@wenrwa/marketplace-cli 0.7.7 → 0.8.1

package/dist/__tests__/bridge-activity-tail.test.js

@@ -85,6 +85,22 @@ describe('startActivityTail', () => {
         expect(records).toEqual([{ sessionId: 's1', filePaths: ['src/foo.ts'], tool: 'Edit' }]);
         handle.close();
     });
+    it('oc-22: carries kind needs_you through; every other kind stays off the record (Claude records unchanged)', () => {
+        const file = tmpFile();
+        fs.writeFileSync(file, '');
+        const { scheduleInterval, cancelInterval, tick } = fakeInterval();
+        const records = [];
+        (0, activityTail_1.startActivityTail)({ file, onRecord: (r) => records.push(r), scheduleInterval, cancelInterval });
+        fs.appendFileSync(file, JSON.stringify({ sessionId: 's1', kind: 'needs_you', thinking: 'Waiting for you' }) + '\n');
+        fs.appendFileSync(file, JSON.stringify({ sessionId: 's1', kind: 'stop', thinking: '' }) + '\n');
+        fs.appendFileSync(file, JSON.stringify({ sessionId: 's1', kind: 'tool', thinking: 'Reading a.ts' }) + '\n');
+        tick();
+        expect(records).toEqual([
+            { sessionId: 's1', kind: 'needs_you', thinking: 'Waiting for you' },
+            { sessionId: 's1', thinking: '' },
+            { sessionId: 's1', thinking: 'Reading a.ts' },
+        ]);
+    });
     it('does NOT replay bytes already in the file before the tail started', () => {
         const file = tmpFile();
         fs.writeFileSync(file, JSON.stringify({ sessionId: 'pre-existing', thinking: 'old' }) + '\n');

package/dist/__tests__/bridge-attach-paste-engine.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-attach-paste-engine.test.js

@@ -0,0 +1,108 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * oc-16 — image paste parity. After `attach-file` writes the image, an
+ * OpenCode session gets the path as a BRACKETED PASTE with no Enter (its TUI
+ * turns a pasted image path into an `[Image N]` attachment); a Claude Code
+ * session is byte-identical to before (nothing reaches the PTY from the
+ * bridge). Same shared handler on both lanes.
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const sessionManager_1 = require("../bridge/sessionManager");
+const attachmentWriter_1 = require("../bridge/attachmentWriter");
+class FakePty {
+    written = [];
+    write(d) { this.written.push(d); }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const PNG = Buffer.from('89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c4890000000d4944415478da63f8cfc0f01f0005000201a5f3b4d60000000049454e44ae426082', 'hex');
+let tmp;
+let ptys;
+let sessions;
+beforeEach(() => {
+    tmp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'attach-paste-')));
+    ptys = [];
+    sessions = new sessionManager_1.SessionManager({ spawn: () => { const p = new FakePty(); ptys.push(p); return p; } });
+});
+afterEach(() => { fs.rmSync(tmp, { recursive: true, force: true }); });
+const frame = (sessionId) => ({ rid: 'r', sessionId, name: 'a.png', data: PNG.toString('base64') });
+describe('pastePayloadFor', () => {
+    it('opencode: exact bracketed paste, no Enter', () => {
