@sagentlab/navarch-runtime 0.1.118 → 0.1.120

package/bin/worktree-guard-hook.cjs

@@ -214,6 +214,73 @@ function isInsideOpeningQuote(command, start) {
   return beforeQuote === undefined || /[\s=(<>;|&]/.test(beforeQuote);
 }
 
+/**
+ * Returns [open, close, segmentStart] for the quoted word containing `index`,
+ * or null when it sits outside quotes or the quote state cannot be trusted.
+ * `segmentStart` follows the last unquoted, unescaped `;`, `|`, `&` or newline
+ * before the word, so a separator inside quotes never starts a segment. Only
+ * plain single and double quotes are tracked. Constructs that nest or hide
+ * quotes (backticks, `$(`, `$'`, heredocs, shell comments) make the scan bail
+ * out, so a misread quote never exempts a token.
+ */
+function quotedSpanAt(command, index) {
+  let quote = "";
+  let open = -1;
+  let segmentStart = 0;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "'") {
+      if (ch === "'") {
+        if (index > open && index < i) return [open, i, segmentStart];
+        quote = "";
+      }
+      continue;
+    }
+    if (ch === "`" || (ch === "$" && (command[i + 1] === "(" || command[i + 1] === "'"))) return null;
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') {
+        if (index > open && index < i) return [open, i, segmentStart];
+        quote = "";
+      }
+      continue;
+    }
+    if (/[;|&\n]/.test(ch)) segmentStart = i + 1;
+    if (ch === "<" && command[i + 1] === "<") return null;
+    if (ch === "#" && (i === 0 || /[\s;|&(]/.test(command[i - 1]))) return null;
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      open = i;
+    }
+  }
+  return null;
+}
+
+/**
+ * True for the jq alternative operator (`//`, `//=`) used as its own word inside
+ * a quoted jq program: `jq '.a // "x"' f.json`, `gh ... --jq '(.x) // "none"'`.
+ * Narrow on purpose. The token must be whitespace-delimited, sit inside a
+ * plain-quoted word in a shell segment whose command word is `jq`, or is `gh`
+ * with the word given to `--jq`/`-q`. Unquoted tokens (`find // -x`),
+ * quoted bare roots (`ls "//"`) and `//` in other quoted text stay screened.
+ */
+function isJqAlternativeOperator(command, start, token) {
+  if (token !== "//" && token !== "//=") return false;
+  const next = command[start + token.length];
+  if (!/\s/.test(command[start - 1] ?? "") || next === undefined || !/\s/.test(next)) return false;
+  const span = quotedSpanAt(command, start);
+  if (!span) return false;
+  const segment = command.slice(span[2], span[0]);
+  const commandWord = /^\s*\(?\s*(?:[A-Za-z_]\w*=\S*\s+)*/;
+  if (new RegExp(commandWord.source + "jq\\s").test(segment)) return true;
+  return (
+    new RegExp(commandWord.source + "gh\\s").test(segment) && /\s(?:--jq|-q)(?:=|\s+)$/.test(segment)
+  );
+}
+
 /**
  * True when a "/"-leading token is comment or markup text rather than a path:
  * a closing tag (`</p>`), a block-comment opener (`/**`, `/*`), or a line
@@ -222,12 +289,16 @@ function isInsideOpeningQuote(command, start) {
  * checked, `/*` and `//` only count at a comment position (line start, right
  * after an opening quote, or after `;`) so `rm -rf /*`, `find // -name x`
  * and `rm -rf "" /*` stay blocked, and a block comment needs a closing
- * `*` + `/` later in the text.
+ * `*` + `/` later in the text. The jq alternative operator inside a quoted jq
+ * program is exempt under the separate, narrower rule in
+ * isJqAlternativeOperator.
  */
 function isCommentOrMarkupToken(command, start, token) {
   const end = start + token.length;
   const next = command[end];
 
