makdoong2-team 1.3.0

package/dist/config.js

@@ -0,0 +1,96 @@
+// config.ts — single source of configuration for makdoong2-team.
+//
+// Replaces every MAKDOONG2 environment variable with ONE JSON file:
+//   ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/makdoong2-team.json
+//
+// The shell-side mirror reader is scripts/config.sh (jq). Both resolve the
+// same path and the same defaults, so gates (shell) and the plugin (TS) agree.
+//
+// HOME / XDG_CONFIG_HOME are read ONLY to *locate* the config dir (the same
+// convention opencode itself follows) — they are not tunable settings.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+export const DEFAULT_STALL_ESCALATE_THRESHOLD = 5;
+export const LOG_LEVELS = [
+    "silent",
+    "error",
+    "warn",
+    "info",
+    "debug",
+    "trace",
+];
+export const LOG_MODES = ["stdin", "file"];
+export const DEFAULT_LOG_MAX_BYTES = 10 * 1024 * 1024;
+export function readLoggingConfig(block) {
+    const rawLevel = block?.level;
+    const level = typeof rawLevel === "string" && LOG_LEVELS.includes(rawLevel)
+        ? rawLevel
+        : "error";
+    const rawMode = block?.mode;
+    const mode = typeof rawMode === "string" && LOG_MODES.includes(rawMode)
+        ? rawMode
+        : "stdin";
+    const rawEventMax = block?.event_max_chars;
+    const eventMaxChars = typeof rawEventMax === "number" && Number.isFinite(rawEventMax) && rawEventMax > 0
+        ? Math.floor(rawEventMax)
+        : 300;
+    const rawMaxBytes = block?.max_bytes;
+    const maxBytes = typeof rawMaxBytes === "number" && Number.isFinite(rawMaxBytes) && rawMaxBytes > 0
+        ? Math.floor(rawMaxBytes)
+        : DEFAULT_LOG_MAX_BYTES;
+    if (mode === "stdin") {
+        return { level, mode, path: null, eventMaxChars, maxBytes };
+    }
+    const rawPath = block?.path;
+    if (typeof rawPath !== "string" || rawPath.trim() === "") {
+        throw new Error(`[makdoong2-team config] logging.mode="file" requires logging.path to be a non-empty string. ` +
+            `Edit \${XDG_CONFIG_HOME:-\$HOME/.config}/opencode/makdoong2-team.json and set .logging.path, ` +
+            `or change .logging.mode to "stdin".`);
+    }
+    return { level, mode, path: rawPath, eventMaxChars, maxBytes };
+}
+function configDir() {
+    const xdg = process.env.XDG_CONFIG_HOME;
+    const base = xdg && xdg.trim() ? xdg : join(homedir(), ".config");
+    return join(base, "opencode");
+}
+// Locate the npm-installed makdoong2-team package root by walking up from this
+// file (src/config.ts → package root). Works for both npm global installs
+// (…/lib/node_modules/makdoong2-team/) and local dev checkouts.
+function packageRoot() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    return join(here, "..");
+}
+let _cache;
+/** Load + cache makdoong2-team.json. Returns {} when absent or invalid (defaults apply). */
+export function loadConfig() {
+    if (_cache !== undefined)
+        return _cache ?? {};
+    try {
+        const path = join(configDir(), "makdoong2-team.json");
+        _cache = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        _cache = null; // absent / unreadable / invalid JSON → defaults
+    }
+    return _cache ?? {};
+}
+/** Resolve the five runtime path roots (JSON paths.* override → default).
+ *
+ * `skills` default is the opencode config dir (`${XDG_CONFIG_HOME:-$HOME/.config}/opencode/skills`)
+ * because scripts/install-lib.mjs deploys skill directories there, not into the
+ * package root. All other paths default to package-root subdirs.
+ */
+export function resolvePaths() {
+    const p = loadConfig().paths ?? {};
+    const root = packageRoot();
+    return {
+        hooks: p.hooks ?? join(root, "src", "hooks"),
+        gates: p.gates ?? join(root, "gates"),
+        scripts: p.scripts ?? join(root, "scripts"),
+        stages: p.stages ?? join(root, "stages"),
+        skills: p.skills ?? join(configDir(), "skills"),
+    };
+}