+        expect((0, attachmentWriter_1.pastePayloadFor)('opencode', '/w/.hiveop/attachments/x.png')).toBe('\x1b[200~/w/.hiveop/attachments/x.png\x1b[201~');
+    });
+    it('opencode: spaces in the path are backslash-escaped', () => {
+        expect((0, attachmentWriter_1.pastePayloadFor)('opencode', '/My Repo/a.png')).toBe('\x1b[200~/My\\ Repo/a.png\x1b[201~');
+    });
+    it('claude / unknown: nothing', () => {
+        expect((0, attachmentWriter_1.pastePayloadFor)('claude', '/w/x.png')).toBeNull();
+        expect((0, attachmentWriter_1.pastePayloadFor)(undefined, '/w/x.png')).toBeNull();
+    });
+});
+describe('handleAttachFrame engine dispatch', () => {
+    it('opencode session: file in the same place, paste written once, no \\r', () => {
+        sessions.open({ cols: 80, rows: 24, cwd: tmp, id: 'oc', command: 'opencode' });
+        const reply = (0, attachmentWriter_1.handleAttachFrame)(frame('oc'), sessions);
+        expect(reply.ok).toBe(true);
+        expect(reply.path.startsWith(path.join(tmp, attachmentWriter_1.ATTACHMENTS_DIR) + path.sep)).toBe(true);
+        expect(fs.readFileSync(reply.path).equals(PNG)).toBe(true);
+        expect(ptys[0].written).toEqual([`\x1b[200~${reply.path}\x1b[201~`]);
+        expect(ptys[0].written.join('')).not.toMatch(/[\r\n]/);
+        expect(reply.pasted).toBe(true);
+    });
+    it('claude session: nothing written to the PTY, reply unchanged', () => {
+        sessions.open({ cols: 80, rows: 24, cwd: tmp, id: 'cc', command: 'claude' });
+        const reply = (0, attachmentWriter_1.handleAttachFrame)(frame('cc'), sessions);
+        expect(reply.ok).toBe(true);
+        expect(reply).not.toHaveProperty('pasted');
+        expect(ptys[0].written).toEqual([]);
+    });
+    it('bare shell session: nothing written', () => {
+        sessions.open({ cols: 80, rows: 24, cwd: tmp, id: 'sh' });
+        (0, attachmentWriter_1.handleAttachFrame)(frame('sh'), sessions);
+        expect(ptys[0].written).toEqual([]);
+    });
+    it('failed write on an opencode session pastes nothing', () => {
+        sessions.open({ cols: 80, rows: 24, cwd: tmp, id: 'oc', command: 'opencode' });
+        const reply = (0, attachmentWriter_1.handleAttachFrame)({ ...frame('oc'), data: Buffer.from('hello').toString('base64') }, sessions);
+        expect(reply.ok).toBe(false);
+        expect(ptys[0].written).toEqual([]);
+    });
+});

package/dist/__tests__/bridge-attach-screenshot.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-attach-screenshot.test.js

@@ -0,0 +1,250 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Screenshot drop — `attach-screenshot {rid, sessionId, name}` (local bridge
+ * only). The browser cannot read a dropped macOS screenshot thumbnail, so the
+ * bridge reads `<screenshot folder>/<name>` once macOS has written it.
+ *
+ * Fake fs + fake clock: the folder is a Map, sleep advances the clock, so the
+ * ~6s poll runs instantly and deterministically. The attachment WRITE is real
+ * (temp dir), so the bytes on disk are compared with the bytes "dropped".
