opencode-agent-skill 14.2.0-beta.1 → 15.0.0

package/lib/completion-auditor.mjs

@@ -0,0 +1,102 @@
+function text(value) {
+  return String(value ?? "").trim()
+}
+
+function reportSections(run) {
+  const sections = run?.report?.sections
+  return sections && typeof sections === "object" ? sections : {}
+}
+
+function passRun(run) {
+  return Boolean(run && Number(run.exitCode) === 0 && run.verdict === "PASS")
+}
+
+function normalizeSection(value) {
+  return text(value)
+    .toLowerCase()
+    .replace(/[`*_#]/g, "")
+    .replace(/[.!:;]+$/g, "")
+    .replace(/\s+/g, " ")
+    .trim()
+}
+
+function benignEmptySection(value) {
+  const normalized = normalizeSection(value)
+  return !normalized || /^(?:none(?: observed| found| remaining)?|n\/a|na|nil|0|no failures?(?: observed| found| remaining)?|no unresolved gaps?(?: observed| found| remaining)?|no gaps?(?: observed| found| remaining)?|not applicable|không có|không có gì|không có lỗi|không phát hiện lỗi|không còn khoảng trống|không có khoảng trống)$/.test(normalized)
+}
+
+function benignFailureSection(value) {
+  const normalized = normalizeSection(value)
+  return benignEmptySection(normalized) ||
+    /^(?:không có|không phát hiện) .{0,120}(?:lỗi|thất bại)(?: nào)?$/.test(normalized)
+}
+
+function outOfScopeGapOnly(value) {
+  const normalized = normalizeSection(value)
+  if (benignEmptySection(normalized)) return true
+  return /(?:not requested|outside (?:the )?scope|out of scope|not required|không có yêu cầu|không được yêu cầu|ngoài phạm vi|không thuộc phạm vi)/.test(normalized)
+}
+
+function receiptPassed(row = {}) {
+  const receipt = row?.receipt || row
+  return Boolean(receipt?.passed === true && Number(receipt?.exitCode) === 0)
+}
+
+export function auditCompletion(input = {}) {
+  const failures = []
+  const warnings = []
+  const verification = input.verification || null
+  const integration = input.integration || null
+  const visual = input.visual || null
+  const requireIntegration = input.requireIntegration === true
+  const requireVisual = input.requireVisual === true
+  const receipts = Array.isArray(input.behavioralReceipts) ? input.behavioralReceipts : []
+
+  if (!passRun(verification)) failures.push("primary-verification-not-pass")
+  if (requireIntegration && !passRun(integration)) failures.push("integration-verification-not-pass")
+  if (requireVisual && !passRun(visual)) failures.push("visual-verification-not-pass")
+
+  const sections = reportSections(verification)
+  for (const key of ["checks-run", "acceptance-criteria-proven", "completion-evidence"]) {
+    if (!text(sections[key])) failures.push(`missing-report-section:${key}`)
+  }
+  if (Object.hasOwn(sections, "failures") && !benignFailureSection(sections.failures)) failures.push("verification-reports-failures")
+  if (Object.hasOwn(sections, "unresolved-gaps") && !benignEmptySection(sections["unresolved-gaps"])) {
+    if (outOfScopeGapOnly(sections["unresolved-gaps"])) warnings.push("verification-reports-out-of-scope-gap")
+    else failures.push("verification-reports-unresolved-gaps")
+  }
+  if (Object.hasOwn(sections, "checks-not-run") && !benignEmptySection(sections["checks-not-run"])) warnings.push("verification-reports-checks-not-run")
+
+  const snapshot = input.workspaceSnapshot || null
+  if (snapshot) {
+    if (snapshot.cacheable === true && !text(snapshot.fingerprint)) failures.push("workspace-fingerprint-missing")
+    if (Array.isArray(snapshot.changedFiles) && snapshot.changedFiles.length === 0) warnings.push("workspace-has-no-detected-changes")
+  } else {
+    warnings.push("workspace-snapshot-unavailable")
+  }
+
+  const passingReceipts = receipts.filter(receiptPassed)
+  if (input.requireBehavioralReceipt === true && passingReceipts.length === 0) failures.push("fresh-behavioral-receipt-missing")
+  else if (passingReceipts.length === 0) warnings.push("no-fresh-behavioral-receipt-attached")
+
+  const verifierOutput = text(verification?.output)
+  if (verification?.report?.valid === false) failures.push("verification-report-invalid")
+  if (verification?.report?.verdict && verification.report.verdict !== "PASS") failures.push("verification-report-verdict-mismatch")
+  if (/UES_VERDICT:\s*FAIL/i.test(verifierOutput)) failures.push("verifier-output-contains-fail-verdict")
+
+  return {
+    schemaVersion: 1,
+    passed: failures.length === 0,
+    failures: [...new Set(failures)],
+    warnings: [...new Set(warnings)],
+    evidence: {
+      primary: passRun(verification),
+      integration: requireIntegration ? passRun(integration) : null,
+      visual: requireVisual ? passRun(visual) : null,
+      reportSections: Object.keys(sections).sort(),
+      passingReceiptCount: passingReceipts.length,
+      workspaceFingerprint: snapshot?.fingerprint || null,
+      changedFiles: Array.isArray(snapshot?.changedFiles) ? snapshot.changedFiles.slice(0, 200) : [],
+    },
+  }
+}

