist/{cli-n8t34zmq.js → cli-zdbv40d5.js}

@@ -637,7 +637,7 @@ var init_priorityAttestation = __esm(() => {
 
 // src/proxy/setup.ts
 var import_cross_spawn = __toESM(require_cross_spawn(), 1);
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2, platform as platform2 } from "os";
 import { basename, dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
@@ -720,6 +720,15 @@ class UnparseableConfigError extends Error {
   }
 }
 
+class MissingV1PluginError extends Error {
+  expectedPath;
+  constructor(expectedPath) {
+    super(`OpenCode V1 plugin bundle not found at ${expectedPath}`);
+    this.expectedPath = expectedPath;
+    this.name = "MissingV1PluginError";
+  }
+}
+
 class MissingV2PluginError extends Error {
   expectedPath;
   constructor(expectedPath) {
@@ -771,21 +780,47 @@ function siblingOpencodeConfigPath(configPath) {
   return;
 }
 function findPluginPath(fromUrl) {
-  const dir = dirname2(fileURLToPath(fromUrl));
-  return join2(dir, "..", "plugin", "meridian.ts");
+  const entryPath = fileURLToPath(fromUrl);
+  const dir = dirname2(entryPath);
+  if (entryPath.endsWith(".ts")) {
+    const sourcePlugin = join2(dir, "..", "plugin", "meridian");
+    if (hasPluginPackageEntry(sourcePlugin))
+      return sourcePlugin;
+    throw new MissingV1PluginError(sourcePlugin);
+  }
+  const bundledPlugin = join2(dir, "meridian");
+  if (hasPluginPackageEntry(bundledPlugin))
+    return bundledPlugin;
+  throw new MissingV1PluginError(bundledPlugin);
+}
+var SUPPORTED_OPENCODE_V2_VERSIONS = new Set([
+  "0.0.0-beta-18314",
+  "0.0.0-beta-18866"
+]);
+function hasPluginPackageEntry(path) {
+  try {
+    if (!statSync(join2(path, "index.js"), { throwIfNoEntry: false })?.isFile())
+      return false;
+    const manifest = JSON.parse(readFileSync2(join2(path, "package.json"), "utf8"));
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
+      return false;
+    const fields = manifest;
+    return fields.type === "module" && fields.main === "./index.js";
+  } catch {
+    return false;
+  }
 }
-var SUPPORTED_OPENCODE_V2_VERSION = "0.0.0-beta-18314";
 function findV2PluginPath(fromUrl) {
   const entryPath = fileURLToPath(fromUrl);
   const dir = dirname2(entryPath);
   if (entryPath.endsWith(".ts")) {
-    const sourcePlugin = join2(dir, "..", "plugin", "meridian-v2.ts");
-    if (existsSync(sourcePlugin))
+    const sourcePlugin = join2(dir, "..", "plugin", "meridian-v2");
+    if (hasPluginPackageEntry(sourcePlugin))
       return sourcePlugin;
     throw new MissingV2PluginError(sourcePlugin);
   }
-  const bundledPlugin = join2(dir, "meridian-v2.js");
-  if (existsSync(bundledPlugin))
+  const bundledPlugin = join2(dir, "meridian-v2");
+  if (hasPluginPackageEntry(bundledPlugin))
     return bundledPlugin;
   throw new MissingV2PluginError(bundledPlugin);
 }
@@ -840,7 +875,7 @@ function isMeridianEntry(entry) {
   const packageName = pluginEntryPackage(entry);
   if (!packageName)
     return false;
-  return STALE_PATTERNS.some((pattern) => packageName.includes(pattern)) || packageName.includes("meridian.ts") || packageName.includes("meridian-v2.") || packageName.includes("@rynfar/meridian");
+  return STALE_PATTERNS.some((pattern) => packageName.includes(pattern)) || packageName.includes("meridian.ts") || packageName.includes("meridian-v2.") || packageName.endsWith("/meridian-v2") || /[\\/]meridian$/.test(packageName) || packageName.includes("@rynfar/meridian");
 }
 function checkPluginConfigured(configPath, expectedPluginPath) {
   const selectedPath = configPath ?? findOpencodeConfigPath();
@@ -936,4 +971,4 @@ function runSetup(pluginPath, configPath, generation = "v1") {
   return { configPath: path, pluginPath, alreadyConfigured, removedStale, created: false };
 }
 