+ */
+const ws_1 = __importDefault(require("ws"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const server_1 = require("../bridge/server");
+const relayClient_1 = require("../bridge/relayClient");
+const sessionManager_1 = require("../bridge/sessionManager");
+const attachmentWriter_1 = require("../bridge/attachmentWriter");
+const screenshotAttach_1 = require("../bridge/screenshotAttach");
+class FakePty {
+    written = [];
+    write(d) { this.written.push(d); }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const PNG = Buffer.from('89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c4890000000d4944415478da63f8cfc0f01f0005000201a5f3b4d60000000049454e44ae426082', 'hex');
+const HOME = '/Users/me';
+const NAME = 'Screenshot 2026-10-04 at 9.41.12 AM.png';
+/** A fake screenshot folder: files appear at a given fake time. */
+function fakeDeps(opts) {
+    let clock = 0;
+    const reads = [];
+    const deps = {
+        platform: opts.platform ?? 'darwin',
+        homedir: () => HOME,
+        readScreencaptureLocation: async () => (opts.location === undefined ? null : opts.location),
+        stat: (p) => {
+            const f = opts.files?.[p];
+            if (!f || clock < (f.at ?? 0))
+                return null;
+            return { isFile: f.isFile ?? true, size: f.data.length };
+        },
+        readFile: (p) => { reads.push(p); return opts.files[p].data; },
+        sleep: async (ms) => { clock += ms; },
+        now: () => clock,
+        attachment: attachmentWriter_1.realAttachmentDeps,
+    };
+    return { deps, reads, clock: () => clock };
+}
+let tmp;
+const sessions = () => ({ list: () => ['agent-1'], cwdOf: () => tmp });
+beforeEach(() => { tmp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'shot-'))); });
+afterEach(() => { fs.rmSync(tmp, { recursive: true, force: true }); });
+describe('screenshot folder resolution', () => {
+    it('defaults to ~/Desktop, expands ~, ignores relative junk', () => {
+        expect((0, screenshotAttach_1.resolveScreenshotFolder)(null, HOME)).toBe('/Users/me/Desktop');
+        expect((0, screenshotAttach_1.resolveScreenshotFolder)('  \n', HOME)).toBe('/Users/me/Desktop');
+        expect((0, screenshotAttach_1.resolveScreenshotFolder)('~/Pictures/Screenshots\n', HOME)).toBe('/Users/me/Pictures/Screenshots');
+        expect((0, screenshotAttach_1.resolveScreenshotFolder)('~', HOME)).toBe('/Users/me');
+        expect((0, screenshotAttach_1.resolveScreenshotFolder)('/Volumes/Shots/', HOME)).toBe('/Volumes/Shots/');
+        expect((0, screenshotAttach_1.resolveScreenshotFolder)('Pictures', HOME)).toBe('/Users/me/Desktop');
+    });
+    it('accepts only a plain image basename', () => {
+        expect((0, screenshotAttach_1.isSafeScreenshotName)(NAME)).toBe(true);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('shot.JPEG')).toBe(true);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('shot.webp')).toBe(true);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('../secret.png')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('a/b.png')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('a\\b.png')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('..png')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('.hidden.png')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('x.png\0.txt')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('shot.heic')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('notes.txt')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)('noext')).toBe(false);
+        expect((0, screenshotAttach_1.isSafeScreenshotName)(42)).toBe(false);
+    });
+});
+describe('handleScreenshotFrame', () => {
+    it('finds the file after macOS writes it (delay) and saves it via the attach writer', async () => {
+        const file = path.join('/Users/me/Pictures/Shots', NAME);
+        const f = fakeDeps({ location: '~/Pictures/Shots', files: { [file]: { data: PNG, at: 1500 } } });
+        const reply = await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r1', sessionId: 'agent-1', name: NAME }, sessions(), f.deps);
