opencode-agent-skill 13.0.0-beta.2 → 14.4.0

package/lib/task-engine.mjs

@@ -15,6 +15,8 @@ import { putEvidence } from "./evidence-store.mjs"
 import { inferTaskCapabilities } from "./capability-registry.mjs"
 import { buildPromptEnvelope } from "./prompt-cache.mjs"
 import { externalizeContextExcerpts } from "./context-engine-v11.mjs"
+import { buildMemorySnapshot, recordVerifiedTaskMemory, retrieveMemories } from "./memory-engine.mjs"
+import { capabilityFabricStatus } from "./capability-fabric.mjs"
 import { assertActivePlanScope, persistPlanScope } from "./work-plan-scope.mjs"
 import { classifyDecisionPolicy } from "./decision-policy.mjs"
 import { readTextAuto } from "./text-encoding.mjs"
@@ -174,7 +176,7 @@ function gitCapture(root, args) {
 }
 
 const FINGERPRINT_SKIP_DIRS = new Set([
-  ".git", ".ues-work", ".ues-learning", ".ues-dashboard", ".ues-sandboxes", ".ues-cache", ".ues-traces",
+  ".git", ".ues-work", ".ues-learning", ".ues-dashboard", ".ues-sandboxes", ".ues-cache", ".ues-traces", ".ues-memory",
   "node_modules", ".next", "dist", "build", "coverage", ".venv", "venv",
   "Pods", "DerivedData", ".gradle", ".cache", ".turbo", "target", "bin", "obj",
 ])
@@ -256,9 +258,9 @@ export function workspaceFingerprint(root) {
   const parts = []
   const commands = [
     ["rev-parse", "HEAD"],
-    ["status", "--porcelain=v1", "--untracked-files=all", "--", ".", ":(exclude).ues-work", ":(exclude).ues-learning", ":(exclude).ues-dashboard", ":(exclude).ues-sandboxes", ":(exclude).ues-cache", ":(exclude).ues-traces"],
-    ["diff", "--binary", "--no-ext-diff", "--", ".", ":(exclude).ues-work", ":(exclude).ues-learning", ":(exclude).ues-dashboard", ":(exclude).ues-sandboxes", ":(exclude).ues-cache", ":(exclude).ues-traces"],
-    ["diff", "--cached", "--binary", "--no-ext-diff", "--", ".", ":(exclude).ues-work", ":(exclude).ues-learning", ":(exclude).ues-dashboard", ":(exclude).ues-sandboxes", ":(exclude).ues-cache", ":(exclude).ues-traces"],
+    ["status", "--porcelain=v1", "--untracked-files=all", "--", ".", ":(exclude).ues-work", ":(exclude).ues-learning", ":(exclude).ues-dashboard", ":(exclude).ues-sandboxes", ":(exclude).ues-cache", ":(exclude).ues-traces", ":(exclude).ues-memory"],
+    ["diff", "--binary", "--no-ext-diff", "--", ".", ":(exclude).ues-work", ":(exclude).ues-learning", ":(exclude).ues-dashboard", ":(exclude).ues-sandboxes", ":(exclude).ues-cache", ":(exclude).ues-traces", ":(exclude).ues-memory"],
+    ["diff", "--cached", "--binary", "--no-ext-diff", "--", ".", ":(exclude).ues-work", ":(exclude).ues-learning", ":(exclude).ues-dashboard", ":(exclude).ues-sandboxes", ":(exclude).ues-cache", ":(exclude).ues-traces", ":(exclude).ues-memory"],
   ]
   for (const args of commands) {
     const result = gitCapture(root, args)
@@ -1087,7 +1089,20 @@ export async function finalizeWork(root, slug, evidence) {
     await writeJson(loaded.paths.evidence, loaded.evidence)
     await writeJson(loaded.paths.state, loaded.state)
     await journal(loaded.paths, "work.finalized", { fingerprint: currentFingerprint })
-    return { state: loaded.state, evidence: loaded.evidence.entries.at(-1) }
+
+    const memory = await recordVerifiedTaskMemory(loaded.paths.root, {
+      task: loaded.state.goal || loaded.plan.goal || `Completed durable work: ${slug}`,
+      files: [...new Set(loaded.plan.tasks.flatMap((task) => taskFiles(task)))],
+      verifier: verification.receipt?.verifier || "ues-integration-verifier",
