@sagentlab/navarch-runtime 0.1.117 → 0.1.120

package/bin/worktree-guard-hook.cjs

@@ -173,12 +173,151 @@ function expandHome(value) {
   return value;
 }
 
+/**
+ * Previous character on the same line, ignoring blanks; "" at a true line
+ * start. A line that ends in an unescaped backslash continues onto the next
+ * line in the shell, so that backslash is returned instead.
+ */
+function previousSignificantChar(command, index) {
+  for (let i = index - 1; i >= 0; i--) {
+    const ch = command[i];
+    if (ch === "\n") {
+      let j = i - 1;
+      while (j >= 0 && (command[j] === "\r" || command[j] === " " || command[j] === "\t")) j--;
+      let slashes = 0;
+      while (j >= 0 && command[j] === "\\") {
+        slashes++;
+        j--;
+      }
+      return slashes % 2 === 1 ? "\\" : "";
+    }
+    if (ch !== " " && ch !== "\t") return ch;
+  }
+  return "";
+}
+
+/**
+ * True when the token sits directly after a quote that opens a word
+ * (`"/** x *\/"`). A closing quote (`"" /*`, `"x"/*`) leaves the token as a
+ * bare shell argument, so it does not count.
+ */
+function isInsideOpeningQuote(command, start) {
+  const quote = command[start - 1];
+  // Backticks run a command, so never use them to exempt a path token.
+  if (quote !== '"' && quote !== "'") return false;
+  // Only the command's first quote can prove an opening quoted word without
+  // parsing shell comments, heredocs and nested substitutions. Earlier quote
+  // characters make this ambiguous: keep screening rather than risk treating
+  // a closing quote after a continuation as an opening one.
+  if (/["'`]/.test(command.slice(0, start - 1))) return false;
+  const beforeQuote = command[start - 2];
+  return beforeQuote === undefined || /[\s=(<>;|&]/.test(beforeQuote);
+}
+
+/**
+ * Returns [open, close, segmentStart] for the quoted word containing `index`,
+ * or null when it sits outside quotes or the quote state cannot be trusted.
+ * `segmentStart` follows the last unquoted, unescaped `;`, `|`, `&` or newline
+ * before the word, so a separator inside quotes never starts a segment. Only
+ * plain single and double quotes are tracked. Constructs that nest or hide
+ * quotes (backticks, `$(`, `$'`, heredocs, shell comments) make the scan bail
+ * out, so a misread quote never exempts a token.
+ */
+function quotedSpanAt(command, index) {
+  let quote = "";
+  let open = -1;
+  let segmentStart = 0;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "'") {
+      if (ch === "'") {
+        if (index > open && index < i) return [open, i, segmentStart];
+        quote = "";
+      }
+      continue;
+    }
+    if (ch === "`" || (ch === "$" && (command[i + 1] === "(" || command[i + 1] === "'"))) return null;
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') {
+        if (index > open && index < i) return [open, i, segmentStart];
+        quote = "";
+      }
+      continue;
+    }
+    if (/[;|&\n]/.test(ch)) segmentStart = i + 1;
+    if (ch === "<" && command[i + 1] === "<") return null;
+    if (ch === "#" && (i === 0 || /[\s;|&(]/.test(command[i - 1]))) return null;
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      open = i;
+    }
+  }
+  return null;
+}
+
+/**
+ * True for the jq alternative operator (`//`, `//=`) used as its own word inside
+ * a quoted jq program: `jq '.a // "x"' f.json`, `gh ... --jq '(.x) // "none"'`.
+ * Narrow on purpose. The token must be whitespace-delimited, sit inside a
+ * plain-quoted word in a shell segment whose command word is `jq`, or is `gh`
+ * with the word given to `--jq`/`-q`. Unquoted tokens (`find // -x`),
+ * quoted bare roots (`ls "//"`) and `//` in other quoted text stay screened.
+ */
+function isJqAlternativeOperator(command, start, token) {
+  if (token !== "//" && token !== "//=") return false;
+  const next = command[start + token.length];
+  if (!/\s/.test(command[start - 1] ?? "") || next === undefined || !/\s/.test(next)) return false;
+  const span = quotedSpanAt(command, start);
+  if (!span) return false;
+  const segment = command.slice(span[2], span[0]);
+  const commandWord = /^\s*\(?\s*(?:[A-Za-z_]\w*=\S*\s+)*/;
+  if (new RegExp(commandWord.source + "jq\\s").test(segment)) return true;
+  return (
+    new RegExp(commandWord.source + "gh\\s").test(segment) && /\s(?:--jq|-q)(?:=|\s+)$/.test(segment)
+  );
+}
+
+/**
+ * True when a "/"-leading token is comment or markup text rather than a path:
+ * a closing tag (`</p>`), a block-comment opener (`/**`, `/*`), or a line
+ * comment (`// note`). Each rule is deliberately narrow so real escapes stay
+ * screened: tag names that exist at the filesystem root (`</home>`) are still
+ * checked, `/*` and `//` only count at a comment position (line start, right
+ * after an opening quote, or after `;`) so `rm -rf /*`, `find // -name x`
+ * and `rm -rf "" /*` stay blocked, and a block comment needs a closing
+ * `*` + `/` later in the text. The jq alternative operator inside a quoted jq
+ * program is exempt under the separate, narrower rule in
+ * isJqAlternativeOperator.
+ */
+function isCommentOrMarkupToken(command, start, token) {
+  const end = start + token.length;
+  const next = command[end];
+
+  if (isJqAlternativeOperator(command, start, token)) return true;
+
+  if (command[start - 1] === "<" && next === ">" && /^\/[A-Za-z][\w:.-]*$/.test(token)) {
+    return !fs.existsSync(token);
+  }
+
+  const atCommentPosition =
+    isInsideOpeningQuote(command, start) ||
+    ["", ";"].includes(previousSignificantChar(command, start));
+  if (!atCommentPosition || next === undefined || !/\s/.test(next)) return false;
+  if (token === "/*" || token === "/**") return command.indexOf("*/", end) !== -1;
+  return token === "//" && /\S/.test(command.slice(end));
+}
+
 /**
  * Pulls path-like references out of a shell command: absolute paths,
  * home-anchored paths (`~...`, `$HOME/...`), and relative `..` traversals.
  * Lexical by design — see the file header for why this is a guardrail, not
  * a parser. URLs survive untouched (the char before `//` in `https://` is
- * `:`, which is not a path delimiter here).
+ * `:`, which is not a path delimiter here). Comment and markup text that
+ * merely starts with "/" (`/** doc *\/`, `// note`, `</p>`) is not a path.
  */
 function extractBashPathCandidates(command) {
   const candidates = [];
@@ -193,7 +332,11 @@ function extractBashPathCandidates(command) {
   const absoluteRe = /(?:^|[\s'"`=(<>;|&])(\/[^\s'"`<>;|&)]*)/g;
   const homeRe = /(?:^|[\s'"`=(<>;|&])((?:~|\$\{?HOME\}?)[^\s'"`<>;|&)]*)/g;
   let match;
-  while ((match = absoluteRe.exec(command))) add(match[1]);
+  while ((match = absoluteRe.exec(command))) {
+    const start = match.index + match[0].length - match[1].length;
+    if (isCommentOrMarkupToken(command, start, match[1])) continue;
+    add(match[1]);
+  }
   while ((match = homeRe.exec(command))) add(match[1]);
 