package/lib/document-ingestion.mjs

@@ -0,0 +1,60 @@
+import { lstat, readFile, realpath } from "node:fs/promises"
+import { spawnSync } from "node:child_process"
+import path from "node:path"
+
+const BUILTIN_TEXT_EXTENSIONS = new Set([
+  ".txt", ".md", ".markdown", ".json", ".jsonl", ".csv", ".tsv", ".xml", ".html", ".htm",
+  ".yaml", ".yml", ".toml", ".ini", ".log", ".js", ".mjs", ".cjs", ".jsx", ".ts", ".tsx",
+  ".py", ".java", ".kt", ".kts", ".cs", ".go", ".rs", ".rb", ".php", ".sql", ".css", ".scss",
+])
+const MARKITDOWN_EXTENSIONS = new Set([".pdf", ".docx", ".pptx", ".xlsx", ".xls", ".epub", ".zip"])
+
+function inside(root, target) { return target === root || target.startsWith(root + path.sep) }
+async function safeFile(root, relative) {
+  const base = await realpath(path.resolve(root)).catch(() => path.resolve(root))
+  const requested = path.resolve(base, String(relative || ""))
+  if (!inside(base, requested)) throw new Error("document path escapes workspace root")
+  const info = await lstat(requested)
+  if (!info.isFile()) throw new Error("document path is not a file")
+  const actual = await realpath(requested)
+  if (!inside(base, actual)) throw new Error("document symlink escapes workspace root")
+  return { base, file: actual, info }
+}
+
+function runMarkItDown(file, options = {}) {
+  const timeout = Math.max(5_000, Math.min(120_000, Number(options.timeoutMs || 30_000)))
+  const maxBuffer = Math.max(256 * 1024, Math.min(16 * 1024 * 1024, Number(options.maxBuffer || 4 * 1024 * 1024)))
+  const attempts = process.platform === "win32"
+    ? [["markitdown.exe", [file]], ["markitdown", [file]], ["py", ["-m", "markitdown", file]], ["python", ["-m", "markitdown", file]]]
+    : [["markitdown", [file]], ["python3", ["-m", "markitdown", file]], ["python", ["-m", "markitdown", file]]]
+  for (const [command, args] of attempts) {
+    const result = spawnSync(command, args, { encoding: "utf8", timeout, maxBuffer, windowsHide: true })
+    if (result.status === 0 && String(result.stdout || "").trim()) return { provider: command.includes("python") || command === "py" ? "markitdown-python" : "markitdown-cli", markdown: String(result.stdout) }
+    if (result.error?.code !== "ENOENT" && result.status != null) return { provider: "markitdown-unavailable", error: String(result.stderr || result.error?.message || `exit ${result.status}`) }
+  }
+  return { provider: "markitdown-unavailable", error: "MarkItDown command/module was not found" }
+}
+
+export function documentIngestionSupport(file = "") {
+  const ext = path.extname(String(file)).toLowerCase()
+  return { schemaVersion: 1, extension: ext, builtin: BUILTIN_TEXT_EXTENSIONS.has(ext), markitdown: MARKITDOWN_EXTENSIONS.has(ext), supported: BUILTIN_TEXT_EXTENSIONS.has(ext) || MARKITDOWN_EXTENSIONS.has(ext) }
+}
+
+export async function ingestDocument(root, relative, options = {}) {
+  const target = await safeFile(root, relative)
+  const support = documentIngestionSupport(target.file)
+  const maxBytes = Math.max(16 * 1024, Math.min(32 * 1024 * 1024, Number(options.maxBytes || 4 * 1024 * 1024)))
+  if (target.info.size > maxBytes) throw new Error(`document exceeds ingestion limit (${target.info.size} > ${maxBytes} bytes)`)
+  if (support.builtin) {
+    const content = await readFile(target.file, "utf8")
+    return { schemaVersion: 1, provider: "builtin-text", file: path.relative(target.base, target.file).replaceAll("\\", "/"), bytes: target.info.size, markdown: content, optionalDependency: false }
+  }
+  if (support.markitdown) {
+    const converted = runMarkItDown(target.file, options)
+    if (converted.markdown) return { schemaVersion: 1, provider: converted.provider, file: path.relative(target.base, target.file).replaceAll("\\", "/"), bytes: target.info.size, markdown: converted.markdown, optionalDependency: true }
+    const error = new Error(`${converted.error}. Install Microsoft MarkItDown only when Office/PDF ingestion is needed.`)
+    error.code = "UES_MARKITDOWN_UNAVAILABLE"
+    throw error
+  }
+  throw new Error(`unsupported document extension: ${support.extension || "(none)"}`)
+}