+      verifierOutput: [verification.evidence, verification.report].filter(Boolean).join("\n"),
+      integrationOutput: evidenceText,
+      sourceTask: `work:${slug}`,
+      taskClass: "long-horizon",
+      type: "episodic",
+      scope: "project",
+    }).catch(() => null)
+
+    return { state: loaded.state, evidence: loaded.evidence.entries.at(-1), memory }
   })
 }
 
@@ -1161,6 +1176,25 @@ async function buildContextPack(loaded, taskID) {
     [task.title, task.summary, ...(task.acceptance || [])].join(" "),
   ).catch(() => [])
 
+  const memoryRetrieval = await retrieveMemories(loaded.paths.root, taskText, {
+    files: taskFiles(task),
+    limit: 6,
+    taskClass: contextPolicy.executionProfile || contextPolicy.profile?.name || contextPolicy.mode || null,
+    touch: true,
+  }).catch(() => ({ schemaVersion: 1, query: taskText, eligible: 0, results: [] }))
+  const memories = memoryRetrieval.results || []
+  const memorySnapshot = memoryRetrieval.snapshot || buildMemorySnapshot(memories)
+  const fabric = await capabilityFabricStatus(loaded.paths.root).catch(() => null)
+  const providerHints = (fabric?.rows || [])
+    .filter((row) => row.selected)
+    .slice(0, 12)
+    .map((row) => ({
+      capability: row.capability,
+      selected: row.selected,
+      status: row.status,
+      fallbacks: (row.fallbacks || []).slice(0, 3),
+    }))
+
   const specStored = spec
     ? await putEvidence(loaded.paths.root, spec, {
         kind: "work-spec",
@@ -1183,6 +1217,15 @@ async function buildContextPack(loaded, taskID) {
       ...(contextManifest?.evidencePointers || []).map((item) => item.ref),
       ...(contextManifest?.rankedReferences || []).slice(0, 12).map((item) => item.path),
     ],
+    memorySnapshot,
+    contextHints: {
+      hierarchy: (contextManifest?.hierarchy?.scopes || []).slice(0, 6).map((item) => ({
+        path: item.path,
+        score: item.score,
+        l0: item.l0,
+      })),
+      providers: providerHints,
+    },
     recentFailure: recovery.stage === "initial" ? null : loaded.state.tasks?.[taskID]?.lastError || null,
     nextAction: loaded.state.checkpoint?.nextAction || loaded.state.nextAction || null,
   })
@@ -1198,7 +1241,9 @@ async function buildContextPack(loaded, taskID) {
       dynamicHash: promptEnvelope.dynamicHash,
       stableChars: promptEnvelope.stableChars,
       dynamicChars: promptEnvelope.dynamicChars,
+      cacheableChars: promptEnvelope.cacheableChars,
       cacheableRatio: promptEnvelope.cacheableRatio,
+      memoryGeneration: memorySnapshot.generation,
     },
     attempt,
     slug: loaded.state.slug,
@@ -1220,6 +1265,18 @@ async function buildContextPack(loaded, taskID) {
     planApproval: loaded.state.planApproval || null,
     contextManifest,
     acceptedLearnings: learnings,
+    memories,
+    memoryRetrieval: {
+      schemaVersion: memoryRetrieval.schemaVersion || 1,
+      eligible: memoryRetrieval.eligible || 0,
+      returned: memories.length,
+      generation: memorySnapshot.generation,
+    },
+    capabilityFabric: {
+      healthyCapabilities: fabric?.healthyCapabilities || 0,
+      totalCapabilities: fabric?.totalCapabilities || 0,
+      providers: providerHints,
+    },
     workingState: {
       status: loaded.state.status,
       task: loaded.state.tasks?.[taskID],

package/lib/task-policy.mjs

@@ -0,0 +1,291 @@
+const SENSITIVE_DOMAIN = /(\bauth\b|authorization|authentication|security|permission|payment|schema|database|production|deploy|public api|secret|credential|phân quyền|bảo mật|thanh toán|cơ sở dữ liệu|triển khai|api công khai|bí mật|thông tin xác thực)/i