-export { LRUMap, PRIORITY_ATTESTATION_HEADER, verifyPriorityAttestation, init_priorityAttestation, UnparseableConfigError, MissingV2PluginError, DuplicateMeridianConfigError, findOpencodeConfigPath, findPluginPath, SUPPORTED_OPENCODE_V2_VERSION, findV2PluginPath, classifyOpenCodeVersion, detectOpenCodeGeneration, pluginPathForGeneration, checkPluginConfigured, clearPluginlessWarnings, notePluginlessOpenCodeRequest, runSetup };
+export { LRUMap, PRIORITY_ATTESTATION_HEADER, verifyPriorityAttestation, init_priorityAttestation, UnparseableConfigError, MissingV1PluginError, MissingV2PluginError, DuplicateMeridianConfigError, findOpencodeConfigPath, findPluginPath, SUPPORTED_OPENCODE_V2_VERSIONS, findV2PluginPath, classifyOpenCodeVersion, detectOpenCodeGeneration, pluginPathForGeneration, checkPluginConfigured, clearPluginlessWarnings, notePluginlessOpenCodeRequest, runSetup };

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   startProxyServer
-} from "./cli-35jx6vmy.js";
+} from "./cli-x1sv3bqf.js";
 import"./cli-5jxyma6z.js";
 import"./cli-sry5aqdj.js";
 import"./cli-8yp89fan.js";
@@ -10,7 +10,7 @@ import {
 } from "./cli-9e5cxp89.js";
 import"./cli-khhjyk04.js";
 import"./cli-vj9cv18n.js";
-import"./cli-n8t34zmq.js";
+import"./cli-zdbv40d5.js";
 import {
   __require
 } from "./cli-p9swy5t3.js";
@@ -91,9 +91,9 @@ if (args[0] === "setup") {
     MissingV2PluginError,
     pluginPathForGeneration,
     runSetup,
-    SUPPORTED_OPENCODE_V2_VERSION,
+    SUPPORTED_OPENCODE_V2_VERSIONS,
     UnparseableConfigError
-  } = await import("./setup-8fwgwhqh.js");
+  } = await import("./setup-b3ymd9z8.js");
   const forceV1 = args.includes("--v1");
   const forceV2 = args.includes("--v2");
   if (forceV1 && forceV2) {
@@ -117,9 +117,9 @@ if (args[0] === "setup") {
     console.error("Could not find an OpenCode V2 beta. Install the pinned beta or pass --opencode-bin <path>.");
     process.exit(1);
   }
-  if (detected.generation === "v2" && detected.version !== SUPPORTED_OPENCODE_V2_VERSION) {
+  if (detected.generation === "v2" && !SUPPORTED_OPENCODE_V2_VERSIONS.has(detected.version ?? "")) {
     console.error(`OpenCode V2 ${detected.version ?? "unknown"} is not supported by this Meridian build.`);
-    console.error(`Install @opencode-ai/cli@${SUPPORTED_OPENCODE_V2_VERSION}, then re-run meridian setup --v2.`);
+    console.error(`Install a supported OpenCode beta (${[...SUPPORTED_OPENCODE_V2_VERSIONS].join(", ")}), then re-run meridian setup --v2.`);
     process.exit(1);
   }
   let pluginPath;
@@ -205,7 +205,7 @@ async function runCli(start = startProxyServer, runAuthCheck = async () => {
   return execFile(claudePath, ["auth", "status"], { timeout: 5000 });
 }) {
   try {
-    const { findOpencodeConfigPath, checkPluginConfigured, findPluginPath } = await import("./setup-8fwgwhqh.js");
+    const { findOpencodeConfigPath, checkPluginConfigured, findPluginPath } = await import("./setup-b3ymd9z8.js");
     const configPath = findOpencodeConfigPath();
     const { existsSync } = await import("fs");
     if (existsSync(configPath) && !checkPluginConfigured(configPath)) {