package/lib/evidence-store.mjs

@@ -5,6 +5,41 @@ import path from "node:path"
 
 const STORE_VERSION = 1
 const REF_PREFIX = "evidence:sha256:"
+const DEFAULT_MAX_STORE_BYTES = 192 * 1024 * 1024
+const DEFAULT_MAX_STORE_ENTRIES = 1200
+const DEFAULT_MAX_STORE_AGE_DAYS = 14
+const AUTO_GC_EVERY_WRITES = 8
+const AUTO_GC_LARGE_ITEM_BYTES = 16 * 1024 * 1024
+const PUT_COUNTS = new Map()
+
+function boundedNumber(value, fallback, min, max) {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+function defaultStoreLimits() {
+  return {
+    maxBytes: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_BYTES,
+      DEFAULT_MAX_STORE_BYTES,
+      16 * 1024 * 1024,
+      2 * 1024 * 1024 * 1024,
+    ),
+    maxEntries: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_ENTRIES,
+      DEFAULT_MAX_STORE_ENTRIES,
+      100,
+      20_000,
+    ),
+    maxAgeDays: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_AGE_DAYS,
+      DEFAULT_MAX_STORE_AGE_DAYS,
+      1,
+      365,
+    ),
+  }
+}
 
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue)
@@ -21,6 +56,24 @@ function toBytes(value, options = {}) {
   return { bytes: Buffer.from(text, "utf8"), encoding: "utf8", mediaType: options.mediaType || "application/json" }
 }
 
