codiedev 0.9.30 → 0.9.32

package/assets/git-refs.mjs

@@ -0,0 +1,252 @@
+// Git-ref resolution and header construction for the Codiedev OpenCode
+// plugin. These live OUTSIDE opencode-plugin.mjs on purpose: opencode
+// treats EVERY export of a plugin module as a plugin factory, so exporting
+// helpers there breaks harness startup. See openCodePluginGitRefs.test.ts.
+
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
+
+/**
+ * The directory the agent last WROTE to. Reading refs from the plugin's cwd is
+ * only right when `codie` was launched where the work lands. A dev who launches
+ * in their primary checkout while the agent edits a sibling git worktree would
+ * otherwise report the launch checkout's branch forever — the shape seen on
+ * `secscan`, whose merged PRs came from `feat/live-security-operations` and
+ * `worktree-landing-page-login` while the session recorded only `main`.
+ *
+ * Writes are the signal, not reads: an agent reads all over the tree, but the
+ * code it writes is what becomes the PR.
+ *
+ * Keyed by session, like skillUseBySession: one OpenCode process hosts many
+ * sessions (TUI `/new`, `task` subagents, `opencode serve`). A single global
+ * slot would let a write in session B retarget session A's headers, and both
+ * dirs pass the trust check when they share an origin, so the guard would not
+ * catch it.
+ */
+export const workDirBySession = new Map();
+/**
+ * Tool ids as OpenCode actually registers them, captured from a live run — not
+ * read off the binary, which is what got this wrong twice. The patch tool is
+ * `apply_patch`; `patch` is kept only as a defensive alias.
+ */
+const WRITE_TOOLS = new Set(["write", "edit", "apply_patch", "patch"]);
+
+/**
+ * Which directory a tool call says the agent is working in, or null.
+ *
+ * Covering only `write`/`edit` was not enough. Two live `codie run` sessions
+ * were driven to create a file and the agent picked `bash` once and `patch`
+ * once — neither carries a `filePath` in its args, so both sessions reported
+ * the launch branch:
+ *
+ *   write / edit   args.filePath                     — known before the write
+ *   apply_patch    result.metadata.files[].filePath  — only known AFTER it runs
+ *
+ * `bash` is deliberately NOT handled. Honouring its `workdir` re-anchors on
+ * READS too — `bash {command:"git log", workdir:"/repo"}` would move the
+ * anchor off a tracked worktree and back to the primary checkout, which
+ * passes the trust check because both share an origin. That breaks the rule
+ * this module is built on: writes are the signal, reads are not. Mining the
+ * command text was tried instead and did not work live. See NEXT_RELEASE.md.
+ *
+ * `patch` takes `patchText`, so its args never name a file. Shape confirmed
+ * against the opencode binary:
+ *   metadata:{files:[{type:"update",filePath:…,relativePath:…,diff:…}]}
+ *
+ */
+function workDirFromTool(tool, args, result) {
+  if (!WRITE_TOOLS.has(tool)) return null;
+  const candidates = [
+    args?.filePath,
+    args?.file_path,
+    ...(Array.isArray(result?.metadata?.files) ? result.metadata.files : []).flatMap((file) => [
+      file?.movePath, // a move reports the destination, which is where the work is
+      file?.filePath,
+    ]),
+  ];
+  // relativePath is deliberately excluded — it resolves against a cwd we may
+  // not share, so it is not a usable anchor.
+  const hit = candidates.find((path) => typeof path === "string" && isAbsolute(path));
+  return hit ? dirname(hit) : null;
+}
+
+export function trackWorkPath({
+  tool,
+  args,
+  sessionID,
+  result = null,
+  state = workDirBySession,
+}) {
+  const dir = workDirFromTool(tool, args, result);
+  if (dir) state.set(sessionID, dir);
+}
+
+/**
+ * `tool.execute.before` fires BEFORE the write lands, so a file created in a
+ * new subdirectory names a directory that does not exist yet. Running git
+ * there fails, and caching that failure would revert to the launch cwd for the
+ * whole TTL — most of a task, for an agent scaffolding several directories.
+ * Walk up to the nearest directory that does exist.
