opencode-agent-skill 13.0.0-beta.1 → 14.2.0-beta.1

package/lib/workspace-fingerprint.mjs

@@ -0,0 +1,198 @@
+import { createHash } from "node:crypto"
+import { lstatSync, readFileSync, readlinkSync } from "node:fs"
+import { spawnSync } from "node:child_process"
+import path from "node:path"
+
+const RUNTIME_DIRS = [
+  ".ues-cache",
+  ".ues-traces",
+  ".ues-work",
+  ".ues-learning",
+  ".ues-dashboard",
+  ".ues-sandboxes",
+  ".ues-memory",
+  ".ues-evals",
+]
+const RUNTIME_PATHSPECS = [
+  ".",
+  ...RUNTIME_DIRS.map((dir) => `:(exclude)${dir}/**`),
+]
+
+let nonGitNonce = 0
+
+function git(root, args) {
+  return spawnSync("git", args, {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+  })
+}
+
+function normalizePath(value) {
+  return String(value || "").replaceAll("\\", "/").replace(/^\.\//, "")
+}
+
+function porcelainEntries(statusOutput) {
+  const records = String(statusOutput || "").split("\0").filter(Boolean)
+  const entries = []
+  let renameCode = null
+
+  for (const record of records) {
+    if (record.length >= 3 && record[2] === " ") {
+      const code = record.slice(0, 2)
+      const file = normalizePath(record.slice(3))
+      if (file) entries.push({ code, file })
+      renameCode = /[RC]/.test(code) ? code : null
+      continue
+    }
+    if (renameCode) {
+      const file = normalizePath(record)
+      if (file) entries.push({ code: renameCode, file, renameSource: true })
+      renameCode = null
+    }
+  }
+  return entries
+}
+
+function porcelainChangedFiles(statusOutput) {
+  return [...new Set(porcelainEntries(statusOutput).map((entry) => entry.file))].sort()
+}
+
+function untrackedContentDigest(root, statusOutput, options = {}) {
+  const limit = Math.max(1024 * 1024, Number(options.maxUntrackedBytes || 32 * 1024 * 1024))
+  const totalLimit = Math.max(limit, Number(options.maxUntrackedTotalBytes || 64 * 1024 * 1024))
+  const files = porcelainEntries(statusOutput)
+    .filter((entry) => entry.code === "??")
+    .map((entry) => entry.file)
+    .sort()
+  const hash = createHash("sha256")
+  let totalBytes = 0
+
+  for (const relative of files) {
+    const full = path.resolve(root, relative)
+    if (full !== root && !full.startsWith(root + path.sep)) {
+      return { cacheable: false, reason: "untracked-path-escape", files }
+    }
+    try {
+      const info = lstatSync(full)
+      hash.update(relative)
+      hash.update("\0")
+      if (info.isSymbolicLink()) {
+        hash.update("symlink:")
+        hash.update(readlinkSync(full))
+        hash.update("\0")
+        continue
+      }
+      if (!info.isFile()) {
+        return { cacheable: false, reason: "untracked-non-file", files }
+      }
+      if (info.size > limit) {
+        return {
+          cacheable: false,
+          reason: "untracked-file-too-large",
+          files,
+          file: relative,
+          bytes: info.size,
+        }
+      }
+      totalBytes += info.size
+      if (totalBytes > totalLimit) {
+        return {
+          cacheable: false,
+          reason: "untracked-total-too-large",
+          files,
+          bytes: totalBytes,
+        }
+      }
+      hash.update(readFileSync(full))
+      hash.update("\0")
+    } catch {
+      return { cacheable: false, reason: "untracked-read-failed", files, file: relative }
+    }
+  }
+  return { cacheable: true, digest: hash.digest("hex"), files }
+}
+
+function nonGitSnapshot(root) {
+  nonGitNonce += 1
+  return {
+    schemaVersion: 1,
+    root,
+    git: false,
+    cacheable: false,
+    fingerprint: createHash("sha256")
+      .update(
+        "non-git-no-reuse:" +
+        root +
+        ":" +
+        process.pid +
+        ":" +
+        nonGitNonce,
+      )
+      .digest("hex"),
+    changedFiles: [],
+    head: null,
+  }
+}
+
+export function runtimeWorkspaceSnapshot(root = process.cwd()) {
+  root = path.resolve(root)
+  const inside = git(root, ["rev-parse", "--is-inside-work-tree"])
+  if (inside.status !== 0 || String(inside.stdout || "").trim() !== "true") {
+    return nonGitSnapshot(root)
+  }
+
+  const head = git(root, ["rev-parse", "HEAD"])
+  const status = git(root, [
+    "status",
+    "--porcelain=v1",
+    "-z",
+    "--untracked-files=all",
+    "--",
+    ...RUNTIME_PATHSPECS,
+  ])
+  const diff = git(root, ["diff", "--binary", "--no-ext-diff", "--", ...RUNTIME_PATHSPECS])
+  const cached = git(root, ["diff", "--cached", "--binary", "--no-ext-diff", "--", ...RUNTIME_PATHSPECS])
+
+  const commands = [head, status, diff, cached]
+  const commandComplete = commands.every((result) => result.status === 0)
+  const untracked = status.status === 0
+    ? untrackedContentDigest(root, status.stdout)
+    : { cacheable: false, reason: "status-unavailable", files: [] }
+  const cacheable = commandComplete && untracked.cacheable === true
+  if (!cacheable) {
+    // A partial Git snapshot or unhashable untracked file must never be reused
+    // as if it proved repository identity. Return a nonce fingerprint so
+    // callers fail closed while still exposing changed-file hints.
