ai-push-hooks 0.3.0 → 0.3.2

package/src/ai_push_hooks/executors/runners/opencode.py

@@ -1,8 +1,8 @@
 """OpenCode adapter for the internal runner boundary.
 
-The compatibility invocation deliberately remains the shipped ``opencode
-run`` shape.  This module owns the adapter-level protocol and lifecycle
-semantics; workflow retries and JSON/schema handling remain in orchestration.
+The adapter deliberately retains the shipped ``opencode run`` shape.  This
+module owns the adapter-level protocol and lifecycle semantics; workflow
+retries and JSON/schema handling remain in orchestration.
 """
 
 from __future__ import annotations
@@ -14,7 +14,7 @@ import sys
 import tempfile
 from typing import Any
 
-from ..ask import (
+from .opencode_support import (
     OPENCODE_APPLY_AGENT,
     OPENCODE_READ_ONLY_AGENT,
     _transcript_dir,
@@ -23,10 +23,13 @@ from ..ask import (
     opencode_isolation_env,
     resolve_opencode_executable,
     sanitize_filename_component,
-    validate_opencode_attachments,
+    validate_hook_owned_artifacts,
+)
+from ...paths import (
+    ensure_private_directory,
+    resolve_contained_path,
+    write_text_no_follow,
 )
-from ...paths import resolve_contained_path, write_text_no_follow
-from ...paths import ensure_private_directory
 from .process import ProcessResult
 from .contracts import (
     RunnerCapabilities,
@@ -66,7 +69,9 @@ class OpenCodeRunner:
         session_id: str | None = None
         text_parts: list[str] = []
 
-        def protocol_failure(message: str, *, missing: bool = False) -> RunnerProtocolError:
+        def protocol_failure(
+            message: str, *, missing: bool = False
+        ) -> RunnerProtocolError:
             error: RunnerProtocolError
             if missing:
                 error = RunnerMissingOutputError(message)
@@ -87,7 +92,9 @@ class OpenCodeRunner:
             try:
                 event = json.loads(line)
             except json.JSONDecodeError as exc:
-                raise protocol_failure("OpenCode emitted malformed JSONL output") from exc
+                raise protocol_failure(
+                    "OpenCode emitted malformed JSONL output"
+                ) from exc
             if not isinstance(event, dict):
                 raise protocol_failure("OpenCode emitted a non-object JSONL event")
 
@@ -159,7 +166,7 @@ class OpenCodeRunner:
         # Validate source ownership and symlink traversal before making any
         # copy.  The source is then never reopened: its logical snapshot is
         # the only content sent through OpenCode's native --file transport.
-        validate_opencode_attachments(
+        validate_hook_owned_artifacts(
             context,
             [path for path in original_paths if path is not None],
         )
@@ -221,7 +228,11 @@ class OpenCodeRunner:
         *,
         prompt: str,
     ) -> list[str]:
-        agent = OPENCODE_APPLY_AGENT if request.mode == "apply" else OPENCODE_READ_ONLY_AGENT
+        agent = (
+            OPENCODE_APPLY_AGENT
+            if request.mode == "apply"
+            else OPENCODE_READ_ONLY_AGENT
+        )
         config = getattr(getattr(context, "config", None), "llm", None)
         title_prefix = getattr(config, "session_title_prefix", "ai-push-hooks")
         argv = [
@@ -251,6 +262,34 @@ class OpenCodeRunner:
         argv.extend(["--", prompt])
         return argv
 
+    @staticmethod
+    def _require_staging_directory(
+        context: Any, working_directory: pathlib.Path
+    ) -> None:
+        """Reject repository worktrees as apply targets.
+
+        The apply workflow supplies a disposable, non-VCS staging projection.
+        A runner request can identify the repository root and the selected cwd,
+        but it cannot turn an arbitrary host directory into a sandbox.  Refuse
+        the known unsafe cases at this boundary instead of granting edit
+        permissions to the checked-out repository.
+        """
+
+        repository_root = context.repo_root.resolve(strict=True)
+        if working_directory == repository_root or working_directory.is_relative_to(
+            repository_root
+        ):
+            raise RunnerContractError(
+                "OpenCode apply requests require an isolated staging directory"
+            )
+        if any(
+            (parent / ".git").exists()
+            for parent in (working_directory, *working_directory.parents)
+        ):
+            raise RunnerContractError(
+                "OpenCode apply requests require a non-VCS isolated staging directory"
+            )
+
     def run(self, request: RunnerRequest) -> RunnerResult:
         if request.runner_type != "opencode":
             raise RunnerContractError(
@@ -268,8 +307,19 @@ class OpenCodeRunner:
         else:
             working_directory = None
 
