deliberate 1.0.2 → 1.0.4

package/opencode/deliberate-changes-plugin.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { spawn } from "child_process";
+import { fileURLToPath } from "url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const PYTHON_CMD = process.platform === "win32" ? "python" : "python3";
+const HOME_DIR = os.homedir();
+const HOOK_SCRIPT_LOCAL = path.join(__dirname, "..", "hooks", "deliberate-changes.py");
+const HOOK_SCRIPT_GLOBAL = path.join(HOME_DIR, ".claude", "hooks", "deliberate-changes.py");
+const HOOK_SCRIPT = fs.existsSync(HOOK_SCRIPT_LOCAL) ? HOOK_SCRIPT_LOCAL : HOOK_SCRIPT_GLOBAL;
+const TIMEOUT_MS = 30000;
+
+function stripAnsi(input) {
+  return input.replace(/\u001b\[[0-9;]*m/g, "");
+}
+
+async function runChangeHook({ toolName, toolInput, sessionID }) {
+  if (!fs.existsSync(HOOK_SCRIPT)) {
+    return null;
+  }
+
+  const payload = {
+    tool_name: toolName,
+    tool_input: toolInput,
+    session_id: sessionID
+  };
+
+  return new Promise((resolve) => {
+    const child = spawn(PYTHON_CMD, [HOOK_SCRIPT], {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: {
+        ...process.env
+      }
+    });
+
+    let stdout = "";
+    let stderr = "";
+    let finished = false;
+
+    const timer = setTimeout(() => {
+      if (!finished) {
+        finished = true;
+        child.kill("SIGKILL");
+        resolve({ code: 124, stdout: "", stderr: "Deliberate hook timed out" });
+      }
+    }, TIMEOUT_MS);
+
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+
+    child.on("close", (code) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      resolve({ code: code ?? 0, stdout, stderr });
+    });
+
+    child.stdin.write(`${JSON.stringify(payload)}\n`);
+    child.stdin.end();
+  });
+}
+
+function parseHookOutput(stdout) {
+  if (!stdout) return null;
+
+  try {
+    const parsed = JSON.parse(stdout.trim());
+    const hookOutput = parsed?.hookSpecificOutput || {};
+    const context = hookOutput.additionalContext || "";
+    const systemMessage = parsed?.systemMessage || "";
+
+    return {
+      context: stripAnsi(context).trim(),
+      message: stripAnsi(systemMessage).trim()
+    };
+  } catch (err) {
+    return null;
+  }
+}
+
+export const DeliberateOpenCodeChangesPlugin = async ({ client }) => {
+  if (!client) {
+    throw new Error("Deliberate OpenCode plugin requires SDK client access");
+  }
+
+  return {
+    "tool.execute.after": async (input, output) => {
+      const tool = input.tool;
+      if (!tool || !["write", "edit", "multiedit", "patch"].includes(tool)) return;
+      if (!output) return;
+
+      const toolArgs = output?.metadata?.args || output?.args || {};
+      const filePath = toolArgs.filePath || toolArgs.file_path || output?.metadata?.filepath || output?.metadata?.filePath;
+
+      if (!filePath) return;
+
+      const edits = Array.isArray(toolArgs.edits)
+        ? toolArgs.edits.map((edit) => ({
+          old_string: edit.oldString || edit.old_string || "",
+          new_string: edit.newString || edit.new_string || ""
+        }))
+        : undefined;
+
+      const hookToolName = tool === "multiedit" ? "MultiEdit" : tool === "write" ? "Write" : "Edit";
+
+      const toolInput = {
+        file_path: filePath,
+        content: toolArgs.content || "",
+        old_string: toolArgs.oldString || toolArgs.old_string || "",
+        new_string: toolArgs.newString || toolArgs.new_string || "",
+        edits
+      };
+
+      if (hookToolName === "Edit" && output?.metadata?.filediff?.before && output?.metadata?.filediff?.after) {
+        toolInput.old_string = output.metadata.filediff.before;
+        toolInput.new_string = output.metadata.filediff.after;
+      }
+
+      if (hookToolName === "Edit" && !toolInput.old_string && output?.metadata?.diff) {
+        const diff = output.metadata.diff;
+        const lines = diff.split("\n");
+        let oldBlock = [];
+        let newBlock = [];
+        for (const line of lines) {
+          if (line.startsWith("---") || line.startsWith("+++")) continue;
+          if (line.startsWith("-")) {
+            oldBlock.push(line.slice(1));
+          } else if (line.startsWith("+")) {
+            newBlock.push(line.slice(1));
+          }
+        }
+        if (oldBlock.length) toolInput.old_string = oldBlock.join("\n");
+        if (newBlock.length) toolInput.new_string = newBlock.join("\n");
+      }
+
+      const result = await runChangeHook({
+        toolName: hookToolName,
+        toolInput,
+        sessionID: input.sessionID
+      });
+
+      if (!result) return;
+
+      const parsed = parseHookOutput(result.stdout);
+      const message = parsed?.message || parsed?.context;
+
+      if (message) {
+        await client.session.prompt({
+          path: { id: input.sessionID },
+          body: {
+            noReply: true,
+            parts: [{ type: "text", text: message }]
+          }
+        }).catch(() => {});
+      }
+    }
+  };
+};
+
+export default DeliberateOpenCodeChangesPlugin;