+    return {
+      ...nonGitSnapshot(root),
+      git: true,
+      head: head.status === 0 ? String(head.stdout || "").trim() || null : null,
+      changedFiles: status.status === 0 ? porcelainChangedFiles(status.stdout) : [],
+      reason: commandComplete ? untracked.reason : "git-snapshot-incomplete",
+    }
+  }
+
+  const parts = [
+    String(head.stdout || ""),
+    String(status.stdout || ""),
+    String(diff.stdout || ""),
+    String(cached.stdout || ""),
+    "untracked:" + String(untracked.digest || ""),
+  ]
+  return {
+    schemaVersion: 1,
+    root,
+    git: true,
+    cacheable: true,
+    fingerprint: createHash("sha256")
+      .update(parts.join("\n---UES-RUNTIME-FP---\n"))
+      .digest("hex"),
+    changedFiles: porcelainChangedFiles(status.stdout),
+    head: String(head.stdout || "").trim() || null,
+  }
+}
+
+export function runtimeWorkspaceFingerprint(root = process.cwd()) {
+  return runtimeWorkspaceSnapshot(root).fingerprint
+}

package/package.json

@@ -1,61 +1,50 @@
 {
   "name": "opencode-agent-skill",
-  "version": "13.0.0-beta.1",
-  "description": "Parallel weak-model engineering runtime with isolated same-model workers, event-driven DAG execution, transactional integration, adaptive context and evidence-gated verification for OpenCode",
+  "version": "14.2.0-beta.1",
+  "description": "Pi Agent engineering runtime with hierarchical context, verified persistent memory, learned capability failover, durable evidence, and evidence-gated verification",
   "type": "module",
   "bin": {
+    "ues": "bin/ocskill.mjs",
     "ocskill": "bin/ocskill.mjs"
   },
   "files": [
     "bin/ocskill.mjs",
     "lib/",
+    "global-config/AGENTS.md",
+    "global-config/skills/",
+    "global-config/agents/",
+    "global-config/commands/",
+    "global-config/plugins/",
+    "pi/",
     "scripts/",
-    "global-config/",
     "evals/",
-    "docs/",
+    "docs/V14-CONTEXT-MEMORY-FABRIC.md",
+    "docs/V14.1-QUALITY-PERFORMANCE-FABRIC.md",
+    "docs/V14.2-TURBO-WEAK-MODEL-RUNTIME.md",
+    "docs/PI-COMPAT.md",
+    "docs/OPENCODE-COMPAT.md",
     "README.md",
-    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
     "syntax": "node scripts/syntax-check.mjs",
-    "validate": "node scripts/validate.mjs",
-    "evals": "node scripts/eval-skills.mjs",
-    "evals:live:validate": "node scripts/validate-live-suite.mjs",
-    "test": "node --test test/*.test.mjs",
-    "ci": "npm run syntax && npm run validate && npm run docs:check && npm run evals && npm run evals:router && npm run evals:v11:validate && npm run evals:v12:validate && npm run evals:v13 && npm run evals:repo-scale:validate && npm run evals:live:validate && npm run evals:long:validate && npm run evals:polyglot:validate && npm test && npm pack --dry-run && npm run smoke:pack && npm run smoke:plain-install",
-    "postinstall": "node scripts/install.mjs",
-    "preuninstall": "node scripts/uninstall.mjs",
-    "prepublishOnly": "npm run ci",
-    "evals:live": "node scripts/eval-live.mjs",
-    "smoke:pack": "node scripts/smoke-packed-install.mjs",
-    "inspect:stack": "node scripts/detect-stack.mjs",
-    "inspect:tests": "node scripts/detect-test-commands.mjs",
-    "inspect:repo": "node scripts/repo-map.mjs",
-    "inspect:impact": "node scripts/impact-map.mjs",
-    "inspect:evidence": "node scripts/collect-evidence.mjs",
-    "inspect:git": "node scripts/check-working-tree.mjs",
-    "evals:report": "node scripts/eval-report.mjs",
-    "evals:router": "node scripts/eval-router.mjs",
-    "evals:long:validate": "node scripts/validate-live-suite.mjs --suite long",
-    "evals:long": "node scripts/eval-live.mjs --suite long",
-    "dashboard": "node scripts/control-center.mjs",
-    "evals:matrix": "node scripts/eval-matrix.mjs",
-    "smoke:plain-install": "node scripts/smoke-plain-install.mjs",
+    "test": "node --test",
+    "test:pi": "node --test test/pi-package.test.mjs",