+async function protectedEvidenceHashes(root) {
+  const file = path.join(path.resolve(root), ".ues-memory", "MEMORY.json")
+  const parsed = await readFile(file, "utf8")
+    .then((raw) => JSON.parse(raw))
+    .catch(() => null)
+  const protectedHashes = new Set()
+  const now = Date.now()
+  for (const memory of parsed?.memories || []) {
+    if (memory?.status !== "verified" || memory?.supersededBy) continue
+    const expiresAt = Date.parse(String(memory?.expiresAt || ""))
+    if (expiresAt && expiresAt <= now) continue
+    for (const ref of memory?.evidenceRefs || []) {
+      try { protectedHashes.add(normalizeHash(ref)) } catch {}
+    }
+  }
+  return protectedHashes
+}
+
 function normalizeHash(ref) {
   const value = String(ref || "").trim()
   const hash = value.startsWith(REF_PREFIX) ? value.slice(REF_PREFIX.length) : value.replace(/^sha256:/, "")
@@ -79,6 +132,13 @@ export async function putEvidence(root, value, options = {}) {
     preview,
   }
   await writeFile(target.meta, JSON.stringify(metadata, null, 2) + "\n", "utf8")
+
+  const writes = (PUT_COUNTS.get(root) || 0) + 1
+  PUT_COUNTS.set(root, writes)
+  if (writes % AUTO_GC_EVERY_WRITES === 0 || encoded.bytes.length >= AUTO_GC_LARGE_ITEM_BYTES) {
+    await gcEvidenceStore(root, defaultStoreLimits()).catch(() => null)
+  }
+
   return metadata
 }
 
@@ -216,25 +276,44 @@ export async function evidenceStoreStatus(root = process.cwd()) {
 }
 
 export async function gcEvidenceStore(root = process.cwd(), options = {}) {
+  root = path.resolve(root)
   const files = await metadataFiles(root)
-  const maxEntries = Math.max(10, Number(options.maxEntries || 2_000))
-  const maxAgeMs = Math.max(0, Number(options.maxAgeDays ?? 30)) * 86_400_000
+  const defaults = defaultStoreLimits()
+  const maxEntries = Math.max(10, Number(options.maxEntries ?? defaults.maxEntries))
+  const maxBytes = Math.max(1024 * 1024, Number(options.maxBytes ?? defaults.maxBytes))
+  const maxAgeMs = Math.max(0, Number(options.maxAgeDays ?? defaults.maxAgeDays)) * 86_400_000
   const now = Date.now()
+  const protectedHashes = options.protectMemoryRefs === false
+    ? new Set()
+    : await protectedEvidenceHashes(root)
   const rows = []
   for (const metaFile of files) {
     const meta = JSON.parse(await readFile(metaFile, "utf8").catch(() => "{}"))
     const time = Date.parse(meta.lastSeenAt || meta.createdAt || 0) || 0
-    rows.push({ metaFile, meta, time })
+    rows.push({ metaFile, meta, time, bytes: Math.max(0, Number(meta.bytes || 0)) })
   }
   rows.sort((a, b) => b.time - a.time)
 
   const removed = []
-  for (let index = 0; index < rows.length; index += 1) {
-    const row = rows[index]
-    const tooMany = index >= maxEntries
+  let retainedEntries = 0
+  let retainedBytes = 0
+  let protectedEntries = 0
+  let protectedBytes = 0
+  for (const row of rows) {
+    const hash = normalizeHash(row.meta.sha256 || path.basename(row.metaFile, ".json"))
+    const protectedByMemory = protectedHashes.has(hash)
+    const tooMany = retainedEntries >= maxEntries
     const tooOld = maxAgeMs > 0 && row.time > 0 && now - row.time > maxAgeMs
-    if (!tooMany && !tooOld) continue
-    const hash = row.meta.sha256 || path.basename(row.metaFile, ".json")
+    const tooLarge = retainedBytes + row.bytes > maxBytes
+    if (protectedByMemory || (!tooMany && !tooOld && !tooLarge)) {
+      retainedEntries += 1
+      retainedBytes += row.bytes
+      if (protectedByMemory) {
+        protectedEntries += 1
+        protectedBytes += row.bytes
+      }
+      continue
+    }
     const target = evidencePaths(root, hash)
     await rm(target.meta, { force: true })
     await rm(target.data, { force: true })
@@ -244,6 +323,11 @@ export async function gcEvidenceStore(root = process.cwd(), options = {}) {
   return {
     removed,
     removedCount: removed.length,
+    retainedEntries,
+    retainedBytes,
+    protectedEntries,
+    protectedBytes,
+    limits: { maxEntries, maxBytes, maxAgeMs },
     status: await evidenceStoreStatus(root),
   }
 }