-        if working_directory is not None and not working_directory.is_dir():
-            raise RunnerContractError("OpenCode request cwd must be an existing directory")
+        if working_directory is not None:
+            try:
+                working_directory = working_directory.resolve(strict=True)
+            except (OSError, RuntimeError) as exc:
+                raise RunnerContractError(
+                    "OpenCode request cwd must be an existing directory"
+                ) from exc
+            if not working_directory.is_dir():
+                raise RunnerContractError(
+                    "OpenCode request cwd must be an existing directory"
+                )
+            if request.mode == "apply":
+                self._require_staging_directory(context, working_directory)
 
         agent = "apply" if request.mode == "apply" else "read-only"
         _agent_name, security_config = build_opencode_security_config(
@@ -282,12 +332,17 @@ class OpenCodeRunner:
                 working_directory if request.project_access == "project" else None
             ),
         )
-        executable = getattr(context, "opencode_executable", None) or resolve_opencode_executable()
+        executable = (
+            getattr(context, "opencode_executable", None)
+            or resolve_opencode_executable()
+        )
         isolated_env = opencode_isolation_env(context, security_config, request.stage)
         attachment_dir: pathlib.Path | None = None
         session_id: str | None = None
         try:
-            attachments, attachment_dir = self._materialize_attachments(context, request)
+            attachments, attachment_dir = self._materialize_attachments(
+                context, request
+            )
             # Every logical artifact is materialized, including pathless
             # contract artifacts.  Therefore native attachments carry the
             # complete snapshot and the instruction is never duplicated in a
@@ -322,14 +377,18 @@ class OpenCodeRunner:
 
             try:
                 if working_directory is None:
-                    with tempfile.TemporaryDirectory(prefix="ai-push-hooks-readonly-") as directory:
+                    with tempfile.TemporaryDirectory(
+                        prefix="ai-push-hooks-readonly-"
+                    ) as directory:
                         completed = invoke(pathlib.Path(directory).resolve(strict=True))
                 else:
-                    completed = invoke(working_directory.resolve(strict=True))
+                    completed = invoke(working_directory)
             except (RunnerError,) as error:
                 process_result = getattr(error, "_process_result", None)
                 partial_stdout = (
-                    process_result.stdout if isinstance(process_result, ProcessResult) else ""
+                    process_result.stdout
+                    if isinstance(process_result, ProcessResult)
+                    else ""
                 )
                 setattr(
                     error,
@@ -368,7 +427,9 @@ class OpenCodeRunner:
                 stdout=completed.stdout,
                 stderr=completed.stderr,
                 session=(
-                    SessionMetadata(session_id=session_id, state="persisted", resumable=True)
+                    SessionMetadata(
+                        session_id=session_id, state="persisted", resumable=True
+                    )
                     if session_id
                     else SessionMetadata()
                 ),
@@ -398,7 +459,9 @@ class OpenCodeRunner:
             non_agent_opencode_config(),
             request.stage,
         )
-        with tempfile.TemporaryDirectory(prefix=f"ai-push-hooks-session-{action}-") as directory:
+        with tempfile.TemporaryDirectory(
+            prefix=f"ai-push-hooks-session-{action}-"
+        ) as directory:
             return run_process(
                 argv,
                 cwd=pathlib.Path(directory).resolve(strict=True),
@@ -427,7 +490,10 @@ class OpenCodeRunner:
                     "OpenCode transcript path",
                 )
                 try:
-                    executable = getattr(context, "opencode_executable", None) or resolve_opencode_executable()
+                    executable = (
+                        getattr(context, "opencode_executable", None)
+                        or resolve_opencode_executable()
+                    )
                     exported = self._lifecycle_process(
                         request,
                         context,
@@ -440,10 +506,17 @@ class OpenCodeRunner:
                         and not getattr(exported, "stderr_truncated", False)
                         and exported.stdout.strip()
                     ):
-                        write_text_no_follow(transcript_path, exported.stdout.strip() + "\n")
+                        write_text_no_follow(
+                            transcript_path, exported.stdout.strip() + "\n"
+                        )
                     else:
                         transcript_path = None
-                        self._warn_export(context, request, session_id, "export returned no transcript")
+                        self._warn_export(
+                            context,
+                            request,
+                            session_id,
+                            "export returned no transcript",
+                        )
                 except Exception as exc:  # noqa: BLE001
                     transcript_path = None
                     self._warn_export(context, request, session_id, type(exc).__name__)
@@ -451,7 +524,10 @@ class OpenCodeRunner:
         deleted = False
         if getattr(context.config.llm, "delete_session_after_run", False):
             try:
-                executable = getattr(context, "opencode_executable", None) or resolve_opencode_executable()
+                executable = (
+                    getattr(context, "opencode_executable", None)
+                    or resolve_opencode_executable()
+                )
                 deleted_result = self._lifecycle_process(
                     request,
                     context,
@@ -460,9 +536,13 @@ class OpenCodeRunner:
                 )
                 deleted = deleted_result.returncode == 0
                 if not deleted:
-                    self._warn_export(context, request, session_id, "session deletion failed")
+                    self._warn_export(
+                        context, request, session_id, "session deletion failed"
+                    )
             except Exception as exc:  # noqa: BLE001
-                self._warn_export(context, request, session_id, f"delete {type(exc).__name__}")
+                self._warn_export(
+                    context, request, session_id, f"delete {type(exc).__name__}"
+                )
 