+        expect(reply).toMatchObject({ t: 'file-attached', rid: 'r1', sessionId: 'agent-1', ok: true, bytes: PNG.length });
+        expect(f.clock()).toBe(1500);
+        const saved = String(reply.path);
+        expect(path.dirname(saved)).toBe(path.join(tmp, attachmentWriter_1.ATTACHMENTS_DIR));
+        expect(saved.endsWith('-Screenshot-2026-10-04-at-9.41.12-AM.png')).toBe(true);
+        expect(fs.readFileSync(saved).equals(PNG)).toBe(true);
+        expect(f.reads).toEqual([file]);
+    });
+    it('defaults to ~/Desktop when no location is set', async () => {
+        const f = fakeDeps({ files: { [path.join('/Users/me/Desktop', NAME)]: { data: PNG } } });
+        const reply = await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: NAME }, sessions(), f.deps);
+        expect(reply.ok).toBe(true);
+        expect(f.clock()).toBe(0);
+    });
+    it('gives up with not-found after ~6s', async () => {
+        const f = fakeDeps({});
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: NAME }, sessions(), f.deps))
+            .toEqual({ t: 'file-attached', rid: 'r', sessionId: 'agent-1', ok: false, reason: 'not-found' });
+        expect(f.clock()).toBe(screenshotAttach_1.SCREENSHOT_POLL_MS);
+        expect(fs.existsSync(path.join(tmp, '.hiveop'))).toBe(false);
+    });
+    it('rejects path traversal without touching the disk', async () => {
+        const f = fakeDeps({ files: { '/Users/me/secret.png': { data: PNG } } });
+        for (const name of ['../secret.png', '/Users/me/secret.png', 'sub/../../secret.png']) {
+            expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name }, sessions(), f.deps))
+                .toMatchObject({ ok: false, reason: 'bad-name' });
+        }
+        expect(f.reads).toEqual([]);
+    });
+    it('rejects non-image names and non-image bytes', async () => {
+        const file = path.join('/Users/me/Desktop', 'shot.png');
+        const f = fakeDeps({ files: { [file]: { data: Buffer.from('not an image at all') } } });
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: 'notes.txt' }, sessions(), f.deps))
+            .toMatchObject({ ok: false, reason: 'bad-name' });
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: 'shot.heic' }, sessions(), f.deps))
+            .toMatchObject({ ok: false, reason: 'bad-name' });
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: 'shot.png' }, sessions(), f.deps))
+            .toMatchObject({ ok: false, reason: 'not-image' });
+        expect(fs.existsSync(path.join(tmp, '.hiveop'))).toBe(false);
+    });
+    it('refuses a symlink/dir by that name, an oversize file, an unknown session, and non-macOS', async () => {
+        const file = path.join('/Users/me/Desktop', 'shot.png');
+        const link = fakeDeps({ files: { [file]: { data: PNG, isFile: false } } });
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: 'shot.png' }, sessions(), link.deps))
+            .toMatchObject({ ok: false, reason: 'not-image' });
+        expect(link.reads).toEqual([]);
+        const big = fakeDeps({ files: { [file]: { data: Buffer.alloc(attachmentWriter_1.MAX_ATTACHMENT_BYTES + 1) } } });
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: 'shot.png' }, sessions(), big.deps))
+            .toMatchObject({ ok: false, reason: 'too-large' });
+        expect(big.reads).toEqual([]);
+        const ok = fakeDeps({ files: { [file]: { data: PNG } } });
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'nope', name: 'shot.png' }, sessions(), ok.deps))
+            .toMatchObject({ ok: false, reason: 'no-session' });
+        const linux = fakeDeps({ platform: 'linux', files: { [file]: { data: PNG } } });
+        expect(await (0, screenshotAttach_1.handleScreenshotFrame)({ rid: 'r', sessionId: 'agent-1', name: 'shot.png' }, sessions(), linux.deps))
+            .toMatchObject({ ok: false, reason: 'not-supported' });
+    });
+});
+function frameQueue(ws) {
+    const frames = [];
+    const waiters = [];
+    ws.on('message', (raw) => {
+        const f = JSON.parse(String(raw));
+        const w = waiters.shift();
+        if (w)