     "docs:check": "node scripts/check-release-consistency.mjs",
     "release:check-tag": "node scripts/check-release-tag.mjs",
-    "evals:polyglot:validate": "node scripts/validate-live-suite.mjs --suite polyglot",
-    "evals:polyglot": "node scripts/eval-live.mjs --suite polyglot",
-    "evals:matrix:gate": "node scripts/eval-matrix.mjs --require-confidence",
-    "evals:ablation": "node scripts/eval-ablation.mjs",
-    "evals:v11": "node --test test/*-v11.test.mjs",
-    "evals:v11:validate": "node scripts/validate-v11-suite.mjs",
-    "evals:repo-scale:validate": "node scripts/validate-repo-scale-suite.mjs",
-    "evals:v12:validate": "node scripts/validate-v12-foundation.mjs",
-    "evals:v13": "node --test test/*-v13.test.mjs"
+    "smoke:pi": "node scripts/smoke-pi-extension.mjs",
+    "smoke:package": "node scripts/smoke-package-closure.mjs",
+    "eval:pi": "node scripts/eval-pi.mjs",
+    "ci": "npm run integrity && npm run runtime:exports && npm run syntax && npm test && npm run docs:check && npm pack --dry-run && npm run smoke:pi && npm run smoke:package && npm run smoke:packed",
+    "prepublishOnly": "npm run ci",
+    "smoke:packed": "node scripts/smoke-packed-install.mjs",
+    "eval:v14": "node --test test/capability-fabric-v14.test.mjs test/hierarchical-context-v14.test.mjs test/memory-engine-v14.test.mjs test/context-engine-v14.test.mjs test/task-engine-v14-context.test.mjs test/cli-v14.test.mjs test/v14-contract.test.mjs test/performance-fabric-v14.test.mjs test/browser-mcp-routing-v14.test.mjs test/process-hang-detector-v14.test.mjs test/v14.2-runtime.test.mjs test/benchmark-confidence.test.mjs",
+    "integrity": "node scripts/check-source-integrity.mjs",
+    "runtime:exports": "node scripts/check-runtime-exports.mjs"
   },
   "keywords": [
-    "opencode",
+    "pi-package",
+    "pi-agent",
     "agent-skills",
     "coding-agent",
     "developer-tools",
@@ -63,12 +52,10 @@
     "code-review",
     "debugging",
     "verification",
-    "visual-testing",
-    "browser-automation",
     "multimodal-agents"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22.19"
   },
   "publishConfig": {
     "access": "public"
@@ -81,5 +68,28 @@
   "bugs": {
     "url": "https://github.com/laivannha0202/opencode-agent-skill-/issues"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "pi": {
+    "extensions": [
+      "./pi/extensions/ues.ts"
+    ],
+    "skills": [
+      "./global-config/skills"
+    ],
+    "prompts": [
+      "./pi/prompts/*.md"
+    ]
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*",
+    "typebox": "*"
+  },
+  "peerDependenciesMeta": {
+    "@earendil-works/pi-coding-agent": {
+      "optional": true
+    },
+    "typebox": {
+      "optional": true
+    }
+  }
 }

package/pi/extensions/ues-child-runtime.ts

@@ -0,0 +1,238 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { readFile, stat } from "node:fs/promises";
+import { compactReversibleOutput } from "../../lib/performance-fabric.mjs";
+import { getEvidenceSelected } from "../../lib/evidence-store.mjs";
+import { recordVerification } from "../../lib/verification-broker.mjs";
+import { runtimeWorkspaceFingerprint } from "../../lib/workspace-fingerprint.mjs";
+import { destructiveShellRisk } from "../../lib/safety.mjs";
+import {
+  canonicalVerificationCommand,
+  looksLikeVerificationCommand,
+} from "../../lib/verification-command.mjs";
+
+const toolExecutionState = new Map<string, {
+  startedAt: number;
+  workspaceBefore?: string;
+  reusableCandidate: boolean;
+  canonicalVerification?: { command: string; args: string[]; raw: string } | null;
+}>();
+
+function configuredLimit() {
+  const raw = Number(process.env.UES_CHILD_TOOL_OUTPUT_LIMIT || 24 * 1024);
+  if (!Number.isFinite(raw)) return 24 * 1024;
+  return Math.max(4 * 1024, Math.min(128 * 1024, Math.trunc(raw)));
+}
+
+function configuredVerificationTimeout() {