+const HIGH_RISK_MUTATION = /((?:fix|change|modify|update|alter|migrate|drop|truncate|delete|remove|rotate|deploy|publish|push|sửa|thay đổi|cập nhật|xóa|xoá|di trú|chuyển đổi|triển khai).{0,64}(?:\bauth\b|authorization|authentication|security|permission|payment(?: handling| flow)?|schema|database|production|public api|secret|credential|phân quyền|bảo mật|thanh toán|cơ sở dữ liệu|api công khai|bí mật|thông tin xác thực)|(?:\bauth\b|authorization|authentication|security|permission|payment(?: handling| flow)?|schema|database|production|public api|secret|credential|phân quyền|bảo mật|thanh toán|cơ sở dữ liệu|api công khai|bí mật|thông tin xác thực).{0,64}(?:fix|change|modify|update|alter|migrate|drop|truncate|delete|remove|rotate|deploy|publish|push|sửa|thay đổi|cập nhật|xóa|xoá|di trú|chuyển đổi|triển khai)|database migration|schema migration|migrate database|migrate schema|drop table|truncate table|deploy(?:ment)?\s+(?:to\s+)?production|production\s+deploy(?:ment)?|rotate\s+(?:secret|credential)|breaking\s+(?:change\s+to\s+)?(?:public\s+)?api|npm publish|git push|force push|reset --hard|git clean)/i
+const LONG = /(whole repo|whole repository|whole project|entire repo|entire project|large refactor|major refactor|long[- ](?:running|horizon)|durable state|dependency graph|integration verification|resume|refactor all|multi[- ]step migration|migration across|toàn bộ repo|toàn bộ repository|toàn bộ dự án|toàn bộ project|refactor lớn|tác vụ dài|nhiều file|nhiều module|tiếp tục công việc|refactor toàn bộ|xác minh tích hợp|kiểm tra tích hợp|chia (?:công việc|task|tác vụ).*(?:dependency|phụ thuộc))/i
+const DEBUG = /(fix|bug|debug|crash|regression|failure|error|broken|sửa lỗi|lỗi|điều tra lỗi|không chạy)/i
+const CONTRACT = /(public api|api contract|openapi|response schema|request schema|breaking api|hợp đồng api|api công khai)/i
+const DATA = /(database|sql|migration|schema|transaction|index|cơ sở dữ liệu|dữ liệu|migrate)/i
+const BROAD_FILE_SCOPE = /(across\s+(?:multiple|several|many)\s+(?:files|modules|packages)|multiple\s+(?:files|modules|packages)|several\s+(?:files|modules|packages)|many\s+(?:files|modules|packages)|nhiều\s+(?:file|tệp|module)|toàn bộ\s+(?:repo|repository|project|dự án))/i
+const CRITICAL_LOCAL_MUTATION = /(drop\s+table|truncate\s+table|reset\s+--hard|git\s+clean|force\s+push|npm\s+publish|deploy(?:ment)?\s+(?:to\s+)?production|production\s+deploy(?:ment)?|rotate\s+(?:secret|credential)|(?:secret|credential|token).{0,48}(?:rotate|replace|revoke|delete)|(?:authorization|authentication|permission|phân quyền|xác thực).{0,64}(?:change|modify|update|bypass|remove|delete|sửa|thay đổi)|(?:database|sql|schema).{0,64}(?:migration|migrate|drop|truncate|alter)|(?:migration|migrate).{0,64}(?:database|sql|schema)|payment.{0,64}(?:charge|capture|refund|webhook|checkout)|(?:charge|capture|refund|webhook|checkout).{0,64}payment|breaking\s+(?:change\s+to\s+)?(?:public\s+)?api)/i
+const SOURCE_FILE_RE = /(?:^|[\s("'\x60])((?:[A-Za-z]:)?(?:[./\\\w@-]+[\\/])*[\w@.-]+\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|kts|cs|rb|php|swift|dart|vue|svelte))(?=$|[\s"'\x60),:;.])/gi
+
+function referencedSourceFiles(value) {
+  const files = []
+  const seen = new Set()
+  SOURCE_FILE_RE.lastIndex = 0
+  let match
+  while ((match = SOURCE_FILE_RE.exec(String(value || "")))) {
+    const normalized = String(match[1] || "").replaceAll("\\", "/").toLowerCase()