+ */
+function nearestExistingDir(dir, exists = existsSync) {
+  let current = dir;
+  for (let hops = 0; current && hops < 40; hops += 1) {
+    if (exists(current)) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+  return null;
+}
+
+/**
+ * Canonicalize a git remote to bare `host/path` so the two sides of the trust
+ * check compare equal.
+ *
+ * They arrive from DIFFERENT inputs: the live side is the raw output of
+ * `git remote get-url origin`, while CODIEDEV_REPO_URL has already been through
+ * `safeRepoUrl()` in codie.ts, which strips userinfo. Canonicalizing to one
+ * shape — no scheme, no userinfo, scp-colon folded to a slash — is what makes
+ * `git@host:org/repo.git` and `host:org/repo.git` land on the same string.
+ *
+ * An earlier version rewrote ssh→https instead, which matched only when BOTH
+ * sides were raw. It silently failed for every ssh-cloned checkout, i.e. most
+ * enterprise ones.
+ */
+function normalizeRemote(url) {
+  let value = String(url || "").trim().toLowerCase();
+  if (!value) return "";
+  value = value.replace(/^[a-z][a-z0-9+.-]*:\/\//, ""); // scheme://
+  value = value.replace(/^[^@/]+@/, ""); // git@ , user:token@
+  value = value.replace(/^([^/:]+):(?!\d)/, "$1/"); // scp-style host:path, keep :port
+  value = value.replace(/\/+$/, ""); // trailing slash BEFORE .git, or "repo.git/" survives
+  value = value.replace(/\.git$/, "");
+  return value.replace(/\/+$/, "");
+}
+
+/**
+ * Git refs are re-read live per request, not taken from the launch-time
+ * environment. bin/codie.js samples CODIEDEV_BRANCH / CODIEDEV_HEAD_SHA once
+ * and freezes them for the whole session, so a dev who starts on main and
+ * moves to a feature branch reported `main` until they quit. Gateway sessions
+ * then branch-matched nothing, because a merged PR's sourceBranch is always
+ * the feature branch. The env vars survive only as a fallback for when git
+ * cannot be read at all.
+ */
+const GIT_TTL_MS = 5_000;
+const gitCache = {};
+
+export function clean(value, max) {
+  const text = typeof value === "string" ? value.trim() : "";
+  return text ? text.slice(0, max) : "";
+}
+
+/** Returns trimmed stdout, or null when git could not be read. */
+function runGit(args, cwd) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1_000,
+      ...(cwd ? { cwd } : {}),
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A write directory is only trusted when it belongs to the SAME repo the
+ * session is attributed to. Without that check, one stray edit into an
+ * unrelated checkout would publish that repo's branch name to the gateway.
+ * With no configured repo url there is nothing to check against, so we stay on
+ * cwd rather than trust a path.
+ */
+function trustedDir(dir, env, run, cache, at, ttlMs, exists = existsSync) {
+  if (!dir) return null;
+  const want = normalizeRemote(env.CODIEDEV_REPO_URL);
+  if (!want) return null;
+  const probe = nearestExistingDir(dir, exists);
+  if (!probe) return null;
+  const key = `trust:${probe}`;
+  const slot = cache[key];
+  if (slot && at - slot.at < ttlMs) return slot.ok ? probe : null;
+  let ok = false;
+  try {
+    ok = normalizeRemote(run(["remote", "get-url", "origin"], probe)) === want;
+  } catch {
+    ok = false;
+  }
+  cache[key] = { at, ok };
+  return ok ? probe : null;
+}
+
+export function resolveGitRefs({
+  env = process.env,
+  run = runGit,
+  cache = gitCache,
+  now = Date.now,
+  ttlMs = GIT_TTL_MS,
+  dir = null,
+  exists = existsSync,
+} = {}) {
+  const at = now();
+  const target = trustedDir(dir, env, run, cache, at, ttlMs, exists);
+  // Keyed per directory: moving between worktrees must be visible at once, not
+  // after the TTL of whichever directory was resolved first.
+  const key = `refs:${target ?? ""}`;
+  const slot = cache[key];
+  // One git pair per directory per TTL keeps this flat however fast the agent
+  // loops. Failures are cached too, so a pathological git costs one attempt
+  // per TTL rather than one per request.