+  const raw = Number(process.env.UES_CHILD_VERIFICATION_TIMEOUT_SEC || 300);
+  if (!Number.isFinite(raw) || raw <= 0) return 300;
+  return Math.max(30, Math.min(1800, Math.trunc(raw)));
+}
+
+function configuredRawCaptureLimit() {
+  const raw = Number(process.env.UES_CHILD_RAW_CAPTURE_LIMIT || 32 * 1024 * 1024);
+  if (!Number.isFinite(raw) || raw <= 0) return 32 * 1024 * 1024;
+  return Math.max(1024 * 1024, Math.min(128 * 1024 * 1024, Math.trunc(raw)));
+}
+
+function shellExitCode(event: any, rawText: string) {
+  if (!event.isError) return 0;
+  const match = String(rawText || "").match(/Command exited with code\s+(\d+)/i);
+  if (match) return Number(match[1]);
+  if (/timed out|timeout/i.test(rawText)) return 124;
+  if (/aborted/i.test(rawText)) return 130;
+  return 1;
+}
+
+function visibleText(event: any) {
+  return (event.content || [])
+    .filter((part: any) => part?.type === "text" && typeof part.text === "string")
+    .map((part: any) => part.text)
+    .join("\n");
+}
+
+async function capturedText(event: any, fallback: string) {
+  const fullOutputPath = String((event.details as any)?.fullOutputPath || "").trim();
+  if (!fullOutputPath) return { text: fallback, full: false, sourcePath: null };
+
+  try {
+    const info = await stat(fullOutputPath);
+    if (!info.isFile() || info.size <= 0 || info.size > configuredRawCaptureLimit()) {
+      return { text: fallback, full: false, sourcePath: fullOutputPath };
+    }
+    return {
+      text: await readFile(fullOutputPath, "utf8"),
+      full: true,
+      sourcePath: fullOutputPath,
+    };
+  } catch {
+    return { text: fallback, full: false, sourcePath: fullOutputPath };
+  }
+}
+
+export default function (pi: ExtensionAPI) {
+  const clearExecutionState = () => toolExecutionState.clear();
+  pi.on("session_start", clearExecutionState);
+  pi.on("session_shutdown", clearExecutionState);
+
+  pi.on("tool_call", async (event, ctx) => {
+    const toolName = String(event.toolName || "");
+    if (!["bash", "powershell"].includes(toolName)) return undefined;
+
+    const command = String((event.input as any)?.command || "");
+    const risk = destructiveShellRisk(command);
+    if (risk.risky) {
+      toolExecutionState.delete(String(event.toolCallId || ""));
+      return {
+        block: true,
+        reason:
+          `UES child safety blocked ${risk.id || "destructive"} shell operation` +
+          (risk.segment ? `: ${risk.segment}` : ""),
+      };
+    }
+
+    const canonicalVerification = canonicalVerificationCommand(command);
+    const reusableCandidate = Boolean(canonicalVerification);
+    const workspaceBefore = reusableCandidate
+      ? (() => {
+          try { return runtimeWorkspaceFingerprint(ctx.cwd); } catch { return undefined; }
+        })()
+      : undefined;
+    toolExecutionState.set(String(event.toolCallId || ""), {
+      startedAt: Date.now(),
+      workspaceBefore,
+      reusableCandidate,
+      canonicalVerification,
+    });
+    if (looksLikeVerificationCommand(command) && (event.input as any)?.timeout == null) {
+      (event.input as any).timeout = configuredVerificationTimeout();
+    }
+    return undefined;
+  });
+
+  pi.on("tool_result", async (event, ctx) => {
+    const toolName = String(event.toolName || "");
+    if (!["bash", "powershell", "grep", "find", "ls"].includes(toolName)) {
+      return undefined;
+    }
+
+    const shownText = visibleText(event);
+    const capture = await capturedText(event, shownText);
+    const rawText = capture.text;
+    const images = (event.content || []).filter((part: any) => part?.type !== "text");
+    const commandHint = String(
+      (event.input as any)?.command ||
+      (event.input as any)?.pattern ||
+      toolName ||
+      "tool",
+    );
+
+    const executionState = toolExecutionState.get(String(event.toolCallId || ""));
+    if (
+      ["bash", "powershell"].includes(toolName) &&
+      executionState?.reusableCandidate === true &&