+            w(f);
+        else
+            frames.push(f);
+    });
+    return { next: () => (frames.length ? Promise.resolve(frames.shift()) : new Promise((r) => waiters.push(r))) };
+}
+describe('local bridge server — attach-screenshot frame', () => {
+    let handle;
+    afterEach(async () => { await handle?.close(); });
+    it('answers over the loopback socket and advertises attach-screenshot on macOS', async () => {
+        const pty = new FakePty();
+        const mgr = new sessionManager_1.SessionManager({ spawn: () => pty });
+        const f = fakeDeps({ files: { [path.join('/Users/me/Desktop', NAME)]: { data: PNG, at: 500 } } });
+        handle = await (0, server_1.startBridgeServer)({ sessionToken: 'tok', allowedOrigin: 'https://app.hiveop.io', sessions: mgr, screenshotDeps: f.deps });
+        const sessionId = mgr.open({ cols: 80, rows: 24, cwd: tmp, id: 'agent-1' });
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: 'https://app.hiveop.io' } });
+        expect((await res.json()).capabilities).toEqual(expect.arrayContaining(['terminal-attach', 'attach-screenshot']));
+        const ws = new ws_1.default(`ws://127.0.0.1:${handle.port}`, { headers: { origin: 'https://app.hiveop.io' } });
+        await new Promise((r) => ws.on('open', r));
+        const q = frameQueue(ws);
+        ws.send(JSON.stringify({ v: 1, token: 'tok' }));
+        ws.send(JSON.stringify({ t: 'attach-screenshot', rid: 's1', sessionId, name: NAME }));
+        const reply = await q.next();
+        expect(reply).toMatchObject({ t: 'file-attached', rid: 's1', sessionId, ok: true });
+        expect(fs.readFileSync(reply.path).equals(PNG)).toBe(true);
+        expect(pty.written).toEqual([]);
+        ws.close();
+    });
+    it('does not advertise attach-screenshot off macOS', async () => {
+        const mgr = new sessionManager_1.SessionManager({ spawn: () => new FakePty() });
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: 'tok', allowedOrigin: 'https://app.hiveop.io', sessions: mgr,
+            screenshotDeps: fakeDeps({ platform: 'linux' }).deps,
+        });
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: 'https://app.hiveop.io' } });
+        const caps = (await res.json()).capabilities;
+        expect(caps).toContain('terminal-attach');
+        expect(caps).not.toContain('attach-screenshot');
+    });
+});
+describe('relay client (hosted) — never answers attach-screenshot', () => {
+    it('sends no file-attached for the frame', async () => {
+        const { WebSocketServer } = await Promise.resolve().then(() => __importStar(require('ws')));
+        const wss = new WebSocketServer({ port: 0, host: '127.0.0.1' });
+        await new Promise((r) => wss.on('listening', r));
+        const port = wss.address().port;
+        const conn = new Promise((r) => wss.on('connection', r));
+        const mgr = new sessionManager_1.SessionManager({ spawn: () => new FakePty() });
+        mgr.open({ cols: 80, rows: 24, cwd: tmp, id: 'agent-H' });
+        const client = (0, relayClient_1.startRelayClient)({ relayUrl: `ws://127.0.0.1:${port}`, relayToken: 'tok', sessions: mgr });
+        const ws = await conn;
+        const got = [];
+        ws.on('message', (raw) => got.push(JSON.parse(String(raw))));
+        await new Promise((r) => setTimeout(r, 50)); // auth frame
+        ws.send(JSON.stringify({ t: 'attach-screenshot', rid: 'h1', sessionId: 'agent-H', name: 'shot.png' }));
+        await new Promise((r) => setTimeout(r, 200));
+        expect(got.filter((f) => f.t === 'file-attached')).toEqual([]);
+        client.close();
+        for (const c of wss.clients)
+            c.terminate();
+        await new Promise((r) => wss.close(r));
+    });
+});

package/dist/__tests__/bridge-bundle-installer-opencode.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-bundle-installer-opencode.test.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/** oc-18 — engine dispatch at the single bundle write site (both lanes use installBundle). */
+const bundleInstaller_1 = require("../bridge/bundleInstaller");
