akm-opencode 0.9.9202609021827 → 0.10.261002-beta

package/shared/ref-extraction.ts

@@ -1,120 +0,0 @@
-/**
- * AKM 0.9 ref extraction and local bundle validation.
- *
- * Session checkpoints can contain command bodies, heredocs, and serialized
- * tool output. Extraction is deliberately permissive, then candidates are
- * retained only when their concept ID resolves inside a provided bundle root.
- * This keeps the hook subprocess-free and drops ref-shaped string literals.
- */
-
-import { existsSync, statSync } from "node:fs";
-import path from "node:path";
-
-// Passive extraction is intentionally narrower than AKM's explicit ref parser:
-// only standard concept roots are observed. This prevents ordinary paths such
-// as src/app.ts from becoming automatic feedback targets.
-//
-// The concept-root list is the exact set of directories `akm bundle create`
-// scaffolds in 0.9 (agents commands env facts instructions knowledge lessons
-// memories scripts secrets sessions skills tasks workflows), which matches the
-// `assetTypes` array reported by `akm info --format json` modulo pluralization.
-// `wikis` was dropped for 0.9 — it is neither an asset type nor a scaffolded
-// directory — and facts/instructions/sessions were added. Keep this list byte
-// for byte in sync with opencode/index.ts and evals/tier2/metrics/feedback.ts.
-const REF_PATTERN =
-  /(?<![A-Za-z0-9@._+/:=-])(?:[A-Za-z0-9@._+-]+\/\/)?(?:agents|commands|env|facts|instructions|knowledge|lessons|memories|scripts|secrets|sessions|skills|tasks|workflows)\/[A-Za-z0-9._/-]+(?:#[A-Za-z0-9._~!$&'()*+,;=:@%/?-]+)?(?![A-Za-z0-9@._+/#$=-])/g;
-const AKM_REF_STRICT =
-  /^(?:[A-Za-z0-9@._+-]+\/\/)?(?:agents|commands|env|facts|instructions|knowledge|lessons|memories|scripts|secrets|sessions|skills|tasks|workflows)\/[A-Za-z0-9._/-]+(?:#[A-Za-z0-9._~!$&'()*+,;=:@%/?-]+)?$/;
-const EDGE_PUNCTUATION = new Set([".", ",", ";", ":", "!", "?", "(", ")", "[", "]", "{", "}", "'", "\"", "`"]);
-
-function normalizeToken(token: string): string {
-  let start = 0;
-  let end = token.length;
-  while (start < end && EDGE_PUNCTUATION.has(token[start] ?? "")) start += 1;
-  while (end > start && EDGE_PUNCTUATION.has(token[end - 1] ?? "")) end -= 1;
-  return token.slice(start, end);
-}
-
-/** Return all ref-shaped tokens in first-occurrence order, deduplicated. */
-export function extractAllRefs(text: string): string[] {
-  if (!text) return [];
-  const refs = new Set<string>();
-  for (const match of text.match(REF_PATTERN) ?? []) {
-    const normalized = normalizeToken(match);
-    if (AKM_REF_STRICT.test(normalized)) refs.add(normalized);
-  }
-  return [...refs];
-}
-
-/** Return whitespace-delimited tokens that are complete AKM refs. */
-export function extractAkmRefsFromString(text: string): string[] {
-  const refs = new Set<string>();
-  for (const token of text.split(/\s+/)) {
-    const normalized = normalizeToken(token);
-    if (normalized && AKM_REF_STRICT.test(normalized)) refs.add(normalized);
-  }
-  return [...refs];
-}
-
-interface NormalizedRef {
-  canonical: string;
-  conceptId: string;
-}
-
-function normalizeCandidate(candidate: string): NormalizedRef | null {
-  const canonical = normalizeToken(candidate);
-  if (!AKM_REF_STRICT.test(canonical)) return null;
-
-  const withoutFragment = canonical.split("#", 1)[0] ?? "";
-  const separator = withoutFragment.indexOf("//");
-  const conceptId = separator === -1 ? withoutFragment : withoutFragment.slice(separator + 2);
-  const segments = conceptId.split("/");
-  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return null;
-
-  return { canonical, conceptId };
-}
-
-function isFile(file: string): boolean {
-  try {
-    return existsSync(file) && statSync(file).isFile();
-  } catch {
-    return false;
-  }
-}
-
-/** Resolve a concept ID under any local bundle root without invoking AKM. */
-function conceptExistsInAnyBundle(conceptId: string, bundleRoots: readonly string[]): boolean {
-  for (const root of bundleRoots) {
-    if (!root) continue;
-    const resolvedRoot = path.resolve(root);
-    const directPath = path.resolve(resolvedRoot, conceptId);
-    if (directPath !== resolvedRoot && !directPath.startsWith(`${resolvedRoot}${path.sep}`)) continue;
-
-    if (isFile(directPath) || isFile(`${directPath}.md`)) return true;
-    if (isFile(path.join(directPath, "SKILL.md"))) return true;
-    if (conceptId.startsWith("memories/") && isFile(`${directPath}.derived.md`)) return true;
-  }
-  return false;
-}
-
-/** Extract and retain only refs whose concept IDs exist in a local bundle. */
-export function validateLiveRefs(text: string, bundleRoots: readonly string[]): string[] {
-  return validateRefCandidates(extractAllRefs(text), bundleRoots);
-}
-
-/**
- * Validate pre-extracted refs against local bundle roots. Bundle qualifiers and
- * fragments are preserved in the result but do not alter local path lookup.
- */
-export function validateRefCandidates(candidates: readonly string[], bundleRoots: readonly string[]): string[] {
-  if (!candidates || candidates.length === 0) return [];
-  const roots = bundleRoots.filter(Boolean);
-  if (roots.length === 0) return [];
-
-  const refs = new Set<string>();
-  for (const candidate of candidates) {
-    const normalized = normalizeCandidate(candidate);
-    if (normalized && conceptExistsInAnyBundle(normalized.conceptId, roots)) refs.add(normalized.canonical);
-  }
-  return [...refs].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
-}

