leos-agent 6.3.0 → 7.0.0

package/scripts/memory.py

@@ -45,6 +45,7 @@ Set LEOS_AGENT_NO_PROJECT=1 to disable writing to native surfaces entirely.
 Exit codes: 0 ok, non-zero on error (except context/session, which never fail).
 """
 import datetime
+import contextlib
 import hashlib
 import json
 import os
@@ -150,14 +151,39 @@ def ref_path(ref):
 # fact files
 # --------------------------------------------------------------------------
 
-def _atomic_text(path, text, mode=0o644):
+def _private_dir(path):
+    """Create a canonical Leo-owned directory with private permissions."""
+    os.makedirs(path, mode=0o700, exist_ok=True)
+    os.chmod(path, 0o700)
+    return path
+
+
+def _memory_dirs(scope=None, repo=None):
+    root = _private_dir(memory_root())
+    if scope == "global":
+        return _private_dir(os.path.join(root, "global"))
+    if scope == "repo":
+        repo_root = _private_dir(os.path.join(root, "repo"))
+        return _private_dir(os.path.join(repo_root, repo_slug(repo)))
+    return root
+
+
+@contextlib.contextmanager
+def _memory_lock():
+    """The one lock boundary for every memory read-modify-write operation."""
+    _memory_dirs()
+    with state._locked(_lock_path()):
+        yield
+
+
+def _atomic_text(path, text, mode=0o600):
     """Markdown twin of state.atomic_write, which json-dumps its argument."""
     os.makedirs(os.path.dirname(path), exist_ok=True)
     fd, tmp = tempfile.mkstemp(dir=os.path.dirname(path), suffix=".tmp")
     try:
         with os.fdopen(fd, "w", encoding="utf-8") as fh:
             fh.write(text)
-        os.chmod(tmp, mode)  # mkstemp is 0600; these are readable config files
+        os.chmod(tmp, mode)  # mkstemp is 0600; callers choose the final contract.
         os.replace(tmp, path)
     except BaseException:
         try:
@@ -254,7 +280,7 @@ def _listdir(path):
 # index
 # --------------------------------------------------------------------------
 
-def reindex():
+def _reindex_unlocked():
     facts, unreadable = _iter_facts()
     entries = []
     repos = {}
@@ -277,11 +303,17 @@ def reindex():
         "repos": repos,
         "unreadable": unreadable,
     }
-    state.atomic_write(os.path.join(memory_root(), "index.json"), index)
+    _atomic_text(os.path.join(memory_root(), "index.json"),
+                 json.dumps(index, indent=1, sort_keys=True) + "\n")
     _atomic_text(os.path.join(memory_root(), "MEMORY.md"), _render_memory_md(index))
     return index
 
 
+def reindex():
+    with _memory_lock():
+        return _reindex_unlocked()
+
+
 def _load_index():
     """Never state.load(): it sys.exit()s on corruption, breaking fail-open."""
     try:
@@ -368,14 +400,6 @@ def render_context(index, repo=None, limit=MEMORY_CONTEXT_LIMIT):
 # projection
 # --------------------------------------------------------------------------
 
-def _home(var, *parts):
-    base = os.environ.get(var)
-    if not base:
-        base = os.path.join(os.path.expanduser("~"), parts[0])
-        parts = parts[1:]
-    return os.path.join(base, *parts) if parts else base
-
-
 def hermes_home():
     return os.environ.get("HERMES_HOME") or os.path.join(os.path.expanduser("~"), ".hermes")
 
@@ -476,7 +500,7 @@ def _hermes_absent(targets):
     return [{"harness": "hermes", "path": None, "status": "skipped:opt-in-required"}]
 
 
-def project(index=None):
+def _project_unlocked(index=None):
     if os.environ.get("LEOS_AGENT_NO_PROJECT") == "1":
         targets = projection_targets()
         return [{"harness": h, "path": f, "status": "skipped:disabled"}
@@ -484,7 +508,7 @@ def project(index=None):
             {"harness": t["harness"], "path": None, "status": "skipped:disabled"}
             for t in _hermes_absent(targets)]
     if index is None:
-        index = _load_index() or reindex()
+        index = _load_index() or _reindex_unlocked()
     # GLOBAL facts only — see the module docstring.
     body = render_context({"facts": [e for e in index["facts"] if e["scope"] == "global"],
                            "unreadable": index.get("unreadable", [])})
@@ -498,6 +522,11 @@ def project(index=None):
     return results
 
