opencode-agent-skill 14.4.0 → 15.1.0

package/lib/compaction-resume-guard.mjs

@@ -0,0 +1,255 @@
+import { createHash } from "node:crypto"
+import { existsSync } from "node:fs"
+import { readdir, readFile } from "node:fs/promises"
+import path from "node:path"
+import { checkpointWork } from "./task-engine.mjs"
+
+const WORK_DIR = ".ues-work"
+const MAX_WORKSPACES = 3
+const MAX_TASKS = 28
+const MAX_RECEIPTS = 20
+
+function digest(value) {
+  return createHash("sha256").update(String(value || "")).digest("hex").slice(0, 20)
+}
+
+async function readJson(file, fallback = null) {
+  try {
+    return JSON.parse(await readFile(file, "utf8"))
+  } catch (error) {
+    if (error?.code === "ENOENT") return fallback
+    return fallback
+  }
+}
+
+function inside(base, target) {
+  const root = path.resolve(base)
+  const resolved = path.resolve(target)
+  return resolved === root || resolved.startsWith(root + path.sep)
+}
+
+function normalizePhasePath(value) {
+  return String(value || "").replaceAll("\\", "/").replace(/^\.\/+/, "")
+}
+
+async function activeWorkspaces(root, max = MAX_WORKSPACES) {
+  const base = path.join(path.resolve(root), WORK_DIR)
+  if (!existsSync(base)) return []
+  const entries = await readdir(base, { withFileTypes: true }).catch(() => [])
+  const rows = []
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    const dir = path.join(base, entry.name)
+    const state = await readJson(path.join(dir, "STATE.json"), null)
+    if (!state || String(state.status || "").toLowerCase() === "completed") continue
+    rows.push({
+      slug: entry.name,
+      dir,
+      state,
+      updatedAt: Date.parse(state.updatedAt || state.createdAt || "") || 0,
+    })
+  }
+  return rows
+    .sort((a, b) => b.updatedAt - a.updatedAt || a.slug.localeCompare(b.slug))
+    .slice(0, Math.max(1, Math.min(10, Number(max || MAX_WORKSPACES))))
+}
+
+function taskRows(plan, state) {
+  const tasks = Array.isArray(plan?.tasks) ? plan.tasks : []
+  const rows = tasks.map((task) => {
+    const runtime = state?.tasks?.[task.id] || {}
+    return {
+      id: task.id,
+      title: String(task.title || "").slice(0, 240),
+      status: runtime.status || "unknown",
+      attempts: Number(runtime.attempts || 0),
+      runId: runtime.runId || null,
+      dependsOn: Array.isArray(task.dependsOn) ? task.dependsOn.slice(0, 24) : [],
+      evidenceStrength: runtime.evidenceStrength || null,
+      report: runtime.report || null,
+      lastError: runtime.lastError ? String(runtime.lastError).slice(0, 800) : null,
+    }
+  })
+  rows.sort((a, b) => {
+    const rank = (row) => row.status === "running" ? 0 : row.status === "completed" ? 2 : 1
+    return rank(a) - rank(b) || String(a.id).localeCompare(String(b.id))
+  })
+  return rows.slice(0, MAX_TASKS)
+}
+
+function receiptRows(evidence) {
+  return (Array.isArray(evidence?.receipts) ? evidence.receipts : [])
+    .slice(-MAX_RECEIPTS)
+    .map((item) => ({
+      id: item.id || null,
+      kind: item.kind || "verification-receipt",
+      task: item.task || null,
+      runId: item.runId || null,
+      passed: item.passed === true,
+      verdict: item.verdict || (item.passed === true ? "PASS" : null),
+      command: item.command || null,
+      workspaceAfter: item.workspaceAfter || null,
+      recordedAt: item.recordedAt || item.finishedAt || null,
+    }))
+}
+
+function gateRows(evidence) {
+  return (Array.isArray(evidence?.gateReceipts) ? evidence.gateReceipts : [])
+    .slice(-12)
+    .map((item) => ({
+      id: item.id || null,
+      kind: item.kind || null,
+      verdict: item.verdict || null,
+      verifier: item.verifier || null,
+      planHash: item.planHash || null,
+      workspaceFingerprint: item.workspaceFingerprint || null,
+      recordedAt: item.recordedAt || null,
+    }))
+}
+
+async function phaseRows(dir, manifest) {
+  const artifacts = Array.isArray(manifest?.artifacts) ? manifest.artifacts : []
+  const rows = []
+  for (const relative of artifacts.slice(0, 32)) {
+    const normalized = normalizePhasePath(relative)
+    const target = path.resolve(dir, normalized)
+    if (!normalized || !inside(dir, target)) continue
+    const phase = await readJson(target, null)
+    if (!phase) continue
+    rows.push({
+      artifact: normalized,
+      phase: phase.phase ?? null,
+      title: String(phase.title || "").slice(0, 240),
+      status: phase.status || "UNKNOWN",
+      sourceBodyHash: phase.sourceBodyHash || null,
+      evidenceCount: Array.isArray(phase.evidence) ? phase.evidence.length : 0,
+      finalVerdicts: phase.finalVerdicts || null,
+    })
+  }
+  return rows
+}
+
+function stateSummary(state) {
+  return {
+    status: state?.status || null,
+    goal: state?.goal ? String(state.goal).slice(0, 800) : null,
+    updatedAt: state?.updatedAt || null,
+    planHash: state?.planHash || null,
+    planApproved: state?.planApproved === true,
+    nextAction: state?.nextAction || null,
+    checkpoint: state?.checkpoint ? {