package/shared/state-files.ts

@@ -1,98 +0,0 @@
-/**
- * Shared helpers for the append-only state files both plugins keep under their
- * harness state dir (session.log, feedback.log, memory.log, quality-cache.tsv,
- * sessions/<sid>.md, extract.log, events.jsonl).
- *
- * This module is the single copy of three primitives that were previously
- * duplicated near-verbatim in claude/hooks/akm-hook.ts and ./memory-events.ts:
- *
- *   chmodSafe()          best-effort owner-only hardening that never throws
- *   atomicWriteFileSync() write-temp-then-rename, with temp cleanup on failure
- *   rotateIfOversized()   size cap that keeps the newest half of the file
- *
- * Constraints this module must keep satisfying:
- *  - Zero third-party imports. claude/hooks/akm-hook.ts runs as a bare Bun
- *    script with no node_modules at hook-execution time, so only node:* builtins
- *    are importable here.
- *  - It is vendored into the published OpenCode tarball by
- *    opencode/scripts/vendor-shared.mjs, which copies every *.ts in
- *    claude/shared/ — no registration step is needed for a new file.
- */
-
-import { chmodSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"
-
-/**
- * Best-effort chmod. State files can hold prompt fragments, ref names and
- * (despite redaction) sensitive contextual data, so they are locked to
- * owner-only. Filesystems and platforms without POSIX mode (Windows, FAT, some
- * FUSE mounts) silently skip: a hardening attempt must never crash a hook.
- */
-export function chmodSafe(target: string, mode: number): void {
-  try {
-    chmodSync(target, mode)
-  } catch {
-    // Intentionally ignored — see the doc comment above.
-  }
-}
-
-/**
- * Write a file atomically: temp file in the same directory, then rename over
- * the target. rename(2) is atomic on POSIX (and on Windows via Node's
- * implementation), so a concurrent reader always observes either the old
- * content in full or the new content in full — never a torn/partial write.
- *
- * A failed rename removes the temp file (nothing else ever prunes it) and then
- * rethrows, so a caller keeps its own error semantics — rotateIfOversized(),
- * the only caller today, swallows it.
- */
-export function atomicWriteFileSync(filePath: string, content: string, mode?: number): void {
-  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`
-  writeFileSync(tmpPath, content)
-  if (mode !== undefined) chmodSafe(tmpPath, mode)
-  try {
-    renameSync(tmpPath, filePath)
-  } catch (error) {
-    // Don't orphan the temp file when the swap fails (EXDEV, permissions, a
-    // concurrent unlink of the target dir, ...).
-    try {
-      rmSync(tmpPath, { force: true })
-    } catch {}
-    throw error
-  }
-}
-
-// State-file rotation/caps (release-0.9.0 review §2 "Unbounded state growth"):
-// every append-only file under the harness state dir previously grew without
-// bound for the lifetime of the machine. AKM_PLUGIN_MAX_LOG_BYTES (default
-// 1 MiB) is the shared cap for all of them.
-const MAX_LOG_BYTES = (() => {
-  const raw = Number(process.env.AKM_PLUGIN_MAX_LOG_BYTES)
-  return Number.isFinite(raw) && raw > 0 ? raw : 1024 * 1024
-})()
-
-/**
- * Before an append: if the file already exceeds AKM_PLUGIN_MAX_LOG_BYTES,
- * rewrite it down to its newest half (by line count) via write-temp-then-rename
- * so a concurrent reader/writer never observes a truncated or partial file.
- *
- * Best-effort and never throws: a failed attempt just means the file keeps
- * growing until the next successful append/rotate.
- */
-export function rotateIfOversized(filePath: string): void {
-  try {
-    const stat = statSync(filePath)
-    if (stat.size <= MAX_LOG_BYTES) return
-    const lines = readFileSync(filePath, "utf8").split("\n")
-    if (lines[lines.length - 1] === "") lines.pop()
-    // Keep-at-least-one-line guard: a single line larger than the cap would
-    // make slice(ceil(len/2)) empty and rotation would erase the file instead
-    // of capping it. Always retain the newest line.
-    const keep = lines.length <= 1 ? lines : lines.slice(Math.ceil(lines.length / 2))
-    // 0o600 on the replacement: without it the rewritten file would come back
-    // at the umask default and quietly drop the owner-only posture the
-    // originals are created with.
-    atomicWriteFileSync(filePath, keep.length > 0 ? `${keep.join("\n")}\n` : "", 0o600)
-  } catch {
-    // Rotation is best-effort and must never throw — see the doc comment.
-  }
-}