 
+def project(index=None):
+    with _memory_lock():
+        return _project_unlocked(index)
+
+
 def _project_one(gate, path, owned, block, require_file=False):
     try:
         if not os.path.isdir(gate):
@@ -508,9 +537,13 @@ def _project_one(gate, path, owned, block, require_file=False):
             return "skipped:no-soul"
         target = os.path.realpath(path) if os.path.islink(path) else path
         existing = ""
-        mode = 0o644
+        # New generated projections are private. If the user already owns the
+        # target, retain its existing mode exactly instead of tightening it
+        # behind their back.
+        mode = 0o600
         if os.path.exists(target):
-            mode = os.stat(target).st_mode & 0o777
+            if not owned:
+                mode = os.stat(target).st_mode & 0o777
             with open(target, encoding="utf-8", errors="replace") as fh:
                 existing = fh.read()
         if owned:
@@ -560,11 +593,11 @@ def write_fact(scope, type_, title, body, repo=None):
 
     directory = _scope_dir(scope, repo)
     slug = fact_slug(title)
-    with state._locked(_lock_path()):
-        os.makedirs(directory, exist_ok=True)
-        if len(_listdir(directory)) >= MAX_FACTS_PER_SCOPE:
+    with _memory_lock():
+        _memory_dirs(scope, repo)
+        path, action, created = _resolve_slot(directory, slug, type_, title)
+        if action == "created" and len(_listdir(directory)) >= MAX_FACTS_PER_SCOPE:
             sys.exit(f"memory: this scope is full ({MAX_FACTS_PER_SCOPE} facts) — consolidate or forget first")
-        path, action, created = _resolve_slot(directory, slug, type_)
         now = _now()
         meta = {
             "title": title,
@@ -577,25 +610,27 @@ def write_fact(scope, type_, title, body, repo=None):
         if scope == "repo":
             meta["repo"] = repo
         _atomic_text(path, render_fact(meta, body))
-        index = reindex()
-        projection = project(index)
+        index = _reindex_unlocked()
+        projection = _project_unlocked(index)
     rel = os.path.relpath(path, memory_root())[:-3]
     return {"action": action, "ref": rel, "path": path,
             "description": meta["description"], "projection": projection}
 
 
-def _resolve_slot(directory, slug, type_):
-    """Same title+type updates in place; same title, different type gets -2."""
+def _resolve_slot(directory, slug, type_, title):
+    """Only an exact title-and-type identity updates; collisions get -N."""
     candidate = os.path.join(directory, f"{slug}.md")
     parsed = parse_fact(candidate) if os.path.exists(candidate) else None
-    if parsed is None:
-        return candidate, ("created" if not os.path.exists(candidate) else "created"), None
-    if parsed[0].get("type") == type_:
+    if not os.path.exists(candidate):
+        return candidate, "created", None
+    if (parsed and parsed[0].get("type") == type_
+            and parsed[0].get("title") == title):
         return candidate, "updated", parsed[0].get("created")
     suffix = 2
     while os.path.exists(os.path.join(directory, f"{slug}-{suffix}.md")):
         existing = parse_fact(os.path.join(directory, f"{slug}-{suffix}.md"))
-        if existing and existing[0].get("type") == type_:
+        if (existing and existing[0].get("type") == type_
+                and existing[0].get("title") == title):
             return (os.path.join(directory, f"{slug}-{suffix}.md"), "updated",
                     existing[0].get("created"))
         suffix += 1
@@ -608,22 +643,26 @@ def forget(ref):
         sys.exit(f"memory: no such memory {ref!r}")
     stamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%d%H%M%S")
     trash = os.path.join(memory_root(), ".trash", os.path.dirname(ref))
-    with state._locked(_lock_path()):
-        os.makedirs(trash, exist_ok=True)
+    with _memory_lock():
+        trash_root = _private_dir(os.path.join(memory_root(), ".trash"))
+        current = trash_root
+        for part in os.path.dirname(ref).split("/"):
+            current = _private_dir(os.path.join(current, part))
         # Move, never unlink: automatic capture plus hard delete on the model's
         # own judgment is a data-loss path, and the trash costs nothing.
         destination = os.path.join(trash, f"{os.path.basename(ref)}.{stamp}.md")
         shutil.move(path, destination)
-        index = reindex()
-        projection = project(index)
+        index = _reindex_unlocked()
+        projection = _project_unlocked(index)
     return {"forgotten": ref, "path": destination, "projection": projection}
 
 
 def session(cwd=None):
     """One call for the bootstraps: refresh, project, return the block."""
-    index = reindex()
-    project(index)
-    return render_context(index, repo=repo_key(cwd))
+    with _memory_lock():
+        index = _reindex_unlocked()
+        _project_unlocked(index)
+        return render_context(index, repo=repo_key(cwd))
 