+      id: state.checkpoint.id || null,
+      reason: state.checkpoint.reason || null,
+      createdAt: state.checkpoint.createdAt || null,
+      currentTaskId: state.checkpoint.currentTaskId || null,
+      runId: state.checkpoint.runId || null,
+      planHash: state.checkpoint.planHash || null,
+      workspaceFingerprint: state.checkpoint.workspaceFingerprint || null,
+      nextAction: state.checkpoint.nextAction || null,
+      evidencePointers: Array.isArray(state.checkpoint.evidencePointers)
+        ? state.checkpoint.evidencePointers.slice(-20)
+        : [],
+    } : null,
+  }
+}
+
+export async function checkpointDurableWorkBeforeCompaction(root, options = {}) {
+  const reason = String(options.reason || "unknown")
+  const rows = await activeWorkspaces(root, options.maxWorkspaces || MAX_WORKSPACES)
+  const results = []
+  for (const row of rows) {
+    try {
+      const checkpoint = await checkpointWork(root, row.slug, {
+        reason: `pi-compaction:${reason}`,
+      })
+      results.push({ slug: row.slug, checkpoint, ok: true })
+    } catch (error) {
+      results.push({
+        slug: row.slug,
+        checkpoint: null,
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+      })
+    }
+  }
+  return results
+}
+
+export async function buildCompactionResumeGuard(root, options = {}) {
+  const rows = await activeWorkspaces(root, options.maxWorkspaces || MAX_WORKSPACES)
+  const workspaces = []
+  for (const row of rows) {
+    const [plan, evidence, contract, manifest] = await Promise.all([
+      readJson(path.join(row.dir, "PLAN.json"), null),
+      readJson(path.join(row.dir, "EVIDENCE.json"), {}),
+      readJson(path.join(row.dir, "EXECUTION_CONTRACT.json"), null),
+      readJson(path.join(row.dir, "phases", "MANIFEST.json"), null),
+    ])
+    const phases = await phaseRows(row.dir, manifest)
+    const sources = {
+      state: path.relative(root, path.join(row.dir, "STATE.json")).replaceAll("\\", "/"),
+      plan: path.relative(root, path.join(row.dir, "PLAN.json")).replaceAll("\\", "/"),
+      evidence: path.relative(root, path.join(row.dir, "EVIDENCE.json")).replaceAll("\\", "/"),
+      executionContract: contract
+        ? path.relative(root, path.join(row.dir, "EXECUTION_CONTRACT.json")).replaceAll("\\", "/")
+        : null,
+      phaseManifest: manifest
+        ? path.relative(root, path.join(row.dir, "phases", "MANIFEST.json")).replaceAll("\\", "/")
+        : null,
+    }
+    workspaces.push({
+      slug: row.slug,
+      sources,
+      sourceHashes: {
+        state: digest(JSON.stringify(row.state)),
+        plan: digest(JSON.stringify(plan || {})),
+        evidence: digest(JSON.stringify(evidence || {})),
+        executionContract: contract ? digest(JSON.stringify(contract)) : null,
+        phaseManifest: manifest ? digest(JSON.stringify(manifest)) : null,
+      },
+      state: stateSummary(row.state),
+      tasks: taskRows(plan, row.state),
+      receipts: receiptRows(evidence),
+      gateReceipts: gateRows(evidence),
+      executionContract: contract ? {
+        schemaVersion: contract.schemaVersion || null,
+        taskHash: contract.taskHash || null,
+        gates: contract.gates || null,
+        phaseCount: Array.isArray(contract.phases) ? contract.phases.length : 0,
+        approvedInheritedDirtyPaths: Array.isArray(contract.approvedInheritedDirtyPaths)
+          ? contract.approvedInheritedDirtyPaths.slice(0, 40)
+          : [],
+      } : null,
+      phases,
+    })
+  }
+
+  return {
+    schemaVersion: 1,
+    kind: "ues-durable-compaction-resume-guard",
+    generatedAt: new Date().toISOString(),
+    compactionReason: options.reason || null,
+    source: "deterministic-filesystem-artifacts",
+    modelSummaryTrustedForDurableState: false,
+    workspaceCount: workspaces.length,
+    workspaces,
+  }
+}
+
+export function renderCompactionResumeGuard(packet, options = {}) {
+  if (!packet?.workspaces?.length) return ""
+  const maxChars = Math.max(8000, Math.min(48000, Number(options.maxChars || 28000)))
+  const preface = [
+    "## UES Durable Compaction Resume Guard",
+    "Authoritative durable state was rebuilt from filesystem artifacts after Pi compaction.",
+    "The model-generated compaction summary is advisory only for durable execution state.",
+    "If the summary conflicts with STATE.json, PLAN.json, EXECUTION_CONTRACT.json, phase artifacts, or evidence receipts below, the deterministic artifacts win.",
+    "Do not mark a task/phase complete unless the rebuilt state and fresh receipts support it.",
+    "Follow checkpoint.nextAction/state.nextAction and re-read the referenced artifact when more detail is required.",
+    "",
+  ].join("\n")
+  const encoded = JSON.stringify(packet, null, 2)
+  if (preface.length + encoded.length <= maxChars) return preface + encoded
+  return preface + encoded.slice(0, Math.max(0, maxChars - preface.length - 120)) +
+    "\n...[resume packet bounded; re-read referenced .ues-work artifacts for exact detail]"
+}