package/opencode/deliberate-plugin.js

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { spawn } from "child_process";
+import { fileURLToPath } from "url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const PYTHON_CMD = process.platform === "win32" ? "python" : "python3";
+const HOME_DIR = os.homedir();
+const HOOK_SCRIPT_LOCAL = path.join(__dirname, "..", "hooks", "deliberate-commands.py");
+const HOOK_SCRIPT_GLOBAL = path.join(HOME_DIR, ".claude", "hooks", "deliberate-commands.py");
+const HOOK_SCRIPT = fs.existsSync(HOOK_SCRIPT_LOCAL) ? HOOK_SCRIPT_LOCAL : HOOK_SCRIPT_GLOBAL;
+const TIMEOUT_MS = 30000;
+const DANGEROUS_PREFIXES = [
+  "rm ",
+  "rm-",
+  "git ",
+  "sudo ",
+  "bash ",
+  "sh ",
+  "python ",
+  "python3 ",
+  "node ",
+  "perl ",
+  "ruby ",
+  "docker ",
+  "kubectl ",
+  "aws ",
+  "terraform ",
+  "gcloud ",
+  "az ",
+  "scp ",
+  "rsync ",
+  "dd ",
+  "mkfs ",
+  "chmod ",
+  "chown ",
+  "find ",
+  "xargs ",
+  "parallel ",
+  "base64 ",
+  "xxd "
+];
+
+function shouldAnalyze(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return false;
+  if (trimmed.length < 4) return false;
+  const lower = trimmed.toLowerCase();
+  if (lower.includes("rm -rf") || lower.includes("git reset") || lower.includes("git clean")) {
+    return true;
+  }
+  return DANGEROUS_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+
+function stripAnsi(input) {
+  return input.replace(/\u001b\[[0-9;]*m/g, "");
+}
+
+async function runCommandHook({ command, sessionID, cwd }) {
+  if (!fs.existsSync(HOOK_SCRIPT)) {
+    return null;
+  }
+
+  const payload = {
+    tool_name: "Bash",
+    tool_input: { command },
+    session_id: sessionID,
+    cwd: cwd || process.cwd()
+  };
+
+  return new Promise((resolve) => {
+    const child = spawn(PYTHON_CMD, [HOOK_SCRIPT], {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: {
+        ...process.env
+      }
+    });
+
+    let stdout = "";
+    let stderr = "";
+    let finished = false;
+
+    const timer = setTimeout(() => {
+      if (!finished) {
+        finished = true;
+        child.kill("SIGKILL");
+        resolve({ code: 124, stdout: "", stderr: "Deliberate hook timed out" });
+      }
+    }, TIMEOUT_MS);
+
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+
+    child.on("close", (code) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      resolve({ code: code ?? 0, stdout, stderr });
+    });
+
+    child.stdin.write(`${JSON.stringify(payload)}\n`);
+    child.stdin.end();
+  });
+}
+
+function parseHookOutput(stdout) {
+  if (!stdout) return null;
+
+  try {
+    const parsed = JSON.parse(stdout.trim());
+    const hookOutput = parsed?.hookSpecificOutput || {};
+    const reason = hookOutput.permissionDecisionReason || "";
+    const context = hookOutput.additionalContext || "";
+
+    return {
+      reason: stripAnsi(reason).trim(),
+      context: stripAnsi(context).trim()
+    };
+  } catch (err) {
+    return null;
+  }
+}
+
+export const DeliberateOpenCodePlugin = async ({ client, directory }) => {
+  if (!client) {
+    throw new Error("Deliberate OpenCode plugin requires SDK client access");
+  }
+
+  return {
+    "tool.execute.before": async (input, output) => {
+      if (input.tool !== "bash") return;
+
+      const command = output?.args?.command;
+      if (!command) return;
+
+      if (!shouldAnalyze(command)) {
+        return;
+      }
+
+      const cwd = output?.args?.workdir || directory;
+      const result = await runCommandHook({ command, sessionID: input.sessionID, cwd });
+      if (!result) return;
+
+      const parsed = parseHookOutput(result.stdout);
+      const message = parsed?.context || parsed?.reason || "";
+
+      if (message) {
+        await client.session.prompt({
+          path: { id: input.sessionID },
+          body: {
+            noReply: true,
+            parts: [{ type: "text", text: message }]
+          }
+        }).catch(() => {});
+      }
+
+      if (result.code === 2 || (result.stderr && result.stderr.includes("BLOCKED by Deliberate"))) {
+        const blockedMessage = stripAnsi(result.stderr || message || "Blocked by Deliberate");
+        throw new Error(blockedMessage.trim() || "Blocked by Deliberate");
+      }
+    }
+  };
+};
+
+export default DeliberateOpenCodePlugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deliberate",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Safety layer for agentic coding tools - classifies shell commands before execution",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "bin/",
     "src/",
     "hooks/",
+    "opencode/",
     "training/build_classifier.py",
     "training/expanded-command-safety.jsonl",
     "models/classifier_base.pkl",