         state = "deleted" if deleted else "persisted"
         finalized_session = SessionMetadata(
@@ -481,7 +561,9 @@ class OpenCodeRunner:
         )
 
     @staticmethod
-    def _warn_export(context: Any, request: RunnerRequest, session_id: str, reason: str) -> None:
+    def _warn_export(
+        context: Any, request: RunnerRequest, session_id: str, reason: str
+    ) -> None:
         logger = getattr(context, "logger", None)
         if logger is not None:
             logger.warn(

package/src/ai_push_hooks/executors/runners/opencode_support.py

@@ -0,0 +1,286 @@
+"""Shared OpenCode isolation and hook-owned artifact policy helpers.
+
+This module contains only the OpenCode-specific filesystem, environment, and
+permission policy used by the active adapter.  Workflow orchestration remains
+runner-neutral and the adapter owns invocation and session lifecycle.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import pathlib
+import re
+import shutil
+from typing import Any
+
+from ...paths import (
+    ensure_private_directory,
+    is_path_within,
+    path_has_symlink,
+    resolve_contained_path,
+)
+from ...git_utils import ensure_dir, resolve_storage_path
+from ...types import HookError, RuntimeContext
+
+
+OPENCODE_READ_ONLY_AGENT = "ai-push-hooks-readonly"
+OPENCODE_APPLY_AGENT = "ai-push-hooks-apply"
+PROVIDER_ENV_PREFIXES = (
+    "ANTHROPIC_",
+    "AWS_",
+    "AZURE_",
+    "COHERE_",
+    "DEEPSEEK_",
+    "GEMINI_",
+    "GOOGLE_",
+    "GROQ_",
+    "MISTRAL_",
+    "OPENAI_",
+    "OPENROUTER_",
+    "VERTEX_",
+    "XAI_",
+)
+SAFE_PROCESS_ENV_NAMES = frozenset(
+    {
+        "PATH",
+        "TMPDIR",
+        "TMP",
+        "TEMP",
+        "LANG",
+        "LC_ALL",
+        "LC_CTYPE",
+        "SYSTEMROOT",
+    }
+)
+
+
+def _actual_xdg_data_home() -> pathlib.Path:
+    configured = os.environ.get("XDG_DATA_HOME", "").strip()
+    if configured:
+        return pathlib.Path(configured).expanduser().resolve(strict=False)
+    return (pathlib.Path.home() / ".local" / "share").resolve(strict=False)
+
+
+def opencode_isolation_env(
+    context: RuntimeContext,
+    security_config: dict[str, Any],
+    stage_name: str,
+) -> dict[str, str | None]:
+    lexical_isolation_root = (
+        context.run_dir / "opencode-isolation" / sanitize_filename_component(stage_name)
+    )
+    if path_has_symlink(context.run_dir, lexical_isolation_root):
+        raise HookError(
+            f"OpenCode isolation directory must not traverse a symlink: {stage_name}"
+        )
+    isolation_root = resolve_contained_path(
+        context.run_dir,
+        f"opencode-isolation/{sanitize_filename_component(stage_name)}",
+        "OpenCode isolation directory",
+    )
+    home = isolation_root / "home"
+    config_home = isolation_root / "config"
+    cache_home = isolation_root / "cache"
+    state_home = isolation_root / "state"
+    ensure_private_directory(isolation_root)
+    for path in (home, config_home, cache_home, state_home):
+        ensure_private_directory(path, private_root=isolation_root)
+
+    isolated: dict[str, str | None] = {
+        name: value
+        for name, value in os.environ.items()
+        if name in SAFE_PROCESS_ENV_NAMES or name.startswith(PROVIDER_ENV_PREFIXES)
+    }
+    isolated.update(
+        {
+            "HOME": str(home),
+            "XDG_CONFIG_HOME": str(config_home),