+  if (slot && at - slot.at < ttlMs) return slot.refs;
+
+  let branch = null;
+  let sha = null;
+  try {
+    branch = run(["branch", "--show-current"], target ?? undefined);
+    sha = run(["rev-parse", "HEAD"], target ?? undefined);
+  } catch {
+    branch = null;
+    sha = null;
+  }
+
+  // A successful read wins even when it is empty: on a detached HEAD "no
+  // branch" is the true answer, and falling back to env would put the stale
+  // launch-time branch straight back.
+  //
+  // The fallback is ALL-OR-NOTHING. Mixing a live branch with an env sha (or
+  // the reverse) describes a commit that never existed on that branch — if
+  // `rev-parse` alone times out on a lock, the request would claim
+  // `feat/x` + `<launch sha of main>` and the server would attribute the
+  // session to a commit it never touched. That is worse than no sha at all.
+  const branchOk = typeof branch === "string";
+  const shaOk = typeof sha === "string" && sha !== "";
+  const refs = branchOk && shaOk
+    ? { branch: clean(branch, 200), sha: clean(sha, 40) }
+    : { branch: clean(env.CODIEDEV_BRANCH, 200), sha: clean(env.CODIEDEV_HEAD_SHA, 40) };
+  cache[key] = { at, refs };
+  return refs;
+}
+
+/**
+ * The complete set of headers this plugin may add — a closed allowlist. No
+ * prompt, message, code, diff, or tool output ever appears here.
+ */
+export function buildAttributionHeaders({ sessionID, env = process.env, refs, skills = [] }) {
+  const headers = {};
+  const session = clean(sessionID, 200);
+  if (session) headers["X-Codiedev-Session-Id"] = session;
+  const repo = clean(env.CODIEDEV_REPO_URL, 2048);
+  if (repo) headers["X-Codiedev-Repo-Url"] = repo;
+  const branch = clean(refs?.branch, 200);
+  if (branch) headers["X-Codiedev-Branch"] = branch;
+  const sha = clean(refs?.sha, 40);
+  if (/^[0-9a-f]{7,40}$/i.test(sha)) headers["X-Codiedev-Head-Sha"] = sha;
+  const user = clean(env.CODIEDEV_USER, 200);
+  if (user) headers["X-Codiedev-User"] = user;
+  const skillList = clean(skills.join(","), 4096);
+  if (skillList) headers["X-Codiedev-Skills-Used"] = skillList;
+  return headers;
+}

package/assets/opencode-plugin.mjs

@@ -3,210 +3,16 @@
 // output. It only attaches stable session/git identifiers and explicit skill
 // names to inference requests handled by the company gateway.
 
-import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { dirname, isAbsolute } from "node:path";
+import {
+  clean,
+  buildAttributionHeaders,
+  resolveGitRefs,
+  trackWorkPath,
+  workDirBySession,
+} from "./git-refs.mjs";
 
 const skillUseBySession = new Map();
 
-/**
- * The directory the agent last WROTE to. Reading refs from the plugin's cwd is
- * only right when `codie` was launched where the work lands. A dev who launches
- * in their primary checkout while the agent edits a sibling git worktree would
- * otherwise report the launch checkout's branch forever — the shape seen on
- * `secscan`, whose merged PRs came from `feat/live-security-operations` and
- * `worktree-landing-page-login` while the session recorded only `main`.
- *
- * Writes are the signal, not reads: an agent reads all over the tree, but the
- * code it writes is what becomes the PR.
- *
- * Keyed by session, like skillUseBySession: one OpenCode process hosts many
- * sessions (TUI `/new`, `task` subagents, `opencode serve`). A single global
- * slot would let a write in session B retarget session A's headers, and both
- * dirs pass the trust check when they share an origin, so the guard would not
- * catch it.
- */
-const workDirBySession = new Map();
-const WRITE_TOOLS = new Set(["write", "edit", "patch"]);
-
-export function trackWorkPath(tool, args, sessionID, state = workDirBySession) {
-  if (!WRITE_TOOLS.has(tool)) return;
-  const filePath = args?.filePath ?? args?.file_path;
-  // Relative paths are resolved against a cwd we may not share, so they are
-  // not usable anchors.