package/src/install.js

@@ -3,6 +3,7 @@
  * Handles:
  * - Symlinking hooks to ~/.claude/hooks/
  * - Updating ~/.claude/settings.json
+ * - Installing OpenCode plugin (if available)
  * - Configuring Deliberate LLM provider
  * - Optionally starting the classifier server
  */
@@ -23,6 +24,8 @@ const IS_WINDOWS = process.platform === 'win32';
 const CLAUDE_DIR = path.join(HOME_DIR, '.claude');
 const HOOKS_DIR = path.join(CLAUDE_DIR, 'hooks');
 const SETTINGS_FILE = path.join(CLAUDE_DIR, 'settings.json');
+const OPENCODE_DIR = path.join(HOME_DIR, '.config', 'opencode');
+const OPENCODE_PLUGIN_DIR = path.join(OPENCODE_DIR, 'plugins');
 
 // Python command (python on Windows, python3 on Unix)
 const PYTHON_CMD = IS_WINDOWS ? 'python' : 'python3';
@@ -31,6 +34,8 @@ const PIP_CMD = IS_WINDOWS ? 'pip' : 'pip3';
 // Required Python packages
 const PYTHON_DEPS = ['sentence-transformers', 'scikit-learn', 'numpy', 'claude-agent-sdk'];
 
+const OPENCODE_CONFIG_FILES = ['opencode.json', 'opencode.jsonc'];
+
 // Model download configuration
 const MODELS_URL = 'https://github.com/the-radar/deliberate/releases/download/v1.0.0/deliberate-models.tar.gz';
 const MODELS_DIR = path.join(__dirname, '..', 'models');
@@ -184,6 +189,118 @@ function installHooks() {
   return installed;
 }
 