package/dist/meridian/index.js

@@ -0,0 +1,252 @@
+// plugin/priority-attestation.ts
+import { createHash, createHmac } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var PRIORITY_ATTESTATION_HEADER = "x-meridian-opencode-turn";
+var PRIORITY_ATTESTATION_KEY_ENV = "MERIDIAN_OPENCODE_ATTESTATION_KEY";
+var PRIORITY_ATTESTATION_KEY_FILE = "opencode-turn.key";
+var TOKEN_PREFIX = "v1";
+var MAC_DOMAIN = "meridian.opencode.turn.v1\x00";
+var TURN_DOMAIN = "meridian.opencode.human.v1\x00";
+var MAX_HEADER_BYTES = 768;
+var MAX_PAYLOAD_BYTES = 384;
+var TURN_DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+var SAFE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+function configDirectory() {
+  return process.env.MERIDIAN_CONFIG_DIR ?? join(homedir(), ".config", "meridian");
+}
+function priorityAttestationKeyPath() {
+  return join(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE);
+}
+function isSafeAgentId(value) {
+  return value.length >= 1 && value.length <= 64 && value.trim() === value && /^[\x20-\x7E]+$/.test(value);
+}
+function decodeCanonicalBase64Url(raw) {
+  if (!/^[A-Za-z0-9_-]+$/.test(raw))
+    return;
+  const decoded = Buffer.from(raw, "base64url");
+  return decoded.toString("base64url") === raw ? decoded : undefined;
+}
+function decodePriorityAttestationKey(raw) {
+  if (raw === undefined)
+    return;
+  const normalized = raw.trim();
+  const decoded = decodeCanonicalBase64Url(normalized);
+  return decoded?.length === 32 ? decoded : undefined;
+}
+function loadPriorityAttestationKey() {
+  const fromEnv = process.env[PRIORITY_ATTESTATION_KEY_ENV];
+  if (fromEnv !== undefined)
+    return decodePriorityAttestationKey(fromEnv);
+  try {
+    return decodePriorityAttestationKey(readFileSync(priorityAttestationKeyPath(), "utf8"));
+  } catch {
+    return;
+  }
+}
+function computePriorityTurnDigest(input) {
+  if (!SAFE_ID_PATTERN.test(input.sessionId) || !SAFE_ID_PATTERN.test(input.humanMessageId)) {
+    return;
+  }
+  return createHash("sha256").update(TURN_DOMAIN).update(input.generation).update("\x00").update(input.sessionId).update("\x00").update(input.humanMessageId).digest("base64url");
+}
+function createPriorityAttestation(input, key = loadPriorityAttestationKey() ?? Buffer.alloc(0)) {
+  if (key.length !== 32)
+    return;
+  if (!SAFE_ID_PATTERN.test(input.sessionId) || !isSafeAgentId(input.agentId))
+    return;
+  const turnDigest = computePriorityTurnDigest(input);
+  if (!turnDigest || !TURN_DIGEST_PATTERN.test(turnDigest))
+    return;
+  const issuedAt = input.issuedAt;
+  if (!Number.isSafeInteger(issuedAt) || issuedAt < 0)
+    return;
+  const payload = JSON.stringify({
+    v: 1,
+    g: input.generation,
+    s: input.sessionId,
+    a: input.agentId,
+    t: turnDigest,
+    iat: issuedAt
+  });
+  if (Buffer.byteLength(payload) > MAX_PAYLOAD_BYTES)
+    return;
+  const encodedPayload = Buffer.from(payload).toString("base64url");
+  const mac = createHmac("sha256", key).update(MAC_DOMAIN).update(payload).digest("base64url");
+  const token = `${TOKEN_PREFIX}.${encodedPayload}.${mac}`;
+  return Buffer.byteLength(token) <= MAX_HEADER_BYTES ? token : undefined;
+}
+function deleteHeader(headers, name) {
+  if (headers instanceof Headers) {
+    headers.delete(name);
+    return;
+  }
+  const lower = name.toLowerCase();
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === lower)
+      delete headers[key];
+  }
+}
+function getHeader(headers, name) {
+  if (headers instanceof Headers)
+    return headers.get(name) ?? undefined;
+  const lower = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === lower)
+      return value;
+  }
+  return;
+}
+function setHeader(headers, name, value) {
+  deleteHeader(headers, name);
+  if (headers instanceof Headers)
+    headers.set(name, value);
+  else
+    headers[name] = value;
+}
+
+// plugin/meridian.ts
+var BUILTIN_AGENT_MODES = {
+  build: "primary",
+  plan: "primary",
+  general: "subagent",
+  explore: "subagent",
+  title: "subagent",
+  summary: "subagent",
+  compaction: "subagent"
+};
+var INTERNAL_AGENT_IDS = new Set(["title", "summary", "compaction"]);
+var ROOT_SESSION_CACHE_MAX = 256;
+var ROOT_SESSION_CACHE_TTL_MS = 5000;
+var LOOKUP_TIMEOUT_MS = 250;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function withTimeout(pending, timeoutMs) {
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(undefined), timeoutMs);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([pending, timedOut]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+var MeridianPlugin = async (pluginInput) => {
+  let configAgents = {};
+  const rootSessionCache = new Map;
+  const resolve = (agent) => {