+    if (!normalized || seen.has(normalized)) continue
+    seen.add(normalized)
+    files.push(normalized)
+  }
+  return files
+}
+
+function singleFileBoundedTask(value, facts = {}) {
+  const declaredFiles = Array.isArray(facts.declaredFiles) ? facts.declaredFiles.map(String).filter(Boolean) : []
+  const changedFileCount = Array.isArray(facts.changedFiles)
+    ? facts.changedFiles.length
+    : Number.isFinite(Number(facts.changedFiles)) ? Number(facts.changedFiles) : 0
+  const referencedFiles = referencedSourceFiles(value)
+  const counts = [declaredFiles.length, changedFileCount, referencedFiles.length].filter((count) => count > 0)
+  if (!counts.length || counts.some((count) => count > 1)) return false
+  if (BROAD_FILE_SCOPE.test(String(value || "")) || LONG.test(String(value || ""))) return false
+  return counts.some((count) => count === 1) && (
+    declaredFiles.length === 1 ||
+    changedFileCount === 1 ||
+    /\b(?:fix|repair|change|update|modify|rename|implement|correct|sửa|chỉnh sửa|thay đổi|cập nhật)\b/i.test(String(value || ""))
+  )
+}
+
+
+function riskTextFor(value) {
+  return String(value || "")
+    .replace(/\b(?:do not|don't|without)\s+(?:edit|modify|change|write|delete|remove)[^.\n]*/gi, "")
+    .replace(/\b(?:no|read[- ]only)\s+(?:edits?|changes?|writes?)[^.\n]*/gi, "")
+    .replace(/không\s+(?:sửa|chỉnh sửa|thay đổi|ghi|xóa|xoá)[^.\n]*/gi, "")
+    .replace(/chỉ\s+đọc[^.\n]*/gi, "")
+}
+
+function signal(name, matched, weight) {
+  return matched ? { name, weight } : null
+}
+
+function profileFor(mode, risk) {
+  if (mode === "inline" && risk === "low") {
+    return {
+      name: "fast",
+      maxSkills: 2,
+      contextBudget: 8_000,
+      contextStrategy: "incremental-semantic",
+      skillLoading: "direct-only",
+      durableState: false,
+      worktree: "off",
+      critic: "off",
+      verification: "targeted",
+      fullCI: false,
+      containerVerification: "off",
+    }
+  }
+  if (mode === "long-horizon" || risk === "high") {
+    return {
+      name: "deep",
+      maxSkills: 5,
+      contextBudget: 48_000,
+      contextStrategy: "semantic+graph+git",
+      skillLoading: "orchestrated",
+      durableState: true,
+      worktree: "auto-writers",
+      critic: "required-for-high-risk-or-final",
+      verification: "targeted+integration",
+      fullCI: true,
+      containerVerification: risk === "high" ? "preferred-if-capable" : "optional",
+    }
+  }
+  return {
+    name: "standard",
+    maxSkills: 4,
+    contextBudget: 20_000,
+    contextStrategy: "incremental-semantic+git",
+    skillLoading: "selective",
+    durableState: false,
+    worktree: "auto-on-conflict",
+    critic: "on-failure-or-elevated-risk",
+    verification: "targeted+affected",
+    fullCI: false,
+    containerVerification: "off",
+  }
+}
+
+function boundedInt(value, fallback, min, max) {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.min(max, Math.max(min, Math.round(parsed)))
+}
+
+export function recoveryPolicyForAttempt(taskPolicy = {}, attempt = 1) {
+  const normalizedAttempt = boundedInt(attempt, 1, 1, 99)
+  const baseBudget = boundedInt(
+    taskPolicy.contextBudget ?? taskPolicy.profile?.contextBudget,
+    20_000,
+    4_000,
+    48_000,
+  )
+  const baseSkills = boundedInt(
+    taskPolicy.maxSkills ?? taskPolicy.profile?.maxSkills,
+    4,
+    1,
+    5,
+  )
+  const baseStrategy = taskPolicy.profile?.contextStrategy || "incremental-semantic+git"