+function loadOpenCodeConfig() {
+  for (const filename of OPENCODE_CONFIG_FILES) {
+    const candidate = path.join(OPENCODE_DIR, filename);
+    if (fs.existsSync(candidate)) {
+      try {
+        const content = fs.readFileSync(candidate, 'utf-8');
+        return { path: candidate, config: JSON.parse(content) };
+      } catch (error) {
+        return { path: candidate, config: null, error: error.message };
+      }
+    }
+  }
+
+  return { path: path.join(OPENCODE_DIR, OPENCODE_CONFIG_FILES[0]), config: null };
+}
+
+function saveOpenCodeConfig(configPath, config) {
+  ensureDir(OPENCODE_DIR);
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+}
+
+function ensureOpenCodePluginReference() {
+  const pluginPaths = [
+    path.join(OPENCODE_PLUGIN_DIR, 'deliberate.js'),
+    path.join(OPENCODE_PLUGIN_DIR, 'deliberate-changes.js')
+  ];
+  const targets = pluginPaths.map((pluginPath) => {
+    const normalized = pluginPath.split(path.sep).join('/');
+    return normalized.startsWith('/') ? `file://${normalized}` : `file:///${normalized}`;
+  });
+  const { path: configPath, config, error } = loadOpenCodeConfig();
+
+  if (error) {
+    console.warn(`Warning: Could not parse ${configPath}: ${error}`);
+    return { updated: false, configPath };
+  }
+
+  const nextConfig = config || { $schema: 'https://opencode.ai/config.json' };
+  const plugins = Array.isArray(nextConfig.plugin) ? nextConfig.plugin : [];
+  let updated = false;
+
+  for (const target of targets) {
+    if (!plugins.includes(target)) {
+      plugins.push(target);
+      updated = true;
+    }
+  }
+
+  if (updated) {
+    nextConfig.plugin = plugins;
+    saveOpenCodeConfig(configPath, nextConfig);
+  }
+
+  return { updated, configPath };
+}
+
+/**
+ * Install OpenCode plugin to ~/.config/opencode/plugins
+ * Uses symlink on Unix, copy on Windows
+ * @returns {string|null} Installed plugin path or null
+ */
+function installOpenCodePlugin() {
+  const pluginSource = path.join(__dirname, '..', 'opencode');
+
+  const primaryPluginSource = path.join(pluginSource, 'deliberate-plugin.js');
+  const changesPluginSource = path.join(pluginSource, 'deliberate-changes-plugin.js');
+
+  if (!fs.existsSync(primaryPluginSource) || !fs.existsSync(changesPluginSource)) {
+    console.warn('Warning: OpenCode plugin source not found, skipping');
+    return null;
+  }
+
+  ensureDir(OPENCODE_PLUGIN_DIR);
+
+  const primaryDest = path.join(OPENCODE_PLUGIN_DIR, 'deliberate.js');
+  const changesDest = path.join(OPENCODE_PLUGIN_DIR, 'deliberate-changes.js');
+
+  for (const dest of [primaryDest, changesDest]) {
+    try {
+      const stat = fs.lstatSync(dest);
+      if (stat.isFile() || stat.isSymbolicLink()) {
+        fs.unlinkSync(dest);
+      }
+    } catch (err) {
+      // File doesn't exist, that's fine
+    }
+  }
+
+  if (IS_WINDOWS) {
+    fs.copyFileSync(primaryPluginSource, primaryDest);
+    fs.copyFileSync(changesPluginSource, changesDest);
+    console.log(`Installed OpenCode plugin: ${primaryDest} (copied)`);
+    console.log(`Installed OpenCode plugin: ${changesDest} (copied)`);
+  } else {
+    fs.symlinkSync(primaryPluginSource, primaryDest);
+    fs.symlinkSync(changesPluginSource, changesDest);
+    fs.chmodSync(primaryPluginSource, 0o755);
+    fs.chmodSync(changesPluginSource, 0o755);
+    console.log(`Installed OpenCode plugin: ${primaryDest} -> ${primaryPluginSource}`);
+    console.log(`Installed OpenCode plugin: ${changesDest} -> ${changesPluginSource}`);
+  }
+
+  const configResult = ensureOpenCodePluginReference();
+  if (configResult.updated) {
+    console.log(`Updated OpenCode config: ${configResult.configPath}`);
+  } else {
+    console.log(`OpenCode config already references plugin: ${configResult.configPath}`);
+  }
+
+  return primaryDest;
+}
+
 /**
  * Update ~/.claude/settings.json with hook configuration
  * Preserves existing settings and hooks
@@ -715,6 +832,16 @@ export async function install() {
   console.log('Updating Claude Code settings...');
   updateSettings();
 
+  // Install OpenCode plugin
+  console.log('');
+  console.log('Installing OpenCode plugin...');
+  const opencodePlugin = installOpenCodePlugin();
+  if (!opencodePlugin) {
+    console.log('OpenCode plugin: ⚠️  Not installed');
+  } else {
+    console.log('OpenCode plugin: ✅ Installed (commands + changes)');
+  }
+
   // Configure LLM if not already configured
   if (!isLLMConfigured()) {
     await configureLLM();
@@ -734,14 +861,19 @@ export async function install() {
   for (const hookPath of installed) {
     console.log(`  - ${hookPath}`);
   }
+  if (opencodePlugin) {
+    console.log(`  - ${opencodePlugin} (OpenCode plugin: commands)`);
+    console.log(`  - ${path.join(OPENCODE_PLUGIN_DIR, 'deliberate-changes.js')} (OpenCode plugin: changes)`);
+  }
   console.log('');
   console.log('Next steps:');
   console.log('  1. Restart Claude Code to load the new hooks');
+  console.log('  2. Restart OpenCode to load the new plugin');
   console.log('');
-  console.log('  2. (Optional) Start the classifier server for faster ML detection:');
+  console.log('  3. (Optional) Start the classifier server for faster ML detection:');
   console.log('     deliberate serve');
   console.log('');
-  console.log('  3. Test classification:');
+  console.log('  4. Test classification:');
   console.log('     deliberate classify "rm -rf /"');
   console.log('');
 }