 
 FLAGS = ("--repo", "--cwd")

package/scripts/render_adapters.py

@@ -59,7 +59,9 @@ def _validate(config):
                     f"tier ({TIERS[0]!r}) can be — every other rung's roles keep their "
                     "job through a collapse"
                 )
-            twins = [t for t in TIERS if t != tier and rows[t]["model"] == rows[tier]["model"]]
+            twins = [
+                t for t in TIERS if t != tier and _tier_identity(rows[t]) == _tier_identity(rows[tier])
+            ]
             if not twins:
                 raise ValueError(
                     f"{harness}: tier {tier!r} is declared absent but has a model of its own — "
@@ -91,6 +93,15 @@ def _split_role(text):
     return lines[1:end], "\n".join(lines[end + 1 :]).strip() + "\n"
 
 
+def _tier_identity(row):
+    """A tier is a model *and* its requested reasoning effort.
+
+    Codex deliberately maps Fable and Opus to the same model at different
+    efforts. Treating a model id alone as identity falsely removes Fable.
+    """
+    return row["model"], row.get("effort")
+
+
 def _without(frontmatter, keys):
     return [line for line in frontmatter if not any(line.startswith(key + ":") for key in keys)]
 
@@ -177,6 +188,12 @@ def _opencode_agents(config):
             # on the catastrophic rm class for write-capable agents. The
             # precise tripwire stays hooks/bash-guard.py.
             permission = {"bash": {cmd: "deny" for cmd in adapter["writeBashDeny"]}}
+        # `permission.edit: deny` prevents native edits, not destructive shell
+        # commands. Apply the narrow catastrophic Bash denial to every role,
+        # including shell-capable read-only agents.
+        permission.setdefault("bash", {}).update(
+            {cmd: "deny" for cmd in adapter["writeBashDeny"]}
+        )
         agents[role] = {
             "description": fm.get("description", ""),
             "mode": "subagent",
@@ -205,7 +222,7 @@ def _collapse_note(rows):
     """
     by_model = {}
     for tier in ("fable", "opus", "sonnet", "haiku"):
-        by_model.setdefault(rows[tier]["model"], []).append(tier)
+        by_model.setdefault(_tier_identity(rows[tier]), []).append(tier)
     collapsed = [tiers for tiers in by_model.values() if len(tiers) > 1]
     if not collapsed:
         return ""
@@ -260,8 +277,9 @@ def _skill_notes(config, harness):
     lines.append("")
     lines.append(
         "Every other skill in the policy's Skill index is registered here and "
-        "behaves the same, and so are the operational skills — `leo:review-pr`, "
-        "`leo:resolve-ticket` and `leo:watch-review` all run on this harness. "
+        "behaves the same, and so are the operational skills — "
+        + ", ".join(f"`leo:{name}`" for name in config["skills"].get("operational", ()))
+        + " all run on this harness. "
         "Where they name a capability the table above says is missing, take "
         "the fallback each one documents."
     )
@@ -333,6 +351,8 @@ def _mapping_docs(config):
         parts.append(_capability_table(config, harness))
         parts.append(_capability_notes(config, harness))
         parts.append(_collapse_note(rows))
+        if harness == "opencode":
+            parts.append("\n" + _absent_tier_sentence(config) + "\n")
         parts.append(_skill_notes(config, harness))
         out[harness] = "".join(parts)
     return out
@@ -375,32 +395,47 @@ def _payload_readme(config):
     return (
         GENERATED
         + "\n# Leo's Agent\n\n"
-        "Leo's Agent is a portable agent operating policy: cost-tiered model routing, specialist "
-        "subagent roles, process skills, execute-then-review discipline, and a narrow "
-        "catastrophic-command guard.\n\n"
-        "This npm package is the **OpenCode** distribution. Claude Code, Codex, Cursor, and Hermes "
-        "each install it through their own plugin system — see "
-        "[the repository](https://github.com/foxhatleo/leos-agent) for those.\n\n"
-        "## Install\n\n"
+        "Leo's Agent is a portable operating policy with cost-tiered routing, "
+        "specialist roles, process skills, review discipline, and a narrow command guard. "