+    if (typeof agent === "object" && agent !== null) {
+      return { name: agent.name ?? "unknown", mode: agent.mode ?? "primary" };
+    }
+    const name = String(agent);
+    return { name, mode: configAgents[name]?.mode ?? BUILTIN_AGENT_MODES[name] ?? "primary" };
+  };
+  const isStrictVisiblePrimary = (agent) => {
+    const name = typeof agent === "string" ? agent : agent.name;
+    if (!name || INTERNAL_AGENT_IDS.has(name))
+      return false;
+    if (typeof agent === "object") {
+      return agent.mode === "primary" && agent.hidden !== true;
+    }
+    const configured = configAgents[name];
+    if (configured)
+      return configured.mode === "primary" && configured.hidden !== true;
+    return BUILTIN_AGENT_MODES[name] === "primary";
+  };
+  const isRootSession = async (sessionID) => {
+    const cached = rootSessionCache.get(sessionID);
+    if (cached && cached.expiresAt > Date.now())
+      return cached.pending;
+    const pending = (async () => {
+      if (!isRecord(pluginInput) || !isRecord(pluginInput.client))
+        return false;
+      const sessionApi = pluginInput.client.session;
+      if (!isRecord(sessionApi) || typeof sessionApi.get !== "function")
+        return false;
+      const controller = new AbortController;
+      try {
+        const lookup = Promise.resolve(Reflect.apply(sessionApi.get, sessionApi, [
+          { path: { id: sessionID }, signal: controller.signal }
+        ]));
+        const result = await withTimeout(lookup, LOOKUP_TIMEOUT_MS);
+        if (!isRecord(result))
+          return false;
+        const data = isRecord(result.data) ? result.data : result;
+        return data.id === sessionID && data.parentID === undefined && data.fork === undefined;
+      } catch {
+        return false;
+      } finally {
+        controller.abort();
+      }
+    })();
+    rootSessionCache.delete(sessionID);
+    rootSessionCache.set(sessionID, { expiresAt: Date.now() + ROOT_SESSION_CACHE_TTL_MS, pending });
+    while (rootSessionCache.size > ROOT_SESSION_CACHE_MAX) {
+      const oldest = rootSessionCache.keys().next().value;
+      if (oldest === undefined)
+        break;
+      rootSessionCache.delete(oldest);
+    }
+    const eligible = await pending;
+    if (!eligible && rootSessionCache.get(sessionID)?.pending === pending)
+      rootSessionCache.delete(sessionID);
+    return eligible;
+  };
+  return {
+    config: (cfg) => {
+      const next = {};
+      for (const [name, def] of Object.entries(cfg?.agent ?? {})) {
+        if (!def)
+          continue;
+        next[name] = {
+          ...typeof def.mode === "string" ? { mode: def.mode } : {},
+          ...typeof def.hidden === "boolean" ? { hidden: def.hidden } : {}
+        };
+      }
+      configAgents = next;
+    },
+    "chat.headers": async (incoming, output) => {
+      deleteHeader(output.headers, PRIORITY_ATTESTATION_HEADER);
+      if (incoming.model.providerID !== "anthropic")
+        return;
+      setHeader(output.headers, "x-opencode-session", incoming.sessionID);
+      setHeader(output.headers, "x-opencode-request", incoming.message.id);
+      const { name, mode } = resolve(incoming.agent);
+      const safeName = name.replace(/[^\x20-\x7E]/g, "").trim() || "unknown";
+      setHeader(output.headers, "x-opencode-agent-mode", mode === "subagent" ? "subagent" : "primary");
+      setHeader(output.headers, "x-opencode-agent-name", safeName);
+      if (getHeader(output.headers, "x-meridian-profile") !== undefined)
+        return;
+      if (safeName !== name || !isStrictVisiblePrimary(incoming.agent))
+        return;
+      const createdAt = incoming.message.time?.created;
+      if (typeof createdAt !== "number" || !Number.isSafeInteger(createdAt) || createdAt < 0)
+        return;
+      const issuedAt = Math.floor(createdAt / 1000);
+      if (incoming.message.sessionID !== undefined && incoming.message.sessionID !== incoming.sessionID)
+        return;
+      if (!await isRootSession(incoming.sessionID))
+        return;
+      if (!isStrictVisiblePrimary(incoming.agent))
+        return;
+      const token = createPriorityAttestation({
+        generation: "oc1",
+        sessionId: incoming.sessionID,
+        agentId: safeName,
+        humanMessageId: incoming.message.id,
+        issuedAt
+      });
+      if (token)
+        setHeader(output.headers, PRIORITY_ATTESTATION_HEADER, token);
+    }
+  };
+};
+var meridian_default = MeridianPlugin;
+export {
+  meridian_default as default
+};

package/dist/meridian/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@rynfar/meridian-opencode-v1-plugin",
+  "private": true,
+  "type": "module",
+  "main": "./index.js"
+}