opencode-agent-skill 14.2.0-beta.1 → 15.0.0

package/lib/worktree-sandbox.mjs

@@ -1,8 +1,9 @@
 import { existsSync } from "node:fs"
 import { createHash } from "node:crypto"
-import { copyFile, mkdir, readFile, rm, unlink, writeFile } from "node:fs/promises"
+import { copyFile, mkdir, readFile, readdir, rm, unlink, writeFile } from "node:fs/promises"
 import { spawnSync } from "node:child_process"
 import path from "node:path"
+import { isUesRuntimeArtifactPath, sourceFacingPaths, sourceGitPathspecs } from "./runtime-artifacts.mjs"
 
 function git(root, args, options = {}) {
   return spawnSync("git", args, {
@@ -22,6 +23,51 @@ function statusFiles(root) {
     .map((line) => line.slice(3).trim())
     .map((value) => value.includes(" -> ") ? value.split(" -> ").at(-1) : value)
     .map((value) => value.replaceAll("\\", "/"))
+    .filter((value) => !isUesRuntimeArtifactPath(value))
+}
+
+function sourceIntentBatches(values, options = {}) {
+  const maxItems = Math.max(1, Math.min(256, Number(options.maxItems || 64)))
+  const maxChars = Math.max(1024, Math.min(24_000, Number(options.maxChars || 12_000)))
+  const batches = []
+  let batch = []
+  let chars = 0
+
+  for (const value of sourceFacingPaths(values)) {
+    const cost = value.length + 3
+    if (batch.length && (batch.length >= maxItems || chars + cost > maxChars)) {
+      batches.push(batch)
+      batch = []
+      chars = 0
+    }
+    batch.push(value)
+    chars += cost
+  }
+  if (batch.length) batches.push(batch)
+  return batches
+}
+
+function intentToAddSourceFiles(root) {
+  const untracked = git(root, [
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "-z",
+    "--",
+    ...sourceGitPathspecs(),
+  ])
+  if (untracked.status !== 0) {
+    throw new Error((untracked.stderr || untracked.stdout || "git ls-files for intent-to-add failed").trim())
+  }
+
+  const candidates = sourceFacingPaths(untracked.stdout.split("\0").filter(Boolean))
+  for (const batch of sourceIntentBatches(candidates)) {
+    const addIntent = git(root, ["add", "-N", "--", ...batch])
+    if (addIntent.status !== 0) {
+      throw new Error((addIntent.stderr || addIntent.stdout || "git add -N failed").trim())
+    }
+  }
+  return candidates
 }
 
 function safeName(value) {
@@ -40,13 +86,19 @@ async function readSandboxMetadata(dir) {
   }
 }
 
+export async function taskSandboxOwnerRoot(dir) {
+  const metadata = await readSandboxMetadata(path.resolve(dir)).catch(() => null)
+  const root = metadata?.root ? path.resolve(String(metadata.root)) : null
+  return root || null
+}
+
 async function writeSandboxMetadata(dir, value) {
   await writeFile(metadataFile(dir), JSON.stringify(value, null, 2) + "\n", "utf8")
 }
 
 async function inheritDirtySnapshot(root, dir) {
   const inheritedUntrackedHashes = {}
-  const diff = git(root, ["diff", "--binary", "--no-ext-diff", "HEAD", "--"])
+  const diff = git(root, ["diff", "--binary", "--no-ext-diff", "HEAD", "--", ...sourceGitPathspecs()])
   if (diff.status !== 0) throw new Error((diff.stderr || diff.stdout || "git diff HEAD failed").trim())
   if (diff.stdout) {
     const applied = git(dir, ["apply", "--whitespace=nowarn", "-"], { input: diff.stdout })
@@ -56,10 +108,12 @@ async function inheritDirtySnapshot(root, dir) {
   const untracked = git(root, ["ls-files", "--others", "--exclude-standard", "-z"])
   if (untracked.status !== 0) throw new Error((untracked.stderr || untracked.stdout || "git ls-files failed").trim())
   for (const relative of untracked.stdout.split("\0").filter(Boolean)) {
+    const normalizedRelative = relative.replaceAll("\\", "/")
+    if (isUesRuntimeArtifactPath(normalizedRelative)) continue
     const source = path.join(root, relative)
     const target = path.join(dir, relative)
     const bytes = await readFile(source)
-    inheritedUntrackedHashes[relative.replaceAll("\\", "/")] = createHash("sha256").update(bytes).digest("hex")
+    inheritedUntrackedHashes[normalizedRelative] = createHash("sha256").update(bytes).digest("hex")
     await mkdir(path.dirname(target), { recursive: true })
     await copyFile(source, target)
   }
@@ -87,9 +141,7 @@ async function inheritDirtySnapshot(root, dir) {
 