+const MARK = '## Prompt Defense Baseline';
+const agent = (d) => `---\nname: ${d}\ndescription: ${d}\ntools: Read\nmodel: sonnet\n---\nbody\n${MARK}\n`;
+const makeFs = (seed = {}) => {
+    const files = new Map(Object.entries(seed));
+    return {
+        files,
+        deps: {
+            reposBaseDir: '/data/repos',
+            mkdirp: () => { },
+            writeFile: (p, c) => { files.set(p, c); },
+            listDir: (d) => [...files.keys()].filter((k) => k.startsWith(d + '/')).map((k) => k.slice(d.length + 1)),
+            readFile: (p) => files.get(p) ?? '',
+            remove: (p) => { files.delete(p); },
+        },
+    };
+};
+const BUNDLE = {
+    'CLAUDE.md': '# c\n',
+    '.claude/agents/a.md': agent('a'),
+    '.claude/skills/s/SKILL.md': 'skill',
+};
+describe('installBundle engine dispatch', () => {
+    it('no engine: Claude files, byte-identical to before', () => {
+        const { files, deps } = makeFs();
+        const r = (0, bundleInstaller_1.installBundle)({ workspaceId: 'w', files: BUNDLE }, deps);
+        expect(r.written.sort()).toEqual(['.claude/agents/a.md', '.claude/skills/s/SKILL.md', 'CLAUDE.md']);
+        expect(files.get('/data/repos/w/.claude/agents/a.md')).toBe(BUNDLE['.claude/agents/a.md']);
+        expect(files.has('/data/repos/w/AGENTS.md')).toBe(false);
+    });
+    it('engine=claude behaves like no engine', () => {
+        const { deps } = makeFs();
+        expect((0, bundleInstaller_1.installBundle)({ workspaceId: 'w', engine: 'claude', files: BUNDLE }, deps).written).toContain('CLAUDE.md');
+    });
+    it('engine=opencode writes translated OpenCode files, not .claude/agents or CLAUDE.md', () => {
+        const { files, deps } = makeFs();
+        const r = (0, bundleInstaller_1.installBundle)({ workspaceId: 'w', engine: 'opencode', files: BUNDLE }, deps);
+        expect(r.written.sort()).toEqual(['.claude/skills/s/SKILL.md', '.opencode/agent/a.md', 'AGENTS.md']);
+        expect(files.get('/data/repos/w/.opencode/agent/a.md')).toContain('mode: subagent');
+        expect(files.get('/data/repos/w/.opencode/agent/a.md')).not.toMatch(/^model:/m);
+        expect(files.get('/data/repos/w/AGENTS.md')).toBe('# c\n');
+        expect(r.skipped).toEqual([]);
+    });
+    it('engine=opencode still refuses unsafe and unmanaged paths', () => {
+        const { deps } = makeFs();
+        const r = (0, bundleInstaller_1.installBundle)({ workspaceId: 'w', engine: 'opencode', files: { '../x': 'a', 'package.json': 'b', '.opencode/agent/../../evil': 'c' } }, deps);
+        expect(r.written).toEqual([]);
+        expect(r.skipped.length).toBe(3);
+    });
+    it('engine=opencode crew swap prunes stale marker-carrying .opencode/agent files, keeps hand-written ones', () => {
+        const { files, deps } = makeFs({
+            '/data/repos/w/.opencode/agent/old.md': `x\n${MARK}\n`,
+            '/data/repos/w/.opencode/agent/mine.md': 'hand written',
+        });
+        const r = (0, bundleInstaller_1.installBundle)({ workspaceId: 'w', engine: 'opencode', files: BUNDLE }, deps);
+        expect(r.pruned).toEqual(['.opencode/agent/old.md']);
+        expect(files.has('/data/repos/w/.opencode/agent/mine.md')).toBe(true);
+        expect(files.has('/data/repos/w/.opencode/agent/a.md')).toBe(true);
+    });
+    it('local lane (explicit workspaceRoot) dispatches the same way', () => {
+        const { files, deps } = makeFs();
+        (0, bundleInstaller_1.installBundle)({ workspaceId: 'ignored/..', engine: 'opencode', files: BUNDLE }, { ...deps, reposBaseDir: '', workspaceRoot: '/Users/me/app' });
+        expect(files.has('/Users/me/app/AGENTS.md')).toBe(true);
+        expect(files.has('/Users/me/app/.opencode/agent/a.md')).toBe(true);
+    });
+});

package/dist/__tests__/bridge-context-engine.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-context-engine.test.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * oc-23 — the context writers are engine-aware. Claude Code reads CLAUDE.md; OpenCode reads
+ * AGENTS.md and ignores CLAUDE.md the moment AGENTS.md exists (oc-18 notes).