+        "This npm package is the **OpenCode** distribution; use the "
+        "[repository](https://github.com/foxhatleo/leos-agent) for Claude Code, Codex, Cursor, "
+        "and Hermes instructions.\n\n"
+        "Supported hosts are macOS, Linux, and WSL with Python 3.9+; native Windows is unsupported.\n\n"
+        "## Install and update\n\n"
         "```sh\nopencode plugin leos-agent --global\n```\n\n"
-        "On builds without the `plugin` subcommand, add it to "
-        "`~/.config/opencode/opencode.json` (or `opencode.jsonc`) by hand:\n\n"
+        "On builds without that subcommand, add `leos-agent` to the `plugin` array in "
+        "`~/.config/opencode/opencode.json` or `opencode.jsonc`:\n\n"
         '```json\n{ "$schema": "https://opencode.ai/config.json", "plugin": ["leos-agent"] }\n```\n\n'
-        "Start a new OpenCode session. The plugin registers the skills directory, the "
-        f"{len(json.loads(_opencode_agents(config)))} subagent roles, and the operating policy, and installs the "
-        "bash deletion tripwire.\n\n"
-        "If the skills do not appear, run `opencode debug skill` — each one should list a "
-        "`location` inside this package. The plugin resolves its own install path and registers "
-        "it, so none needs to be written by hand.\n\n"
+        "Run `opencode auth login` and choose OpenRouter before using the mapped models; Leo "
+        "never writes provider credentials. Update with "
+        "`opencode plugin leos-agent --global --force`, then start a new session. OpenCode "
+        "currently has no plugin removal command; remove the `leos-agent` configuration entry "
+        "to uninstall.\n\n"
+        "The plugin registers generated shadow skills (`leo-<name>`) and namespaced "
+        f"`leo-<role>` agents ({len(json.loads(_opencode_agents(config)))} generated definitions) "
+        "from `adapters/opencode/agents.json`, "
+        "then injects the operating policy through OpenCode's configuration. Invoke its shadow "
+        "skill as `leo-using-leo`. If a skill is absent, "
+        "run `opencode debug skill`; its `location` should be an `opencode-skills-<hash>/leo-<name>/` "
+        "directory under machine-local state, not a hand-written package path.\n\n"
+        "## MCP and durable state\n\n"
+        "Use `leo-setup` to inspect or explicitly configure MCP services: `connectors` reports "
+        "without writing, while `connect` and `apply` make only reviewed, harness-owned changes. "
+        "Vendor connectors are never installed automatically and OAuth stays in OpenCode. "
+        "Slack, Gmail, Drive, and providers without dynamic registration remain manual-only.\n\n"
+        "Uninstall preserves `${LEOS_AGENT_LOCAL_PATH:-$HOME/.leos-agent-local}`. Before a full "
+        "purge, export or copy that directory; only then explicitly remove it. For a 7.0 recovery, "
+        "move old `LEOS_AGENT_PATH/local/` data there, rename the variable, restart, and run "
+        "`leo-doctor`.\n\n"
         "## Model tiers\n\n"
         "Tier names describe the kind of work, not a fixed provider model.\n\n"
         + _table({tier: opencode[tier] for tier in TIERS})
         + "\n\n"
         + _absent_tier_sentence(config)
-        + " Retier by editing `config/models.json` and re-running "
-        "`scripts/render_adapters.py`.\n\n"
+        + " Retier by editing `config/models.json` and re-running `scripts/render_adapters.py`.\n\n"
         "## Links\n\n"
-        "- [Repository and full documentation](https://github.com/foxhatleo/leos-agent)\n"
+        "- [Repository, contributing, and security policy](https://github.com/foxhatleo/leos-agent)\n"
+        "- [GitHub Releases](https://github.com/foxhatleo/leos-agent/releases)\n"
         "- [Operating policy](https://github.com/foxhatleo/leos-agent/blob/main/plugins/leo/skills/using-leo/SKILL.md)\n\n"
         "MIT licensed.\n"
     )

package/scripts/resolve_attach_target.py

@@ -16,13 +16,16 @@ Exit code is 0 for "ok" and 1 otherwise, so callers can branch on it directly.
 import json
 import os
 import re
+import shlex
 import shutil
 import subprocess
 import sys
+from hashlib import sha256
 