package/dist/logger.d.ts

@@ -0,0 +1,14 @@
+import { type LogLevel, type ResolvedLoggingConfig } from "./config.ts";
+export declare const logger: {
+    error(...args: unknown[]): void;
+    warn(...args: unknown[]): void;
+    info(...args: unknown[]): void;
+    debug(...args: unknown[]): void;
+    trace(...args: unknown[]): void;
+    isDebug(): boolean;
+    isTrace(): boolean;
+    _resetForTests(): void;
+    _setLevelForTests(level: LogLevel): void;
+    _setConfigForTests(cfg: ResolvedLoggingConfig): void;
+};
+export type Logger = typeof logger;

package/dist/logger.js

@@ -0,0 +1,131 @@
+import { appendFileSync, chmodSync, existsSync, mkdirSync, renameSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+import { loadConfig, readLoggingConfig, DEFAULT_LOG_MAX_BYTES, LOG_LEVELS, } from "./config.js";
+let _cachedResolved;
+function currentConfig() {
+    if (_cachedResolved !== undefined)
+        return _cachedResolved;
+    _cachedResolved = readLoggingConfig(loadConfig().logging);
+    return _cachedResolved;
+}
+function shouldEmit(target) {
+    const cur = LOG_LEVELS.indexOf(currentConfig().level);
+    const tgt = LOG_LEVELS.indexOf(target);
+    return tgt > 0 && tgt <= cur;
+}
+function formatArgs(args) {
+    return args
+        .map((a) => {
+        if (typeof a === "string")
+            return a;
+        if (a instanceof Error)
+            return a.stack ?? a.message;
+        try {
+            return JSON.stringify(a);
+        }
+        catch {
+            return String(a);
+        }
+    })
+        .join(" ");
+}
+// File emit: append-only, with size-triggered rotation to `<path>.1`.
+// Synchronous I/O — matches console.* blocking semantics and guarantees flush
+// on process.exit without a graceful-shutdown handshake.
+//
+// Never truncate. One `path` is shared by every opencode process on the host
+// (main TUI, each tmux sub-agent pane, `npm test`), so a per-process truncate
+// makes each new process erase the history the others are still writing.
+//
+// Rotation races are benign by construction: renameSync is atomic, so if two
+// processes both observe an oversized file, the loser simply re-renames a file
+// that is already small and at worst overwrites `<path>.1`. Never partial.
+//
+// Permissions: when we create the file we chmod it to 0o600 (owner read/write
+// only). Hook logs may contain redaction fallbacks or sub-agent command
+// captures that must not be world-readable — the redactSecrets sanitizer is
+// best-effort, so file mode is the last-line defense against credential leak
+// via `/var/log/opencode/opencode.log`.
+function rotateIfOversized(path, maxBytes) {
+    if (!Number.isFinite(maxBytes) || maxBytes <= 0)
+        return;
+    try {
+        if (statSync(path).size < maxBytes)
+            return;
+        renameSync(path, `${path}.1`);
+    }
+    catch {
+        // Missing file (nothing to rotate) or a concurrent rotation by another
+        // process — either way the append below still lands in a valid file.
+    }
+}
+function emitToFile(target, args) {
+    const cfg = currentConfig();
+    const path = cfg.path;
+    if (!path) {
+        throw new Error("[makdoong2-team logger] file mode active but path is null (readLoggingConfig invariant violation)");
+    }
+    const line = `[${new Date().toISOString()}] [${target}] [pid=${process.pid}] ${formatArgs(args)}\n`;
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        rotateIfOversized(path, cfg.maxBytes);
+        const isNewFile = !existsSync(path);
+        appendFileSync(path, line);
+        if (isNewFile) {
+            try {
+                chmodSync(path, 0o600);
+            }
+            catch {
+                // chmod failure is non-fatal (e.g. read-only mount, foreign owner) —
+                // log emission itself succeeded and the file remains writable by us.
+            }
+        }
+    }
+    catch (err) {
+        throw new Error(`[makdoong2-team logger] failed to write to log file "${path}": ${err.message}`);
+    }
+}
+function emit(target, args) {
+    if (!shouldEmit(target))
+        return;
+    const cfg = currentConfig();
+    if (cfg.mode === "file") {
+        emitToFile(target, args);
+        return;
+    }
+    switch (target) {
+        case "error":
+            console.error(...args);
+            return;
+        case "warn":
+            console.warn(...args);
+            return;
+        default:
+            console.log(...args);
+            return;
+    }
+}
+export const logger = {
+    error(...args) { emit("error", args); },
+    warn(...args) { emit("warn", args); },
+    info(...args) { emit("info", args); },
+    debug(...args) { emit("debug", args); },
+    trace(...args) { emit("trace", args); },
+    isDebug() { return shouldEmit("debug"); },
+    isTrace() { return shouldEmit("trace"); },
+    _resetForTests() {
+        _cachedResolved = undefined;
+    },
+    _setLevelForTests(level) {
+        _cachedResolved = {
+            level,
+            mode: "stdin",
+            path: null,
+            eventMaxChars: 300,
+            maxBytes: DEFAULT_LOG_MAX_BYTES,
+        };
+    },
+    _setConfigForTests(cfg) {
+        _cachedResolved = cfg;
+    },
+};