package/src/uninstall.js

@@ -15,11 +15,15 @@ const CLAUDE_DIR = path.join(HOME_DIR, '.claude');
 const HOOKS_DIR = path.join(CLAUDE_DIR, 'hooks');
 const SETTINGS_FILE = path.join(CLAUDE_DIR, 'settings.json');
 const CONFIG_FILE = path.join(HOME_DIR, '.deliberate', 'config.json');
+const OPENCODE_DIR = path.join(HOME_DIR, '.config', 'opencode');
+const OPENCODE_PLUGIN_DIR = path.join(OPENCODE_DIR, 'plugins');
+const OPENCODE_CONFIG_FILES = ['opencode.json', 'opencode.jsonc'];
 
 // Hook files to remove
 const HOOKS_TO_REMOVE = [
-  'deliberate-explain-command.py',
-  'deliberate-explain-changes.py'
+  'deliberate-commands.py',
+  'deliberate-commands-post.py',
+  'deliberate-changes.py'
 ];
 
 /**
@@ -45,6 +49,53 @@ function removeHooks() {
   return removed;
 }
 
+/**
+ * Remove OpenCode plugin from config and plugins dir
+ */
+function removeOpenCodePlugin() {
+  let removed = false;
+
+  const pluginPaths = [
+    path.join(OPENCODE_PLUGIN_DIR, 'deliberate.js'),
+    path.join(OPENCODE_PLUGIN_DIR, 'deliberate-changes.js')
+  ];
+
+  for (const pluginPath of pluginPaths) {
+    if (fs.existsSync(pluginPath)) {
+      fs.unlinkSync(pluginPath);
+      console.log(`  Removed OpenCode plugin: ${pluginPath}`);
+      removed = true;
+    }
+  }
+
+  for (const filename of OPENCODE_CONFIG_FILES) {
+    const configPath = path.join(OPENCODE_DIR, filename);
+    if (!fs.existsSync(configPath)) continue;
+
+    try {
+      const content = fs.readFileSync(configPath, 'utf-8');
+      const config = JSON.parse(content);
+      if (Array.isArray(config.plugin)) {
+        const nextPlugins = config.plugin.filter((entry) => !String(entry).includes('deliberate'));
+        if (nextPlugins.length !== config.plugin.length) {
+          config.plugin = nextPlugins;
+          fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+          console.log(`  Updated OpenCode config: ${configPath}`);
+          removed = true;
+        }
+      }
+    } catch (error) {
+      console.warn(`  Warning: Could not parse ${configPath}: ${error.message}`);
+    }
+  }
+
+  if (!removed) {
+    console.log('  No OpenCode plugin config found');
+  }
+
+  return removed;
+}
+
 /**
  * Remove Deliberate hooks from ~/.claude/settings.json
  */
@@ -71,8 +122,8 @@ function removeFromSettings() {
 
           const filteredHooks = matcher.hooks.filter(hook => {
             const isDeliberate = hook.command && (
-              hook.command.includes('deliberate-explain-command') ||
-              hook.command.includes('deliberate-explain-changes')
+              hook.command.includes('deliberate-commands') ||
+              hook.command.includes('deliberate-changes')
             );
             if (isDeliberate) modified = true;
             return !isDeliberate;
@@ -91,8 +142,8 @@ function removeFromSettings() {
 
           const filteredHooks = matcher.hooks.filter(hook => {
             const isDeliberate = hook.command && (
-              hook.command.includes('deliberate-explain-command') ||
-              hook.command.includes('deliberate-explain-changes')
+              hook.command.includes('deliberate-commands') ||
+              hook.command.includes('deliberate-changes')
             );
             if (isDeliberate) modified = true;
             return !isDeliberate;
@@ -153,6 +204,10 @@ export async function uninstall() {
   console.log('');
   removeFromSettings();
 
+  // Remove OpenCode plugin
+  console.log('');
+  removeOpenCodePlugin();
+
   // Ask about config
   console.log('');
   if (fs.existsSync(CONFIG_FILE)) {
@@ -186,7 +241,7 @@ export async function uninstall() {
   console.log('===========================================');
   console.log('');
   console.log('Next step:');
-  console.log('  Restart Claude Code to unload the hooks');
+  console.log('  Restart Claude Code and OpenCode to unload hooks/plugins');
   console.log('');
 }