 export async function createTaskSandbox(root, slug, taskID, options = {}) {
   root = path.resolve(root)
-  const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"])
-  if (status.status !== 0) throw new Error((status.stderr || status.stdout || "git status failed").trim())
-  const rootDirty = Boolean(status.stdout.trim())
+  const rootDirty = statusFiles(root).length > 0
   if (rootDirty && options.allowDirtyRoot !== true && options.inheritDirtyRoot !== true) {
     throw new Error("sandbox creation requires a clean root working tree so the isolated executor cannot miss existing uncommitted changes")
   }
@@ -129,6 +181,7 @@ export async function createTaskSandbox(root, slug, taskID, options = {}) {
     inheritedDirtyRoot,
     inheritedUntrackedHashes,
     createdAt: new Date().toISOString(),
+    ownerPid: process.pid,
   }
   await writeSandboxMetadata(dir, metadata)
   return metadata
@@ -155,11 +208,12 @@ export async function integrateTaskSandbox(root, dir, options = {}) {
     baseSha = base.stdout.trim()
   }
 
-  // Intent-to-add exposes untracked files in a binary diff without committing them.
-  const addIntent = git(dir, ["add", "-N", "."])
-  if (addIntent.status !== 0) throw new Error((addIntent.stderr || addIntent.stdout || "git add -N failed").trim())
+  // Intent-to-add only the non-ignored untracked source files. A root-wide
+  // `git add -N -- .` fails when an ignored UES runtime directory such as
+  // .ues-cache exists, even when an exclude pathspec is also present.
+  intentToAddSourceFiles(dir)
 
-  const changedRun = git(dir, ["diff", "--name-only", baseSha, "--"])
+  const changedRun = git(dir, ["diff", "--name-only", baseSha, "--", ...sourceGitPathspecs()])
   if (changedRun.status !== 0) throw new Error((changedRun.stderr || changedRun.stdout || "git diff --name-only failed").trim())
   const changed = changedRun.stdout.split(/\r?\n/).filter(Boolean).map((value) => value.replaceAll("\\", "/"))
   if (changed.length === 0) {
@@ -195,7 +249,7 @@ export async function integrateTaskSandbox(root, dir, options = {}) {
     throw new Error("sandbox integration conflicts with existing root changes: " + unsafeOverlap.join(", "))
   }
 
-  const patch = git(dir, ["diff", "--binary", "--no-ext-diff", baseSha, "--"])
+  const patch = git(dir, ["diff", "--binary", "--no-ext-diff", baseSha, "--", ...sourceGitPathspecs()])
   if (patch.status !== 0) throw new Error((patch.stderr || patch.stdout || "git diff failed").trim())
   const applied = git(root, ["apply", "--whitespace=nowarn", "-"], { input: patch.stdout })
   if (applied.status !== 0) {
@@ -206,6 +260,175 @@ export async function integrateTaskSandbox(root, dir, options = {}) {
   return { integrated: true, changed, base: baseSha, empty: false }
 }
 