-  if (typeof filePath !== "string" || !isAbsolute(filePath)) return;
-  state.set(sessionID, dirname(filePath));
-}
-
-/**
- * `tool.execute.before` fires BEFORE the write lands, so a file created in a
- * new subdirectory names a directory that does not exist yet. Running git
- * there fails, and caching that failure would revert to the launch cwd for the
- * whole TTL — most of a task, for an agent scaffolding several directories.
- * Walk up to the nearest directory that does exist.
- */
-function nearestExistingDir(dir, exists = existsSync) {
-  let current = dir;
-  for (let hops = 0; current && hops < 40; hops += 1) {
-    if (exists(current)) return current;
-    const parent = dirname(current);
-    if (parent === current) return null;
-    current = parent;
-  }
-  return null;
-}
-
-/**
- * Canonicalize a git remote to bare `host/path` so the two sides of the trust
- * check compare equal.
- *
- * They arrive from DIFFERENT inputs: the live side is the raw output of
- * `git remote get-url origin`, while CODIEDEV_REPO_URL has already been through
- * `safeRepoUrl()` in codie.ts, which strips userinfo. Canonicalizing to one
- * shape — no scheme, no userinfo, scp-colon folded to a slash — is what makes
- * `git@host:org/repo.git` and `host:org/repo.git` land on the same string.
- *
- * An earlier version rewrote ssh→https instead, which matched only when BOTH
- * sides were raw. It silently failed for every ssh-cloned checkout, i.e. most
- * enterprise ones.
- */
-function normalizeRemote(url) {
-  let value = String(url || "").trim().toLowerCase();
-  if (!value) return "";
-  value = value.replace(/^[a-z][a-z0-9+.-]*:\/\//, ""); // scheme://
-  value = value.replace(/^[^@/]+@/, ""); // git@ , user:token@
-  value = value.replace(/^([^/:]+):(?!\d)/, "$1/"); // scp-style host:path, keep :port
-  value = value.replace(/\/+$/, ""); // trailing slash BEFORE .git, or "repo.git/" survives
-  value = value.replace(/\.git$/, "");
-  return value.replace(/\/+$/, "");
-}
-
-/**
- * Git refs are re-read live per request, not taken from the launch-time
- * environment. bin/codie.js samples CODIEDEV_BRANCH / CODIEDEV_HEAD_SHA once
- * and freezes them for the whole session, so a dev who starts on main and
- * moves to a feature branch reported `main` until they quit. Gateway sessions
- * then branch-matched nothing, because a merged PR's sourceBranch is always
- * the feature branch. The env vars survive only as a fallback for when git
- * cannot be read at all.
- */
-const GIT_TTL_MS = 5_000;
-const gitCache = {};
-
-function clean(value, max) {
-  const text = typeof value === "string" ? value.trim() : "";
-  return text ? text.slice(0, max) : "";
-}
-
-/** Returns trimmed stdout, or null when git could not be read. */
-function runGit(args, cwd) {
-  try {
-    return execFileSync("git", args, {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 1_000,
-      ...(cwd ? { cwd } : {}),
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-
-/**
- * A write directory is only trusted when it belongs to the SAME repo the
- * session is attributed to. Without that check, one stray edit into an
- * unrelated checkout would publish that repo's branch name to the gateway.
- * With no configured repo url there is nothing to check against, so we stay on
- * cwd rather than trust a path.
- */
-function trustedDir(dir, env, run, cache, at, ttlMs, exists = existsSync) {
-  if (!dir) return null;
-  const want = normalizeRemote(env.CODIEDEV_REPO_URL);
-  if (!want) return null;
-  const probe = nearestExistingDir(dir, exists);
-  if (!probe) return null;
-  const key = `trust:${probe}`;
-  const slot = cache[key];
-  if (slot && at - slot.at < ttlMs) return slot.ok ? probe : null;
-  let ok = false;
-  try {
-    ok = normalizeRemote(run(["remote", "get-url", "origin"], probe)) === want;
-  } catch {
-    ok = false;
-  }
-  cache[key] = { at, ok };
-  return ok ? probe : null;
-}
-
-export function resolveGitRefs({
-  env = process.env,
-  run = runGit,
-  cache = gitCache,
-  now = Date.now,
-  ttlMs = GIT_TTL_MS,
-  dir = null,
-  exists = existsSync,
-} = {}) {
-  const at = now();
-  const target = trustedDir(dir, env, run, cache, at, ttlMs, exists);
-  // Keyed per directory: moving between worktrees must be visible at once, not
-  // after the TTL of whichever directory was resolved first.