package/dist/mcp-secret-injector.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Which MCP server key in opencode.json's `mcp` object maps to which
+ * (env-var name, secrets.<key> name) pair. This is the same variable name
+ * both in opencode.json environment and in makdoong2-team.json .secrets.
+ */
+export interface McpSecretMapping {
+    /** opencode.json's `mcp.<key>` — e.g. "repos" */
+    mcpKey: string;
+    /** env var name injected into MCP process, and .secrets.<varName> lookup key */
+    varName: string;
+}
+/**
+ * Fixed mapping — one row per MCP that makdoong2-team owns credentials for.
+ *
+ * Do NOT extend this list to arbitrary MCPs. If a user adds their own MCP to
+ * opencode.json, we leave it alone (unmanaged). Only these four are considered
+ * SSoT-managed because their tokens are declared in makdoong2-team.json.
+ */
+export declare const MCP_SECRET_MAPPINGS: readonly McpSecretMapping[];
+export type SecretsSource = Readonly<Record<string, string | undefined>>;
+/**
+ * `status` semantics (consumers branch on these):
+ * - "injected":         secret was written (fresh or matched existing)
+ * - "overridden":       secret differed from opencode.json's value; replaced
+ * - "skipped-no-secret": makdoong2-team.json had no value → left alone
+ * - "skipped-no-mcp":   opencodeConfig.mcp[key] not present → nothing to do
+ *
+ * `tokenPrefix` is the first 8 chars of the applied token — safe to log for
+ * audit; never contains a full secret.
+ */
+export interface InjectResult {
+    mcpKey: string;
+    varName: string;
+    status: "injected" | "overridden" | "skipped-no-secret" | "skipped-no-mcp";
+    tokenPrefix?: string;
+}
+/**
+ * Apply one mapping in-place to the given opencodeConfig object.
+ *
+ * SAFETY: this function is `any`-typed on purpose. opencode does not export
+ * a stable public schema for its config object, and we only touch a narrow
+ * `mcp[key].environment[varName]` path. We defensively ensure the parent
+ * objects exist before writing.
+ *
+ * Returns a summary so the caller can log a coherent audit line.
+ */
+export declare function injectOneSecret(opencodeConfig: any, secrets: SecretsSource, mapping: McpSecretMapping): InjectResult;
+/**
+ * Apply every known mapping to the shared config object. Idempotent.
+ *
+ * Ordering: mappings are applied in declaration order. Missing MCPs and
+ * missing secrets are silently skipped — MCP entries opencode-side is the
+ * user's responsibility (they must have added the MCP to opencode.json for
+ * makdoong2-team to be able to override its token).
+ */
+export declare function injectAllSecrets(opencodeConfig: any, secrets: SecretsSource): InjectResult[];