   for (const token of command.split(/[\s'"`;|&<>()]+/)) {

package/dist/adapters/opencode.cjs

@@ -13,11 +13,18 @@ const node_path_1 = __importDefault(require("node:path"));
 const config_cjs_1 = require("../config.cjs");
 const kill_agent_cjs_1 = require("../kill-agent.cjs");
 /**
- * Headless OpenCode adapter, fixture-pinned to the OpenCode JSON/config
- * contract shared by V1 and V2 (verified against 2.0.6):
+ * Headless OpenCode adapter, fixture-pinned to the OpenCode JSON event
+ * contract shared by V1 and V2 (verified against 1.19.1, 2.0.6 and 2.0.17):
  *
  *   opencode run --format json [--model provider/model[#variant]]  < prompt
  *
+ * V1 (still npm's `latest`) differs in two ways the adapter must follow: its
+ * config takes V1 `permission` rules and flat `mcp` entries, and it rejects
+ * V2's `permissions`/`mcp.servers` outright ("V2 permissions are not
+ * supported by OpenCode V1"); and it takes the reasoning variant as
+ * `--variant`, reporting `model#variant` as an unknown model. A `--version`
+ * probe picks the dialect per session, defaulting to V2.
+ *
  * The prompt goes in on stdin, which `opencode run` reads as the message when
  * none is given (verified against 2.0.17). Linux rejects any single argv
  * string over 128 KiB (`spawn E2BIG`), and an argv prompt also let an
@@ -45,16 +52,20 @@ async function runOpenCodeAdapter(options) {
     // supervisor's PWD in the inherited environment (often the home directory).
     if (!options.dockerExec && options.cwd)
         env.PWD = node_path_1.default.resolve(options.cwd);
-    await prepareOpenCodeConfig(options.mcpConfigPath, env, Boolean(options.dockerExec));
+    const probe = (probeArgs) => {
+        const probeOptions = { ...options, env, timeoutMs: 10_000, onProcessStarted: undefined };
+        return options.dockerExec ? runViaDocker(probeOptions, probeArgs) : runOnHost(probeOptions, probeArgs);
+    };
+    // Neither generation loads config for --version, so the probe runs before
+    // the config is written in the matching dialect.
+    const generation = openCodeGeneration(await probe(["--version"]));
+    await prepareOpenCodeConfig(options.mcpConfigPath, env, Boolean(options.dockerExec), generation);
     // V2's default background service owns its own cwd, environment and MCP
     // configuration. A client process's isolated config does not isolate that
     // service. Probe help without starting a turn, so older in-process CLIs
     // remain supported and upgrades are detected on the next session.
     const runOptions = { ...options, env };
-    const probeOptions = { ...runOptions, timeoutMs: 10_000, onProcessStarted: undefined };
-    const help = options.dockerExec
-        ? await runViaDocker(probeOptions, ["run", "--help"])
-        : await runOnHost(probeOptions, ["run", "--help"]);
+    const help = await probe(["run", "--help"]);
     if (help.exitCode !== 0 || help.timedOut || help.killedByLeaseLoss) {
         return { ...help, stderr: `OpenCode CLI capability check failed. ${help.stderr}` };
     }
@@ -76,10 +87,18 @@ async function runOpenCodeAdapter(options) {
     if (options.model && options.model !== "default" && !hasArg(options.extraArgs, "--model", "-m")) {
         // OpenCode V2 folds the reasoning variant into the model reference
         // (`provider/model#variant`) and hard-fails on a variant the model does
-        // not advertise. The claim route clamps the effort to the model's
-        // advertised variants, so a present value is always valid; absent means
-        // use the model's own default.
-        args.push("--model", options.reasoningEffort ? `${options.model}#${options.reasoningEffort}` : options.model);
+        // not advertise; V1 takes it as `--variant`. The claim route clamps the
+        // effort to the model's advertised variants, so a present value is
+        // always valid; absent means use the model's own default.
+        if (generation === 1) {
+            args.push("--model", options.model);