+function processAlive(pid) {
+  const value = Number(pid)
+  if (!Number.isInteger(value) || value <= 0) return false
+  try {
+    process.kill(value, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+export async function pruneOrphanTaskSandboxes(root, options = {}) {
+  root = path.resolve(root)
+  const now = Date.now()
+  const minAgeMs = Math.max(60_000, Number(options.minAgeMs || 5 * 60_000))
+  const legacyMinAgeMs = Math.max(minAgeMs, Number(options.legacyMinAgeMs || 30 * 60_000))
+  const ownedMinAgeMs = Math.max(0, Number(options.ownedMinAgeMs ?? 60_000))
+  const reclaimOwnerPid = Number(options.reclaimOwnerPid || 0)
+  const protectedDirs = new Set(
+    (options.protectedDirs || []).map((value) => path.resolve(String(value))),
+  )
+  const expectedBase = path.resolve(
+    options.baseDir || path.join(path.dirname(root), "." + path.basename(root) + ".ues-sandboxes"),
+  )
+  const removed = []
+  const skipped = []
+  const sidecarsRemoved = []
+
+  for (const item of listTaskSandboxes(root)) {
+    const branch = String(item.branch || "").replace(/^refs\/heads\//, "")
+    const dir = path.resolve(String(item.path || ""))
+    if (!branch.startsWith("ues/")) continue
+    if (path.dirname(dir) !== expectedBase) continue
+    if (protectedDirs.has(dir)) {
+      skipped.push({ dir, reason: "protected-active" })
+      continue
+    }
+
+    const metadata = await readSandboxMetadata(dir)
+    if (!metadata || path.resolve(String(metadata.root || "")) !== root) {
+      skipped.push({ dir, reason: "metadata-missing-or-root-mismatch" })
+      continue
+    }
+
+    const createdAt = Date.parse(String(metadata.createdAt || ""))
+    const ageMs = Number.isFinite(createdAt) ? Math.max(0, now - createdAt) : Infinity
+    const ownerPid = Number(metadata.ownerPid || 0)
+    const reclaimOwned = reclaimOwnerPid > 0 && ownerPid === reclaimOwnerPid
+
+    if (ownerPid > 0 && processAlive(ownerPid) && !reclaimOwned) {
+      skipped.push({ dir, reason: "owner-alive", ownerPid })
+      continue
+    }
+
+    const requiredAge = reclaimOwned
+      ? ownedMinAgeMs
+      : ownerPid > 0
+        ? minAgeMs
+        : legacyMinAgeMs
+    if (ageMs < requiredAge) {
+      skipped.push({ dir, reason: "too-recent", ageMs, ownerPid: ownerPid || null })
+      continue
+    }
+
+    try {
+      const result = await removeTaskSandbox(root, dir, {
+        force: true,
+        deleteBranch: true,
+        branch,
+      })
+      removed.push({ ...result, ageMs, ownerPid: ownerPid || null, reclaimOwned })
+    } catch (error) {
+      skipped.push({
+        dir,
+        reason: "remove-failed",
+        error: error instanceof Error ? error.message : String(error),
+      })
+    }
+  }
+
+  // Clean detached physical sandbox directories left after Git forgot the
+  // worktree registration (for example after a crash/manual prune). Only remove
+  // directories with UES metadata bound to this exact root repository.
+  try {
+    const registered = new Set(
+      listTaskSandboxes(root).map((item) => path.resolve(String(item.path || ""))),
+    )
+    const entries = await readdir(expectedBase, { withFileTypes: true })
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue
+      const dir = path.resolve(expectedBase, entry.name)
+      if (registered.has(dir) || protectedDirs.has(dir)) continue
+
+      const metadata = await readSandboxMetadata(dir)
+      if (!metadata || path.resolve(String(metadata.root || "")) !== root) continue
+
+      const createdAt = Date.parse(String(metadata.createdAt || ""))
+      const ageMs = Number.isFinite(createdAt) ? Math.max(0, now - createdAt) : Infinity
+      const ownerPid = Number(metadata.ownerPid || 0)
+      const reclaimOwned = reclaimOwnerPid > 0 && ownerPid === reclaimOwnerPid
+
+      if (ownerPid > 0 && processAlive(ownerPid) && !reclaimOwned) {
+        skipped.push({ dir, reason: "detached-owner-alive", ownerPid })
+        continue
+      }
+
+      const requiredAge = reclaimOwned
+        ? ownedMinAgeMs
+        : ownerPid > 0
+          ? minAgeMs
+          : legacyMinAgeMs
+      if (ageMs < requiredAge) {
+        skipped.push({ dir, reason: "detached-too-recent", ageMs, ownerPid: ownerPid || null })
+        continue
+      }
+
+      try {
+        await rm(dir, { recursive: true, force: true })
+        await unlink(metadataFile(dir)).catch(() => {})
+        const branch = String(metadata.branch || "")
+        if (branch.startsWith("ues/")) git(root, ["branch", "-D", branch])
+        removed.push({
+          removed: !existsSync(dir),
+          dir,
+          branch: branch || null,
+          ageMs,
+          ownerPid: ownerPid || null,
+          reclaimOwned,
+          detached: true,
+        })
+      } catch (error) {
+        skipped.push({
+          dir,
+          reason: "detached-remove-failed",
+          error: error instanceof Error ? error.message : String(error),
+        })
+      }
+    }
+  } catch {}
+
+  // Clean metadata sidecars left after a crash or manual worktree removal.
+  try {
+    const entries = await readdir(expectedBase, { withFileTypes: true })
+    for (const entry of entries) {
+      if (!entry.isFile() || !entry.name.endsWith(".ues-meta.json")) continue
+      const sidecar = path.join(expectedBase, entry.name)
+      const dir = sidecar.slice(0, -".ues-meta.json".length)
+      if (existsSync(dir)) continue
+      try {
+        const metadata = JSON.parse(await readFile(sidecar, "utf8"))
+        if (path.resolve(String(metadata.root || "")) !== root) continue
+        const createdAt = Date.parse(String(metadata.createdAt || ""))
+        const ageMs = Number.isFinite(createdAt) ? Math.max(0, now - createdAt) : Infinity
+        if (ageMs < minAgeMs) continue
+        await unlink(sidecar)
+        sidecarsRemoved.push(sidecar)
+      } catch {}
+    }
+
+    const remaining = await readdir(expectedBase)
+    if (remaining.length === 0) {
+      await rm(expectedBase, { recursive: false, force: true })
+    }
+  } catch {}
+
+  git(root, ["worktree", "prune"])
+  return { removed, skipped, sidecarsRemoved, baseRemoved: !existsSync(expectedBase) }
+}
+
 export async function removeTaskSandbox(root, dir, options = {}) {
   root = path.resolve(root)
   dir = path.resolve(dir)