package/dist/mcp-secret-injector.js

@@ -0,0 +1,89 @@
+// mcp-secret-injector.ts — inject makdoong2-team.json .secrets.* into opencode's
+// MCP env at plugin `config` hook time.
+//
+// **Motivation**
+// opencode reads `mcp.<name>.environment.<VAR>` from opencode.json once and
+// snapshots it as env when spawning the MCP subprocess. That value is *frozen*
+// for the lifetime of the process. makdoong2-team.json (SSoT for secrets)
+// therefore cannot influence direct MCP tool calls (`repos_*`, `works_*`, …)
+// unless we override the config *before* MCP initialization.
+//
+// **Mechanism (opencode 1.4.14+)**
+// The `config` plugin hook receives the shared Config object *by reference*
+// (Config.get() returns `s.config` directly, and Config.Info is DeepMutable
+// on purpose). MCP.state() later calls the same cfgSvc.get() and reads
+// `cfg.mcp[key].environment` on connectLocal(). Mutating `cfg.mcp[k].environment.<VAR>`
+// in the `config` hook therefore reaches the MCP spawn call site.
+//
+// **Coexistence with non-makdoong2 users**
+// - If makdoong2-team.json is absent or `.secrets.<VAR>` is empty/null, we
+//   leave opencode.json's `environment.<VAR>` alone → other plugins /
+//   standalone opencode users are unaffected.
+// - If both differ, makdoong2-team.json wins (SSoT) and a warning is emitted
+//   so the user can reconcile — same policy as skills/_lib/load-secret.sh
+//   already enforces for the skill_mcp code path.
+//
+// **Scope**
+// Only the four MCPs that makdoong2-team manages credentials for. Foreign MCPs
+// (chrome-devtools-mcp, site-wide entries, user's own) are untouched.
+/**
+ * Fixed mapping — one row per MCP that makdoong2-team owns credentials for.
+ *
+ * Do NOT extend this list to arbitrary MCPs. If a user adds their own MCP to
+ * opencode.json, we leave it alone (unmanaged). Only these four are considered
+ * SSoT-managed because their tokens are declared in makdoong2-team.json.
+ */
+export const MCP_SECRET_MAPPINGS = [
+    { mcpKey: "repos", varName: "BITBUCKET_API_TOKEN" },
+    { mcpKey: "works", varName: "JIRA_API_TOKEN" },
+    { mcpKey: "docs", varName: "CONFLUENCE_API_TOKEN" },
+    { mcpKey: "bamboo", varName: "BAMBOO_TOKEN" },
+];
+/**
+ * Apply one mapping in-place to the given opencodeConfig object.
+ *
+ * SAFETY: this function is `any`-typed on purpose. opencode does not export
+ * a stable public schema for its config object, and we only touch a narrow
+ * `mcp[key].environment[varName]` path. We defensively ensure the parent
+ * objects exist before writing.
+ *
+ * Returns a summary so the caller can log a coherent audit line.
+ */
+export function injectOneSecret(opencodeConfig, secrets, mapping) {
+    const { mcpKey, varName } = mapping;
+    const token = secrets[varName];
+    if (typeof token !== "string" || token.length === 0) {
+        return { mcpKey, varName, status: "skipped-no-secret" };
+    }
+    const mcpBlock = opencodeConfig?.mcp;
+    if (!mcpBlock || typeof mcpBlock !== "object") {
+        return { mcpKey, varName, status: "skipped-no-mcp" };
+    }
+    const entry = mcpBlock[mcpKey];
+    if (!entry || typeof entry !== "object") {
+        return { mcpKey, varName, status: "skipped-no-mcp" };
+    }
+    if (!entry.environment || typeof entry.environment !== "object") {
+        entry.environment = {};
+    }
+    const existing = entry.environment[varName];
+    const wasDifferent = typeof existing === "string" && existing.length > 0 && existing !== token;
+    entry.environment[varName] = token;
+    return {
+        mcpKey,
+        varName,
+        status: wasDifferent ? "overridden" : "injected",
+        tokenPrefix: token.slice(0, 8),
+    };
+}
+/**
+ * Apply every known mapping to the shared config object. Idempotent.
+ *
+ * Ordering: mappings are applied in declaration order. Missing MCPs and
+ * missing secrets are silently skipped — MCP entries opencode-side is the
+ * user's responsibility (they must have added the MCP to opencode.json for
+ * makdoong2-team to be able to override its token).
+ */
+export function injectAllSecrets(opencodeConfig, secrets) {
+    return MCP_SECRET_MAPPINGS.map((m) => injectOneSecret(opencodeConfig, secrets, m));
+}

package/dist/model-chain-cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/model-chain-cli.js