package/shared/vendor-semver.ts

@@ -1,112 +0,0 @@
-// Minimal vendored semver implementation. Covers exactly the subset used by
-// akm-hook.ts (`valid`, `satisfies` with caret ranges + `||` disjunction).
-//
-// Why vendored: the Claude plugin ships via `/plugin marketplace add` which
-// just clones the repo — `node_modules` is gitignored and no install runs on
-// the user's machine. Relying on Bun's auto-install for `semver` makes every
-// hook silently no-op when auto-install is disabled, offline, or rate-limited.
-// Vendoring this ~80 LOC removes the runtime dependency entirely.
-
-type Parsed = {
-  major: number
-  minor: number
-  patch: number
-  prerelease: Array<string | number>
-}
-
-const SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/
-
-function parse(input: string): Parsed | null {
-  const m = String(input).trim().replace(/^v/, "").match(SEMVER_RE)
-  if (!m) return null
-  const [, maj, min, pat, pre] = m
-  const prerelease = pre ? pre.split(".").map((p) => (/^\d+$/.test(p) ? Number(p) : p)) : []
-  return { major: Number(maj), minor: Number(min), patch: Number(pat), prerelease }
-}
-
-export function valid(input: string | null | undefined): string | null {
-  if (!input) return null
-  if (!parse(input)) return null
-  return String(input).trim().replace(/^v/, "")
-}
-
-function cmp(a: Parsed, b: Parsed): number {
-  if (a.major !== b.major) return a.major < b.major ? -1 : 1
-  if (a.minor !== b.minor) return a.minor < b.minor ? -1 : 1
-  if (a.patch !== b.patch) return a.patch < b.patch ? -1 : 1
-  if (a.prerelease.length === 0 && b.prerelease.length === 0) return 0
-  // A version without prerelease has HIGHER precedence than one with.
-  if (a.prerelease.length === 0) return 1
-  if (b.prerelease.length === 0) return -1
-  const n = Math.min(a.prerelease.length, b.prerelease.length)
-  for (let i = 0; i < n; i++) {
-    const ai = a.prerelease[i]
-    const bi = b.prerelease[i]
-    const aNum = typeof ai === "number"
-    const bNum = typeof bi === "number"
-    if (aNum && !bNum) return -1
-    if (!aNum && bNum) return 1
-    if (aNum && bNum) {
-      if (ai !== bi) return (ai as number) < (bi as number) ? -1 : 1
-    } else {
-      const s = String(ai)
-      const t = String(bi)
-      if (s !== t) return s < t ? -1 : 1
-    }
-  }
-  if (a.prerelease.length !== b.prerelease.length) return a.prerelease.length < b.prerelease.length ? -1 : 1
-  return 0
-}
-
-type CaretRange = { min: Parsed; maxExclusive: Parsed; allowPrereleases: boolean }
-
-function parseCaretRange(token: string): CaretRange | null {
-  const m = token.trim().match(/^\^(.+)$/)
-  if (!m) return null
-  const min = parse(m[1])
-  if (!min) return null
-  let maxExclusive: Parsed
-  if (min.major > 0) {
-    maxExclusive = { major: min.major + 1, minor: 0, patch: 0, prerelease: [] }
-  } else if (min.minor > 0) {
-    maxExclusive = { major: 0, minor: min.minor + 1, patch: 0, prerelease: [] }
-  } else {
-    maxExclusive = { major: 0, minor: 0, patch: min.patch + 1, prerelease: [] }
-  }
-  return { min, maxExclusive, allowPrereleases: min.prerelease.length > 0 }
-}
-
-export function satisfies(version: string, range: string): boolean {
-  const v = parse(version)
-  if (!v) return false
-  const branches = range.split("||").map((s) => s.trim())
-  for (const branch of branches) {
-    const tokens = branch.split(/\s+/).filter(Boolean)
-    let ok = true
-    for (const t of tokens) {
-      const r = parseCaretRange(t)
-      if (!r) {
-        ok = false
-        break
-      }
-      if (cmp(v, r.min) < 0 || cmp(v, r.maxExclusive) >= 0) {
-        ok = false
-        break
-      }
-      // node-semver default: prereleases only satisfy a range whose lower
-      // bound also has a prerelease AND shares the same major.minor.patch.
-      if (v.prerelease.length > 0) {
-        if (!r.allowPrereleases) {
-          ok = false
-          break
-        }
-        if (v.major !== r.min.major || v.minor !== r.min.minor || v.patch !== r.min.patch) {
-          ok = false
-          break
-        }
-      }
-    }
-    if (ok) return true
-  }
-  return false
-}