+
+  if (normalizedAttempt <= 1) {
+    return {
+      schemaVersion: 1,
+      stage: "initial",
+      attempt: normalizedAttempt,
+      contextBudget: baseBudget,
+      maxSkills: baseSkills,
+      contextStrategy: baseStrategy,
+      requireDiagnosis: false,
+      requireCritic: false,
+      modelEscalation: false,
+      directives: [],
+    }
+  }
+
+  if (normalizedAttempt === 2) {
+    return {
+      schemaVersion: 1,
+      stage: "diagnose",
+      attempt: normalizedAttempt,
+      contextBudget: Math.min(48_000, Math.max(baseBudget, Math.round(baseBudget * 1.35))),
+      maxSkills: Math.min(5, baseSkills + 1),
+      contextStrategy:
+        taskPolicy.executionProfile === "fast"
+          ? "incremental-semantic+git"
+          : baseStrategy,
+      requireDiagnosis: true,
+      requireCritic: false,
+      modelEscalation: true,
+      directives: [
+        "reproduce or capture the exact previous failure before editing",
+        "inspect the direct caller, nearest test and failure-adjacent evidence",
+        "do not stack another speculative patch on top of the failed attempt",
+      ],
+    }
+  }
+
+  return {
+    schemaVersion: 1,
+    stage: "deep-recovery",
+    attempt: normalizedAttempt,
+    contextBudget: Math.min(48_000, Math.max(20_000, Math.round(baseBudget * 1.75))),
+    maxSkills: Math.min(5, baseSkills + 2),
+    contextStrategy: "semantic+graph+git",
+    requireDiagnosis: true,
+    requireCritic: true,
+    modelEscalation: true,
+    directives: [
+      "re-investigate from fresh evidence and explicitly reject the failed hypothesis",
+      "expand to callers, dependencies, tests and boundary contracts before editing",
+      "challenge the architecture or coupling if repeated fixes expose a wider problem",
+      "run an independent critic or review pass before accepting the recovery",
+    ],
+  }
+}
+
+export function shouldRunDedicatedDiagnosis(taskPolicy = {}, attempt = 1) {
+  const hasDebugSignal = Array.isArray(taskPolicy.signals) &&
+    taskPolicy.signals.some((item) => item?.name === "debugging")
+  if (!hasDebugSignal) return false
+
+  const normalizedAttempt = boundedInt(attempt, 1, 1, 99)
+  if (normalizedAttempt > 1) {
+    return recoveryPolicyForAttempt(taskPolicy, normalizedAttempt).requireDiagnosis === true
+  }
+
+  return taskPolicy.executionProfile !== "fast" || taskPolicy.risk !== "low"
+}
+
+export function classifyEngineeringTask(text, facts = {}) {
+  const value = String(text || "")
+  const riskText = riskTextFor(value)
+  const sensitiveDomain = SENSITIVE_DOMAIN.test(value)
+  const singleFileBounded = singleFileBoundedTask(value, facts)
+  const rawSensitiveMutation = HIGH_RISK_MUTATION.test(riskText)
+  const sensitiveMutation =
+    rawSensitiveMutation &&
+    (!singleFileBounded || CRITICAL_LOCAL_MUTATION.test(riskText))
+  const dataMigration =
+    Boolean(facts.hasMigration) ||
+    (
+      !singleFileBounded &&
+      DATA.test(riskText) &&
+      /migration|schema|migrate|di trú|chuyển đổi/i.test(riskText)
+    )
+  const declaredHighRisk =
+    ["high", "critical"].includes(String(facts.risk || "").toLowerCase()) ||
+    /\b(?:risk|rủi ro)\s*[:=\/-]?\s*(?:high|critical|cao|nghiêm trọng)\b/i.test(value) ||
+    /\b(?:high|critical)[-\s]?(?:risk|rủi ro)\b/i.test(value)
+  const declaredLongHorizon =
+    facts.longHorizon === true ||
+    ["long", "long-horizon", "deep"].includes(String(facts.mode || "").toLowerCase())
+  const compoundLongRisk =