+  if (isJqAlternativeOperator(command, start, token)) return true;
+
   if (command[start - 1] === "<" && next === ">" && /^\/[A-Za-z][\w:.-]*$/.test(token)) {
     return !fs.existsSync(token);
   }

package/dist/adapters/opencode.cjs

@@ -13,11 +13,18 @@ const node_path_1 = __importDefault(require("node:path"));
 const config_cjs_1 = require("../config.cjs");
 const kill_agent_cjs_1 = require("../kill-agent.cjs");
 /**
- * Headless OpenCode adapter, fixture-pinned to the OpenCode JSON/config
- * contract shared by V1 and V2 (verified against 2.0.6):
+ * Headless OpenCode adapter, fixture-pinned to the OpenCode JSON event
+ * contract shared by V1 and V2 (verified against 1.19.1, 2.0.6 and 2.0.17):
  *
  *   opencode run --format json [--model provider/model[#variant]]  < prompt
  *
+ * V1 (still npm's `latest`) differs in two ways the adapter must follow: its
+ * config takes V1 `permission` rules and flat `mcp` entries, and it rejects
+ * V2's `permissions`/`mcp.servers` outright ("V2 permissions are not
+ * supported by OpenCode V1"); and it takes the reasoning variant as
+ * `--variant`, reporting `model#variant` as an unknown model. A `--version`
+ * probe picks the dialect per session, defaulting to V2.
+ *
  * The prompt goes in on stdin, which `opencode run` reads as the message when
  * none is given (verified against 2.0.17). Linux rejects any single argv
  * string over 128 KiB (`spawn E2BIG`), and an argv prompt also let an
@@ -45,16 +52,20 @@ async function runOpenCodeAdapter(options) {
     // supervisor's PWD in the inherited environment (often the home directory).
     if (!options.dockerExec && options.cwd)
         env.PWD = node_path_1.default.resolve(options.cwd);
-    await prepareOpenCodeConfig(options.mcpConfigPath, env, Boolean(options.dockerExec));
+    const probe = (probeArgs) => {
+        const probeOptions = { ...options, env, timeoutMs: 10_000, onProcessStarted: undefined };
+        return options.dockerExec ? runViaDocker(probeOptions, probeArgs) : runOnHost(probeOptions, probeArgs);
+    };
+    // Neither generation loads config for --version, so the probe runs before
+    // the config is written in the matching dialect.
+    const generation = openCodeGeneration(await probe(["--version"]));
+    await prepareOpenCodeConfig(options.mcpConfigPath, env, Boolean(options.dockerExec), generation);
     // V2's default background service owns its own cwd, environment and MCP
     // configuration. A client process's isolated config does not isolate that
     // service. Probe help without starting a turn, so older in-process CLIs
     // remain supported and upgrades are detected on the next session.
     const runOptions = { ...options, env };
-    const probeOptions = { ...runOptions, timeoutMs: 10_000, onProcessStarted: undefined };
-    const help = options.dockerExec
-        ? await runViaDocker(probeOptions, ["run", "--help"])
-        : await runOnHost(probeOptions, ["run", "--help"]);
+    const help = await probe(["run", "--help"]);
     if (help.exitCode !== 0 || help.timedOut || help.killedByLeaseLoss) {
         return { ...help, stderr: `OpenCode CLI capability check failed. ${help.stderr}` };
     }
@@ -76,10 +87,18 @@ async function runOpenCodeAdapter(options) {
     if (options.model && options.model !== "default" && !hasArg(options.extraArgs, "--model", "-m")) {
         // OpenCode V2 folds the reasoning variant into the model reference
         // (`provider/model#variant`) and hard-fails on a variant the model does
-        // not advertise. The claim route clamps the effort to the model's
-        // advertised variants, so a present value is always valid; absent means
-        // use the model's own default.
-        args.push("--model", options.reasoningEffort ? `${options.model}#${options.reasoningEffort}` : options.model);
+        // not advertise; V1 takes it as `--variant`. The claim route clamps the
+        // effort to the model's advertised variants, so a present value is
+        // always valid; absent means use the model's own default.
+        if (generation === 1) {