@@ -0,0 +1,21 @@
+// model-chain-cli.ts — tiny CLI that emits an agent's model fallback chain as JSON.
+// Used by scripts/with-fallback.sh. Keeps the chain definition single-sourced
+// in model-fallback-policy.ts.
+//
+// Usage: node dist/model-chain-cli.js <agent-id>
+import { POLICIES, applyConfigOverrides } from "./model-fallback-policy.js";
+import { loadConfig } from "./config.js";
+const _cfg = loadConfig();
+applyConfigOverrides(_cfg.agents, _cfg.model_policy);
+const agent = process.argv[2];
+if (!agent) {
+    console.error("usage: cli-chain.ts <agent-id>");
+    process.exit(2);
+}
+const policy = POLICIES[agent];
+if (!policy) {
+    console.log("[]");
+    process.exit(0);
+}
+const chain = [policy.primary, ...policy.fallbacks];
+console.log(JSON.stringify(chain));

package/dist/model-fallback-policy.d.ts

@@ -0,0 +1,69 @@
+export type ModelTier = "low" | "medium" | "high" | "max";
+export interface ModelSpec {
+    id: string;
+    variant?: "low" | "medium" | "high" | "xhigh" | "max";
+    tier: ModelTier;
+}
+export interface AgentModelPolicy {
+    primary: ModelSpec;
+    fallbacks: ModelSpec[];
+}
+export declare const DEFAULT_ALLOWED_PRIMARIES: ReadonlySet<string>;
+export declare let ALLOWED_PRIMARIES: ReadonlySet<string>;
+/** Current runtime allow-list (defaults ∪ extras). */
+export declare function getAllowedPrimaries(): ReadonlySet<string>;
+/** Public read-only accessor — single place documenting tier ordering. */
+export declare function tierRank(tier: ModelTier): number;
+export declare const POLICIES: Record<string, AgentModelPolicy>;
+export interface NextModelInput {
+    agent: string;
+    current: string;
+    reason?: string;
+}
+export interface NextModelResult {
+    next: ModelSpec | null;
+    exhausted: boolean;
+    chain: ModelSpec[];
+    reasonAccepted: string;
+}
+/** Picks the next model in the chain. Idempotent — call with the same `current` and you get the same `next`. */
+export declare function nextModel(input: NextModelInput): NextModelResult;
+/**
+ * Validates the two policy invariants. Throws on violation so a malformed
+ * default table or env override fails fast at plugin load.
+ *   1. policy.primary.id ∈ ALLOWED_PRIMARIES (= defaults ∪ extras)
+ *   2. ∀ fb ∈ policy.fallbacks: TIER_RANK[fb.tier] < TIER_RANK[policy.primary.tier]
+ */
+export declare function validatePolicies(policies?: Record<string, AgentModelPolicy>): void;
+/**
+ * Fallback override spec — either a bare model ID (tier defaults to "low" for
+ * backward compatibility) or an object with an explicit tier.
+ */
+export type FallbackOverride = string | {
+    id: string;
+    tier?: ModelTier;
+};
+/** omo-style flat per-agent override read from makdoong2-team.json `agents` block. */
+export interface AgentOverrideInput {
+    model?: string;
+    variant?: ModelSpec["variant"];
+    /** Either ID(s) (tier defaults to "low") or {id, tier?} objects. */
+    fallback_models?: FallbackOverride | FallbackOverride[];
+}
+/** Site-level model policy overrides (extends built-in defaults). */
+export interface ModelPolicyOverrideInput {
+    /** Extra primary model IDs to allow on top of DEFAULT_ALLOWED_PRIMARIES. */
+    allowed_primaries?: string[];
+}
+/**
+ * Apply per-agent overrides + model_policy overrides from makdoong2-team.json
+ * onto POLICIES and the runtime ALLOWED_PRIMARIES, then re-validate.
+ *
+ * Atomicity: on any validation failure, BOTH POLICIES and ALLOWED_PRIMARIES
+ * are restored to their pre-call snapshot so the runtime can keep loading
+ * with the built-in defaults instead of a half-applied corrupt state.
+ *
+ * Kept dependency-free (the blocks are passed in by the caller, not read here)
+ * so scripts/smoke-test.mjs can mirror this module without a config dependency.
+ */
+export declare function applyConfigOverrides(agents?: Record<string, AgentOverrideInput | undefined>, modelPolicy?: ModelPolicyOverrideInput): void;