+ *
+ *   hosted: contextWriter writes the engine's own file, and keeps a sibling that already
+ *           exists in sync (one checkout can hold a Claude agent and an OpenCode agent).
+ *   local : the bridge only ever writes `.hiveop/context.md` (ADR-0035 file-write boundary);
+ *           Claude loads it via a SessionStart hook, OpenCode via its `instructions` config.
+ */
+const contextFile_1 = require("../bridge/contextFile");
+const contextWriter_1 = require("../bridge/contextWriter");
+const opencodeConfig_1 = require("../bridge/opencodeConfig");
+const agentLaunch_1 = require("../bridge/agentLaunch");
+const BASE = '/data/repos';
+const CLAUDE = '/data/repos/ws-1/CLAUDE.md';
+const AGENTS = '/data/repos/ws-1/AGENTS.md';
+const region = (body) => `${contextWriter_1.CONTEXT_START_MARKER}\n${body}\n${contextWriter_1.CONTEXT_END_MARKER}`;
+const makeFs = (seed = {}) => {
+    const files = new Map(Object.entries(seed));
+    return {
+        files,
+        deps: {
+            reposBaseDir: BASE,
+            exists: (p) => files.has(p),
+            readFile: (p) => files.get(p) ?? '',
+            writeFile: (p, c) => { files.set(p, c); },
+            mkdirp: () => { },
+        },
+    };
+};
+describe('contextFileFor', () => {
+    it('maps the engine to the file that engine reads', () => {
+        expect((0, contextFile_1.contextFileFor)('opencode')).toBe('AGENTS.md');
+        expect((0, contextFile_1.contextFileFor)('claude_code')).toBe('CLAUDE.md');
+        expect((0, contextFile_1.contextFileFor)(undefined)).toBe('CLAUDE.md');
+        expect((0, contextFile_1.contextFileFor)('something-new')).toBe('CLAUDE.md');
+    });
+    it('targets: own file first, plus the sibling only when it already exists', () => {
+        const none = () => false;
+        expect((0, contextFile_1.contextTargets)('opencode', none)).toEqual(['AGENTS.md']);
+        expect((0, contextFile_1.contextTargets)('claude_code', none)).toEqual(['CLAUDE.md']);
+        expect((0, contextFile_1.contextTargets)('opencode', (f) => f === 'CLAUDE.md')).toEqual(['AGENTS.md', 'CLAUDE.md']);
+        expect((0, contextFile_1.contextTargets)(undefined, (f) => f === 'AGENTS.md')).toEqual(['CLAUDE.md', 'AGENTS.md']);
+    });
+});
+describe('hosted writeContext by engine', () => {
+    it('claude (or no engine): CLAUDE.md only, no AGENTS.md created', () => {
+        const { files, deps } = makeFs();
+        const r = (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'ctx' }, deps);
+        expect(r.action).toBe('created');
+        expect(files.get(CLAUDE)).toBe(region('ctx') + '\n');
+        expect(files.has(AGENTS)).toBe(false);
+    });
+    it('opencode: writes AGENTS.md and does not create CLAUDE.md', () => {
+        const { files, deps } = makeFs();
+        const r = (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'ctx', engine: 'opencode' }, deps);
+        expect(r.action).toBe('created');
+        expect(r.contextPaths).toEqual([AGENTS]);
+        expect(files.get(AGENTS)).toBe(region('ctx') + '\n');
+        expect(files.has(CLAUDE)).toBe(false);
+    });
+    it('opencode: a first AGENTS.md is seeded from the user CLAUDE.md so its guidance is not hidden', () => {
+        const user = '# Mine\n\nKeep tests green.\n';
+        const { files, deps } = makeFs({ [CLAUDE]: user });
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'ctx', engine: 'opencode' }, deps);
+        expect(files.get(AGENTS).startsWith(user)).toBe(true);
+        expect(files.get(AGENTS)).toContain(region('ctx'));
+        // the sibling that already existed stays in sync
+        expect(files.get(CLAUDE)).toContain(region('ctx'));
+        expect(files.get(CLAUDE).startsWith(user)).toBe(true);
+    });
+    it('mixed checkout: each engine write keeps the other file current, one region each', () => {