+            "XDG_CACHE_HOME": str(cache_home),
+            "XDG_STATE_HOME": str(state_home),
+            "XDG_DATA_HOME": str(_actual_xdg_data_home()),
+            "OPENCODE_CONFIG_CONTENT": json.dumps(security_config, ensure_ascii=True),
+            "OPENCODE_CONFIG_DIR": str(config_home),
+            "OPENCODE_PURE": "true",
+            "OPENCODE_DISABLE_PROJECT_CONFIG": "true",
+            "OPENCODE_DISABLE_EXTERNAL_SKILLS": "true",
+            "OPENCODE_DISABLE_CLAUDE_CODE": "true",
+            "OPENCODE_DISABLE_CLAUDE_CODE_PROMPT": "true",
+            "OPENCODE_DISABLE_CLAUDE_CODE_SKILLS": "true",
+            "OPENCODE_DISABLE_LSP_DOWNLOAD": "true",
+            "OPENCODE_DISABLE_SHARE": "true",
+            "OPENCODE_DISABLE_AUTOUPDATE": "true",
+        }
+    )
+    return isolated
+
+
+def non_agent_opencode_config() -> dict[str, Any]:
+    return {
+        "$schema": "https://opencode.ai/config.json",
+        "plugin": [],
+        "mcp": {},
+        "share": "disabled",
+        "instructions": [],
+        "formatter": False,
+        "lsp": False,
+        "command": {},
+        "permission": {"*": "deny"},
+    }
+
+
+def sanitize_filename_component(value: str) -> str:
+    cleaned = re.sub(r"[^A-Za-z0-9._-]+", "-", value.strip())
+    return cleaned.strip("-") or "value"
+
+
+def resolve_opencode_executable() -> str:
+    opencode_path = shutil.which("opencode")
+    if opencode_path:
+        return opencode_path
+    cli_path = shutil.which("opencode-cli")
+    if cli_path:
+        return cli_path
+    raise HookError("opencode is required but not installed")
+
+
+def _transcript_dir(context: RuntimeContext) -> pathlib.Path | None:
+    if not context.config.logging.capture_llm_transcript:
+        return None
+    return ensure_dir(
+        resolve_storage_path(
+            context.repo_root,
+            context.git_dir,
+            context.config.logging.transcript_dir,
+        )
+    )
+
+
+def build_opencode_security_config(
+    agent_policy: str,
+    allow_paths: tuple[str, ...] = (),
+    *,
+    non_vcs_working_directory: pathlib.Path | None = None,
+    project_read_root: pathlib.Path | None = None,
+) -> tuple[str, dict[str, Any]]:
+    permissions: dict[str, Any] = {
+        "*": "deny",
+        "read": "deny",
+        "glob": "deny",
+        "grep": "deny",
+        "list": "deny",
+        "edit": "deny",
+        "bash": "deny",
+        "task": "deny",
+        "external_directory": "deny",
+        "webfetch": "deny",
+        "websearch": "deny",
+        "lsp": "deny",
+        "skill": "deny",
+        "todowrite": "deny",
+        "question": "deny",
+        "doom_loop": "deny",
+    }
+    if agent_policy == "read-only":
+        agent_name = OPENCODE_READ_ONLY_AGENT
+        description = "Read-only ai-push-hooks analysis agent"
+    elif agent_policy == "apply":
+        if not allow_paths:
+            raise HookError(
+                "OpenCode apply agent requires an explicit non-empty allow_paths"
+            )
+        agent_name = OPENCODE_APPLY_AGENT
+        description = "Path-restricted ai-push-hooks apply agent"
+        permissions["read"] = "allow"
+        permission_patterns: set[str] = set()
+        for pattern in allow_paths:
+            permission_patterns.add(pattern)
+            collapsed = pattern
+            while "**/" in collapsed:
+                collapsed = collapsed.replace("**/", "", 1)