-  const key = `refs:${target ?? ""}`;
-  const slot = cache[key];
-  // One git pair per directory per TTL keeps this flat however fast the agent
-  // loops. Failures are cached too, so a pathological git costs one attempt
-  // per TTL rather than one per request.
-  if (slot && at - slot.at < ttlMs) return slot.refs;
-
-  let branch = null;
-  let sha = null;
-  try {
-    branch = run(["branch", "--show-current"], target ?? undefined);
-    sha = run(["rev-parse", "HEAD"], target ?? undefined);
-  } catch {
-    branch = null;
-    sha = null;
-  }
-
-  // A successful read wins even when it is empty: on a detached HEAD "no
-  // branch" is the true answer, and falling back to env would put the stale
-  // launch-time branch straight back.
-  //
-  // The fallback is ALL-OR-NOTHING. Mixing a live branch with an env sha (or
-  // the reverse) describes a commit that never existed on that branch — if
-  // `rev-parse` alone times out on a lock, the request would claim
-  // `feat/x` + `<launch sha of main>` and the server would attribute the
-  // session to a commit it never touched. That is worse than no sha at all.
-  const branchOk = typeof branch === "string";
-  const shaOk = typeof sha === "string" && sha !== "";
-  const refs = branchOk && shaOk
-    ? { branch: clean(branch, 200), sha: clean(sha, 40) }
-    : { branch: clean(env.CODIEDEV_BRANCH, 200), sha: clean(env.CODIEDEV_HEAD_SHA, 40) };
-  cache[key] = { at, refs };
-  return refs;
-}
-
-/**
- * The complete set of headers this plugin may add — a closed allowlist. No
- * prompt, message, code, diff, or tool output ever appears here.
- */
-export function buildAttributionHeaders({ sessionID, env = process.env, refs, skills = [] }) {
-  const headers = {};
-  const session = clean(sessionID, 200);
-  if (session) headers["X-Codiedev-Session-Id"] = session;
-  const repo = clean(env.CODIEDEV_REPO_URL, 2048);
-  if (repo) headers["X-Codiedev-Repo-Url"] = repo;
-  const branch = clean(refs?.branch, 200);
-  if (branch) headers["X-Codiedev-Branch"] = branch;
-  const sha = clean(refs?.sha, 40);
-  if (/^[0-9a-f]{7,40}$/i.test(sha)) headers["X-Codiedev-Head-Sha"] = sha;
-  const user = clean(env.CODIEDEV_USER, 200);
-  if (user) headers["X-Codiedev-User"] = user;
-  const skillList = clean(skills.join(","), 4096);
-  if (skillList) headers["X-Codiedev-Skills-Used"] = skillList;
-  return headers;
-}
-
 function addSkill(sessionID, value) {
   const skill = clean(value, 160).replace(/^\//, "").replace(/\.md$/i, "");
   if (!skill) return;
@@ -229,10 +35,30 @@ export const CodiedevMetadata = async () => ({
     // Follow where the agent writes so refs come from the tree that becomes
     // the PR. Only the path's DIRECTORY is kept, and only to run git in it —
     // no path ever leaves this process.
-    trackWorkPath(input.tool, output.args, input.sessionID);
+    //
+    // `write`/`edit` name the file up front; `bash` may carry a workdir. Both
+    // are worth catching here so the very next request already reports the
+    // right branch.
+    trackWorkPath({
+      tool: input.tool,
+      args: output.args,
+      sessionID: input.sessionID,
+    });
     if (input.tool !== "skill") return;
     addSkill(input.sessionID, output.args?.name || output.args?.skill || output.args?.key);
   },
+  "tool.execute.after": async (input, output) => {
+    // `patch` takes patchText, so the files it touched are only known once it
+    // has run — they arrive in the result's metadata.files[]. Without this
+    // hook a patch-driven session never moves off the launch branch, which is
+    // exactly what two live runs showed.
+    trackWorkPath({
+      tool: input.tool,
+      args: input.args,
+      sessionID: input.sessionID,
+      result: output,
+    });
+  },
   "chat.headers": async (input, output) => {
     Object.assign(
       output.headers,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",