+        const { files, deps } = makeFs();
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'v1' }, deps);
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'v1', engine: 'opencode' }, deps);
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'v2' }, deps); // a later claude manifest
+        for (const p of [CLAUDE, AGENTS]) {
+            expect(files.get(p)).toContain(region('v2'));
+            expect(files.get(p).split(contextWriter_1.CONTEXT_START_MARKER).length - 1).toBe(1);
+        }
+    });
+    it('pointers-only refresh by opencode keeps pushed content in AGENTS.md', () => {
+        const { files, deps } = makeFs();
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'pushed', engine: 'opencode' }, deps);
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', pointersOnly: true, workGraphAvailable: true, engine: 'opencode' }, deps);
+        expect(files.get(AGENTS)).toContain('pushed');
+    });
+    it('empty content removes the region from every file it touches', () => {
+        const { files, deps } = makeFs();
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'x' }, deps);
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'x', engine: 'opencode' }, deps);
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: '', engine: 'opencode' }, deps);
+        expect(files.get(AGENTS) ?? '').not.toContain(contextWriter_1.CONTEXT_START_MARKER);
+        expect(files.get(CLAUDE) ?? '').not.toContain(contextWriter_1.CONTEXT_START_MARKER);
+    });
+});
+describe('local OpenCode reads .hiveop/context.md through its instructions config', () => {
+    it('canonical config: instructions only when asked', () => {
+        const base = { model: 'm', gatewayBaseUrl: 'https://g/v1' };
+        expect((0, opencodeConfig_1.buildOpencodeConfig)(base).instructions).toBeUndefined();
+        expect((0, opencodeConfig_1.buildOpencodeConfig)({ ...base, instructions: ['.hiveop/context.md'] }).instructions).toEqual(['.hiveop/context.md']);
+    });
+    it('a local opencode launch loads the bridge context file; the Claude launch is unchanged', () => {
+        const l = (0, agentLaunch_1.resolveAgentLaunch)({
+            opencode: { engine: 'opencode', model: 'm', gatewayUrl: 'https://g/v1', gatewayToken: 't' },
+        });
+        expect(JSON.parse(l.env.OPENCODE_CONFIG_CONTENT).instructions).toEqual(['.hiveop/context.md']);
+        expect((0, agentLaunch_1.resolveAgentLaunch)({}).env.OPENCODE_CONFIG_CONTENT).toBeUndefined();
+    });
+});

package/dist/__tests__/bridge-context-manifest-frame.test.js

@@ -65,6 +65,25 @@ function closeRelay(wss) {
     });
 }
 describe('relay client — context-manifest frame (pucc-int-01)', () => {
+    it('oc-23: passes the frame engine to the writer, and omits it when absent', async () => {
+        const relay = await startFakeRelay();
+        const sessions = new sessionManager_1.SessionManager(makeFactory());
+        const calls = [];
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            writeContext: (m) => { calls.push(m); return { action: 'created', claudeMdPath: null }; },
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.next(); // auth
+        ws.send(JSON.stringify({ t: 'context-manifest', workspaceId: 'ws-7', content: 'a', engine: 'opencode' }));
+        await q.next();
+        expect(calls).toEqual([{ workspaceId: 'ws-7', content: 'a', engine: 'opencode' }]);
+        handle.close();
+        await closeRelay(relay.wss);
+    });
     it('routes a context-manifest frame to the injected writer and acks context-written', async () => {
         const relay = await startFakeRelay();
         const sessions = new sessionManager_1.SessionManager(makeFactory());

package/dist/__tests__/bridge-crew-translator.test.d.ts

@@ -0,0 +1 @@
+export {};