 PR_NUM_RE = re.compile(r"^#?(\d+)$")
-PR_URL_RE = re.compile(r"^https?://[^/]*github\.com/([^/]+)/([^/]+)/pull/(\d+)")
+PR_URL_RE = re.compile(r"^https://github\.com/([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+)/pull/([1-9]\d*)$")
 TICKET_RE = re.compile(r"^([A-Za-z][A-Za-z0-9]*)-(\d+)$")
+SAFE_REF_RE = re.compile(r"^(?!-)[A-Za-z0-9][A-Za-z0-9._/-]*$")
 
 PR_FIELDS = "number,url,headRefName,baseRefName,state,title"
 
@@ -48,6 +51,36 @@ def emit(payload):
     sys.exit(0 if payload.get("status") == "ok" else 1)
 
 
+def is_safe_pr_url(url):
+    """Accept only a canonical public GitHub pull-request URL."""
+    return isinstance(url, str) and bool(PR_URL_RE.fullmatch(url))
+
+
+def is_safe_ref(ref):
+    """Keep refs shell-safe *and* ask Git to enforce its ref grammar."""
+    if not isinstance(ref, str) or not SAFE_REF_RE.fullmatch(ref):
+        return False
+    rc, _, _ = run(["git", "check-ref-format", "--branch", ref])
+    return rc == 0
+
+
+def suggested_worktree(root, branch):
+    """A readable name with a stable digest prevents slash-to-dash collisions."""
+    readable = branch.replace("/", "-")
+    digest = sha256(branch.encode("utf-8")).hexdigest()[:10]
+    return os.path.join(root, ".claude", "worktrees", f"{readable}-{digest}")
+
+
+def build_attach_command(workdir, pr_url, base_ref, branch):
+    """Build the intentional compound attach command with every value quoted."""
+    return (
+        'gh() { echo "$PR_URL"; }; '
+        f"cd {shlex.quote(workdir)}; "
+        f"PR_URL={shlex.quote(pr_url)} gh pr create --draft "
+        f"--base {shlex.quote(base_ref)} --head {shlex.quote(branch)}"
+    )
+
+
 # --- environment checks ----------------------------------------------------
 
 
@@ -194,7 +227,7 @@ def resolve(identifier, repo):
     """Return (pr_dict, note) or emit an error/ambiguous payload and exit."""
     ident = identifier.strip()
 
-    url_match = PR_URL_RE.match(ident)
+    url_match = PR_URL_RE.fullmatch(ident)
     if url_match:
         owner, name, number = url_match.groups()
         if f"{owner}/{name}".lower() != repo.lower():
@@ -321,8 +354,14 @@ def main():
 
     pr, note = resolve(sys.argv[1], repo)
     branch = pr.get("headRefName")
+    base_ref = pr.get("baseRefName") or "main"
+    pr_url = pr.get("url")
     if not branch:
         die(f"PR #{pr.get('number')} has no head branch recorded; cannot attach")
+    if not is_safe_ref(branch) or not is_safe_ref(base_ref):
+        die("PR branch or base ref contains unsupported shell-unsafe characters")
+    if not is_safe_pr_url(pr_url):
+        die("PR URL is not a canonical https://github.com/<owner>/<repo>/pull/<number> URL")
 
     workdir, kind = resolve_workdir(branch, root)
 
@@ -332,24 +371,17 @@ def main():
         "repo": repo,
         "branch": branch,
         "pr_number": pr.get("number"),
-        "pr_url": pr.get("url"),
-        "base_ref": pr.get("baseRefName") or "main",
+        "pr_url": pr_url,
+        "base_ref": base_ref,
         "pr_state": pr.get("state"),
         "pr_title": pr.get("title"),
         "workdir": workdir,
         "workdir_kind": kind,
         "repo_root": root,
-        "suggested_worktree": os.path.join(
-            root, ".claude", "worktrees", branch.replace("/", "-")
-        ),
+        "suggested_worktree": suggested_worktree(root, branch),
     }
     if workdir:
-        payload["attach_command"] = (
-            'gh() { echo "$PR_URL"; }; '
-            f"cd {workdir}; "
-            f"PR_URL={pr.get('url')} gh pr create --draft "
-            f"--base {payload['base_ref']} --head {branch}"
-        )
+        payload["attach_command"] = build_attach_command(workdir, pr_url, base_ref, branch)
     emit(payload)