+      executionState.workspaceBefore &&
+      !event.isError
+    ) {
+      const finishedAtMs = Date.now();
+      let workspaceAfter: string | undefined;
+      try { workspaceAfter = runtimeWorkspaceFingerprint(ctx.cwd); } catch {}
+      if (workspaceAfter && workspaceAfter === executionState.workspaceBefore) {
+        const canonical = executionState.canonicalVerification;
+        if (canonical) {
+          await recordVerification(ctx.cwd, {
+            command: canonical.command,
+            args: canonical.args,
+            exitCode: shellExitCode(event, shownText || rawText),
+            stdout: rawText,
+            stderr: "",
+            startedAt: new Date(executionState.startedAt).toISOString(),
+            finishedAt: new Date(finishedAtMs).toISOString(),
+            durationMs: Math.max(0, finishedAtMs - executionState.startedAt),
+            workspaceBefore: executionState.workspaceBefore,
+            workspaceAfter,
+          }).catch(() => null);
+        }
+      }
+    }
+    toolExecutionState.delete(String(event.toolCallId || ""));
+
+    if (String(process.env.UES_CHILD_TOOL_COMPACTION || "") !== "1") return undefined;
+    const maxChars = configuredLimit();
+    if (!rawText || rawText.length <= maxChars) return undefined;
+
+    const compacted = await compactReversibleOutput(ctx.cwd, rawText, {
+      maxChars,
+      kind: `child-${toolName}-output`,
+      source: commandHint,
+      summary: capture.full
+        ? `Full Pi shell output captured from ${capture.sourcePath} before model-visible compaction`
+        : "Captured Pi tool output preserved before model-visible compaction",
+    }).catch(() => null);
+    if (!compacted?.compacted) return undefined;
+
+    return {
+      content: [{ type: "text", text: compacted.text }, ...images],
+      details: {
+        ...(event.details && typeof event.details === "object" ? event.details : {}),
+        uesCompaction: {
+          strategy: compacted.strategy,
+          originalChars: compacted.originalChars,
+          returnedChars: compacted.returnedChars,
+          evidenceRef: compacted.evidenceRef,
+          rawCapture: capture.full ? "full-output-path" : "tool-result",
+          recoveryTool: "ues_evidence_get",
+        },
+      },
+      isError: event.isError,
+      usage: event.usage,
+    };
+  });
+
+  pi.registerTool({
+    name: "ues_evidence_get",
+    label: "UES Evidence Get",
+    description:
+      "Read an exact bounded slice or JSON selector from a UES Evidence Store reference when a compacted tool result says omitted raw evidence is available.",
+    parameters: Type.Object({
+      ref: Type.String({ minLength: 1 }),
+      start: Type.Optional(Type.Number({ minimum: 0 })),
+      maxBytes: Type.Optional(Type.Number({ minimum: 1, maximum: 64000 })),
+    }),
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      try {
+        const result = await getEvidenceSelected(ctx.cwd, params.ref, {
+          start: params.start || 0,
+          maxBytes: params.maxBytes || 16000,
+        });
+        return {
+          content: [{
+            type: "text",
+            text: [
+              `ref: ${result.ref}`,
+              `bytes: ${result.bytes}; start: ${result.start}; returned: ${result.returnedBytes}; truncated: ${result.truncated}`,
+              "",
+              result.content,
+            ].join("\n"),
+          }],
+          details: {
+            ref: result.ref,
+            start: result.start,
+            returnedBytes: result.returnedBytes,
+            truncated: result.truncated,
+          },
+        };
+      } catch (error) {
+        return {
+          content: [{
+            type: "text",
+            text: error instanceof Error ? error.message : String(error),
+          }],
+          details: { ref: params.ref },
+          isError: true,
+        };
+      }
+    },
+  });
+}