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "opencode-agent-skill",
-  "version": "14.2.0-beta.1",
-  "description": "Pi Agent engineering runtime with hierarchical context, verified persistent memory, learned capability failover, durable evidence, and evidence-gated verification",
+  "version": "15.0.0",
+  "description": "Pi-native UES coding-agent runtime with adaptive stability, Turbo Fast Path, durable verification, managed services, and weak-model orchestration",
   "type": "module",
   "bin": {
-    "ues": "bin/ocskill.mjs",
-    "ocskill": "bin/ocskill.mjs"
+    "ocskill": "bin/ocskill.mjs",
+    "ues": "bin/ocskill.mjs"
   },
   "files": [
     "bin/ocskill.mjs",
@@ -21,6 +21,7 @@
     "docs/V14-CONTEXT-MEMORY-FABRIC.md",
     "docs/V14.1-QUALITY-PERFORMANCE-FABRIC.md",
     "docs/V14.2-TURBO-WEAK-MODEL-RUNTIME.md",
+    "docs/V15-MANAGED-RUNTIME.md",
     "docs/PI-COMPAT.md",
     "docs/OPENCODE-COMPAT.md",
     "README.md",
@@ -38,9 +39,11 @@
     "ci": "npm run integrity && npm run runtime:exports && npm run syntax && npm test && npm run docs:check && npm pack --dry-run && npm run smoke:pi && npm run smoke:package && npm run smoke:packed",
     "prepublishOnly": "npm run ci",
     "smoke:packed": "node scripts/smoke-packed-install.mjs",
-    "eval:v14": "node --test test/capability-fabric-v14.test.mjs test/hierarchical-context-v14.test.mjs test/memory-engine-v14.test.mjs test/context-engine-v14.test.mjs test/task-engine-v14-context.test.mjs test/cli-v14.test.mjs test/v14-contract.test.mjs test/performance-fabric-v14.test.mjs test/browser-mcp-routing-v14.test.mjs test/process-hang-detector-v14.test.mjs test/v14.2-runtime.test.mjs test/benchmark-confidence.test.mjs",
+    "eval:v14": "node --test test/capability-fabric-v14.test.mjs test/hierarchical-context-v14.test.mjs test/memory-engine-v14.test.mjs test/context-engine-v14.test.mjs test/task-engine-v14-context.test.mjs test/cli-v14.test.mjs test/v14-contract.test.mjs test/performance-fabric-v14.test.mjs test/browser-mcp-routing-v14.test.mjs test/process-hang-detector-v14.test.mjs test/v14.2-runtime.test.mjs test/benchmark-confidence.test.mjs test/v14.3-intelligence.test.mjs",
     "integrity": "node scripts/check-source-integrity.mjs",
-    "runtime:exports": "node scripts/check-runtime-exports.mjs"
+    "runtime:exports": "node scripts/check-runtime-exports.mjs",
+    "eval:v15": "node --test test/v15-runtime.test.mjs test/trajectory.test.mjs test/evidence-store-v11.test.mjs test/runtime-events.test.mjs test/v14.3-intelligence.test.mjs test/v14.2-runtime.test.mjs test/pi-package.test.mjs test/execution-contract.test.mjs",
+    "release:verify": "npm run ci && npm run eval:v15"
   },
   "keywords": [
     "pi-package",