+            if (options.reasoningEffort && !hasArg(options.extraArgs, "--variant")) {
+                args.push("--variant", options.reasoningEffort);
+            }
+        }
+        else {
+            args.push("--model", options.reasoningEffort ? `${options.model}#${options.reasoningEffort}` : options.model);
+        }
     }
     const run = (runArgs) => runOptions.dockerExec
         ? runViaDocker(runOptions, runArgs, options.prompt)
@@ -110,10 +129,20 @@ function isLogLevelRejection(stderr) {
 function resetOpenCodeLogLevelCache() {
     openCodeLogLevels.clear();
 }
+/**
+ * V1 prints a bare `1.19.1`, V2 `opencode v2.0.17`. Anything unrecognized
+ * keeps the V2 dialect the adapter has always written.
+ */
+function openCodeGeneration(version) {
+    if (version.exitCode !== 0)
+        return 2;
+    const major = version.stdout.match(/^\s*(?:opencode\s+)?v?(\d+)\.\d+\.\d+/i)?.[1];
+    return major !== undefined && Number(major) < 2 ? 1 : 2;
+}
 function hasArg(args, ...flags) {
     return args.some((arg) => flags.some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
 }
-async function prepareOpenCodeConfig(mcpConfigPath, env, inDocker) {
+async function prepareOpenCodeConfig(mcpConfigPath, env, inDocker, generation) {
     if (!mcpConfigPath) {
         throw new Error("OpenCode requires a per-session MCP config path for isolated execution.");
     }
@@ -143,28 +172,46 @@ async function prepareOpenCodeConfig(mcpConfigPath, env, inDocker) {
         mcp[name] = {
             type: "remote",
             url,
-            disabled: false,
+            ...(generation === 1 ? { enabled: true } : { disabled: false }),
             oauth: false,
             ...(Object.keys(headers).length > 0 ? { headers } : {}),
         };
     }
-    const config = {
-        $schema: "https://opencode.ai/config.json",
-        update: "disable",
-        share: "disabled",
-        plugins: [],
-        mcp: { servers: mcp },
-        permissions: [
-            { action: "*", resource: "*", effect: "allow" },
-            { action: "external_directory", resource: "*", effect: "deny" },
-            ...(await openCodeManagedDirectories(env, inDocker)).map((resource) => ({
-                action: "external_directory",
-                resource,
-                effect: "allow",
-            })),
-            { action: "question", resource: "*", effect: "deny" },
-        ],
-    };
+    const managedDirectories = await openCodeManagedDirectories(env, inDocker);
+    // Same policy in both dialects; in each the last matching rule wins.
+    const config = generation === 1
+        ? {
+            $schema: "https://opencode.ai/config.json",
+            autoupdate: false,
+            share: "disabled",
+            plugin: [],
+            mcp,
+            permission: {
+                "*": "allow",
+                external_directory: {
+                    "*": "deny",
+                    ...Object.fromEntries(managedDirectories.map((resource) => [resource, "allow"])),
+                },
+                question: "deny",
+            },
+        }
+        : {
+            $schema: "https://opencode.ai/config.json",
+            update: "disable",
+            share: "disabled",
+            plugins: [],
+            mcp: { servers: mcp },
+            permissions: [
+                { action: "*", resource: "*", effect: "allow" },
+                { action: "external_directory", resource: "*", effect: "deny" },
+                ...managedDirectories.map((resource) => ({
+                    action: "external_directory",
+                    resource,
+                    effect: "allow",
+                })),
+                { action: "question", resource: "*", effect: "deny" },
+            ],
+        };
     const configPath = `${mcpConfigPath}.opencode.json`;
     const configDir = `${mcpConfigPath}.opencode-config`;
     const xdgConfigHome = `${mcpConfigPath}.opencode-xdg`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.117",
+  "version": "0.1.120",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",