+                permission_patterns.add(collapsed)
+        protected_patterns = {".git", ".git/**"}
+        if non_vcs_working_directory is not None:
+            # OpenCode assigns `/` as the worktree for a directory without VCS
+            # metadata, so qualify allowlisted paths with that filesystem root.
+            anchor = pathlib.Path(non_vcs_working_directory.anchor)
+            prefix = non_vcs_working_directory.relative_to(anchor).as_posix()
+            permission_patterns = {
+                f"{prefix}/{pattern}" if prefix else pattern
+                for pattern in permission_patterns
+            }
+            protected_patterns = {
+                f"{prefix}/{pattern}" if prefix else pattern
+                for pattern in protected_patterns
+            }
+        edit_permissions = {
+            "*": "deny",
+            **{pattern: "allow" for pattern in sorted(permission_patterns)},
+        }
+        for pattern in sorted(protected_patterns):
+            edit_permissions[pattern] = "deny"
+        permissions["edit"] = edit_permissions
+    else:
+        raise HookError(f"Unsupported OpenCode agent policy: {agent_policy}")
+
+    if project_read_root is not None:
+        root = project_read_root.resolve(strict=False)
+        if (root / ".git").exists():
+            rooted_permissions: str | dict[str, str] = "allow"
+        else:
+            anchor = pathlib.Path(root.anchor)
+            prefix = root.relative_to(anchor).as_posix()
+            rooted_permissions = {
+                "*": "deny",
+                prefix: "allow",
+                f"{prefix}/**": "allow",
+            }
+        for tool in ("read", "list", "glob", "grep"):
+            permissions[tool] = (
+                dict(rooted_permissions)
+                if isinstance(rooted_permissions, dict)
+                else rooted_permissions
+            )
+
+    return agent_name, {
+        "$schema": "https://opencode.ai/config.json",
+        "plugin": [],
+        "mcp": {},
+        "share": "disabled",
+        "instructions": [],
+        "formatter": False,
+        "lsp": False,
+        "command": {},
+        "agent": {
+            agent_name: {
+                "mode": "primary",
+                "description": description,
+                "permission": permissions,
+            }
+        },
+    }
+
+
+def validate_hook_owned_artifacts(
+    context: RuntimeContext,
+    files: list[pathlib.Path],
+) -> list[pathlib.Path]:
+    run_root = context.run_dir.resolve(strict=True)
+    validated: list[pathlib.Path] = []
+    for file_path in files:
+        lexical_path = pathlib.Path(os.path.abspath(file_path))
+        if not is_path_within(lexical_path, run_root):
+            raise HookError(
+                f"OpenCode attachment is not a hook-owned artifact: {file_path}"
+            )
+        if path_has_symlink(run_root, lexical_path):
+            raise HookError(
+                f"OpenCode attachment must not traverse a symlink: {file_path}"
+            )
+        resolved_path = lexical_path.resolve(strict=True)
+        if not is_path_within(resolved_path, run_root) or not resolved_path.is_file():
+            raise HookError(
+                f"OpenCode attachment must be a regular hook-owned file: {file_path}"
+            )
+        validated.append(resolved_path)
+    return validated