+    /\blong\s*[/|,+]\s*(?:high|critical)[-\s]?risk\b/i.test(value) ||
+    /\b(?:high|critical)[-\s]?risk\s*[/|,+]\s*long\b/i.test(value)
+  const explicitLongHorizon = declaredLongHorizon || compoundLongRisk || LONG.test(value)
+  const signals = [
+    signal("long-request-text", value.length > 700, 1),
+    signal("medium-request-text", value.length > 250, 1),
+    signal("high-risk-domain", sensitiveDomain, 1),
+    signal("high-risk-operation", sensitiveMutation, 2),
+    signal("declared-high-risk", declaredHighRisk, 2),
+    signal("explicit-long-horizon", explicitLongHorizon, 2),
+    signal("debugging", DEBUG.test(value), 1),
+    signal("single-file-bounded", singleFileBounded, -2),
+    signal("public-contract", CONTRACT.test(value) || facts.hasPublicContract, 2),
+    signal("data-migration", dataMigration, 2),
+    signal("many-changed-files", Number(facts.changedFiles || 0) > 5, 1),
+    signal("very-many-changed-files", Number(facts.changedFiles || 0) > 12, 1),
+    signal("large-repository", Number(facts.repoFiles || 0) > 1500, 1),
+    signal("monorepo", facts.monorepo === true, 1),
+  ].filter(Boolean)
+
+  const score = Math.max(0, signals.reduce((sum, item) => sum + item.weight, 0))
+  const highRisk = declaredHighRisk || sensitiveMutation || Boolean(facts.hasMigration) || Boolean(facts.hasPublicContract)
+  const risk = highRisk ? "high" : singleFileBounded ? "low" : score >= 3 ? "medium" : "low"
+  const mode =
+    explicitLongHorizon
+      ? "long-horizon"
+      : singleFileBounded && !highRisk
+        ? "inline"
+        : score >= 4
+          ? "long-horizon"
+          : score >= 2
+            ? "standard"
+            : "inline"
+  const modelTier = risk === "high" || mode === "long-horizon" ? "heavy" : score >= 2 ? "standard" : "light"
+  const maxAttempts = risk === "high" ? 2 : 3
+  const profile = profileFor(mode, risk)
+
+  const domains = []
+  if (/(auth|permission|tenant|token|session|phân quyền|xác thực)/i.test(value)) domains.push("auth-security")
+  if (/(payment|checkout|refund|webhook|thanh toán|hoàn tiền)/i.test(value)) domains.push("payment")
+  if (DATA.test(value)) domains.push("database")
+  if (CONTRACT.test(value)) domains.push("api-contract")
+  if (/(react native|expo|android|ios|gradle|xcode)/i.test(value)) domains.push("react-native")
+  else if (/(next\.js|nextjs|app router|server component)/i.test(value)) domains.push("nextjs")
+  else if (/\breact\b|useeffect|usestate|component/i.test(value)) domains.push("react")
+  if (/(docker|kubernetes|terraform|github actions|ci\/cd|deploy|triển khai)/i.test(value)) domains.push("devops")
+
+  return {
+    schemaVersion: 4,
+    score,
+    signals,
+    risk,
+    mode,
+    executionProfile: profile.name,
+    modelTier,
+    maxAttempts,
+    contextBudget: profile.contextBudget,
+    maxSkills: profile.maxSkills,
+    requirePlanCheck: profile.durableState || risk === "high",
+    requireIntegrationVerification: mode !== "inline" || risk === "high",
+    requireFreshEvidence: true,
+    singleFileBounded,
+    profile,
+    domains: [...new Set(domains)],
+    recovery: {
+      escalateAfterFailure: true,
+      diagnosisBeforePatch: true,
+      deepRecoveryFromAttempt: 3,
+    },
+    antiHallucination: {
+      evidenceFirst: true,
+      noCompletionWithoutVerification: mode !== "inline" || risk === "high",
+      noUnsupportedSemanticClaims: true,
+      failClosedOnMissingCapability: risk === "high",
+    },
+  }
+}