+            args.push("--model", options.model);
+            if (options.reasoningEffort && !hasArg(options.extraArgs, "--variant")) {
+                args.push("--variant", options.reasoningEffort);
+            }
+        }
+        else {
+            args.push("--model", options.reasoningEffort ? `${options.model}#${options.reasoningEffort}` : options.model);
+        }
     }
     const run = (runArgs) => runOptions.dockerExec
         ? runViaDocker(runOptions, runArgs, options.prompt)
@@ -110,10 +129,20 @@ function isLogLevelRejection(stderr) {
 function resetOpenCodeLogLevelCache() {
     openCodeLogLevels.clear();
 }
+/**
+ * V1 prints a bare `1.19.1`, V2 `opencode v2.0.17`. Anything unrecognized
+ * keeps the V2 dialect the adapter has always written.
+ */
+function openCodeGeneration(version) {
+    if (version.exitCode !== 0)
+        return 2;
+    const major = version.stdout.match(/^\s*(?:opencode\s+)?v?(\d+)\.\d+\.\d+/i)?.[1];
+    return major !== undefined && Number(major) < 2 ? 1 : 2;
+}
 function hasArg(args, ...flags) {
     return args.some((arg) => flags.some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
 }
-async function prepareOpenCodeConfig(mcpConfigPath, env, inDocker) {
+async function prepareOpenCodeConfig(mcpConfigPath, env, inDocker, generation) {
     if (!mcpConfigPath) {
         throw new Error("OpenCode requires a per-session MCP config path for isolated execution.");
     }
@@ -143,28 +172,46 @@ async function prepareOpenCodeConfig(mcpConfigPath, env, inDocker) {
         mcp[name] = {
             type: "remote",
             url,
-            disabled: false,
+            ...(generation === 1 ? { enabled: true } : { disabled: false }),
             oauth: false,
             ...(Object.keys(headers).length > 0 ? { headers } : {}),
         };
     }
-    const config = {
-        $schema: "https://opencode.ai/config.json",
-        update: "disable",
-        share: "disabled",
-        plugins: [],
-        mcp: { servers: mcp },
-        permissions: [
-            { action: "*", resource: "*", effect: "allow" },
-            { action: "external_directory", resource: "*", effect: "deny" },
-            ...(await openCodeManagedDirectories(env, inDocker)).map((resource) => ({
-                action: "external_directory",
-                resource,
-                effect: "allow",
-            })),
-            { action: "question", resource: "*", effect: "deny" },
-        ],
-    };
+    const managedDirectories = await openCodeManagedDirectories(env, inDocker);
+    // Same policy in both dialects; in each the last matching rule wins.
+    const config = generation === 1
+        ? {
+            $schema: "https://opencode.ai/config.json",
+            autoupdate: false,
+            share: "disabled",
+            plugin: [],
+            mcp,
+            permission: {
+                "*": "allow",
+                external_directory: {
+                    "*": "deny",
+                    ...Object.fromEntries(managedDirectories.map((resource) => [resource, "allow"])),
+                },
+                question: "deny",
+            },
+        }
+        : {
+            $schema: "https://opencode.ai/config.json",
+            update: "disable",
+            share: "disabled",
+            plugins: [],
+            mcp: { servers: mcp },
+            permissions: [
+                { action: "*", resource: "*", effect: "allow" },
+                { action: "external_directory", resource: "*", effect: "deny" },
+                ...managedDirectories.map((resource) => ({
+                    action: "external_directory",
+                    resource,
+                    effect: "allow",
+                })),
+                { action: "question", resource: "*", effect: "deny" },
+            ],
+        };
     const configPath = `${mcpConfigPath}.opencode.json`;
     const configDir = `${mcpConfigPath}.opencode-config`;
     const xdgConfigHome = `${mcpConfigPath}.opencode-xdg`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.118",
+  "version": "0.1.120",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",