package/lib/completion-auditor.mjs

@@ -11,13 +11,30 @@ function passRun(run) {
   return Boolean(run && Number(run.exitCode) === 0 && run.verdict === "PASS")
 }
 
-function benignEmptySection(value) {
-  const normalized = text(value)
+function normalizeSection(value) {
+  return text(value)
     .toLowerCase()
     .replace(/[`*_#]/g, "")
     .replace(/[.!:;]+$/g, "")
+    .replace(/\s+/g, " ")
     .trim()
-  return !normalized || /^(?:none(?: observed| found| remaining)?|n\/a|na|nil|0|no failures?(?: observed| found| remaining)?|no unresolved gaps?(?: observed| found| remaining)?|no gaps?(?: observed| found| remaining)?|not applicable)$/.test(normalized)
+}
+
+function benignEmptySection(value) {
+  const normalized = normalizeSection(value)
+  return !normalized || /^(?:none(?: observed| found| remaining)?|n\/a|na|nil|0|no failures?(?: observed| found| remaining)?|no unresolved gaps?(?: observed| found| remaining)?|no gaps?(?: observed| found| remaining)?|not applicable|không có|không có gì|không có lỗi|không phát hiện lỗi|không còn khoảng trống|không có khoảng trống)$/.test(normalized)
+}
+
+function benignFailureSection(value) {
+  const normalized = normalizeSection(value)
+  return benignEmptySection(normalized) ||
+    /^(?:không có|không phát hiện) .{0,120}(?:lỗi|thất bại)(?: nào)?$/.test(normalized)
+}
+
+function outOfScopeGapOnly(value) {
+  const normalized = normalizeSection(value)
+  if (benignEmptySection(normalized)) return true
+  return /(?:not requested|outside (?:the )?scope|out of scope|not required|không có yêu cầu|không được yêu cầu|ngoài phạm vi|không thuộc phạm vi)/.test(normalized)
 }
 
 function receiptPassed(row = {}) {
@@ -43,8 +60,11 @@ export function auditCompletion(input = {}) {
   for (const key of ["checks-run", "acceptance-criteria-proven", "completion-evidence"]) {
     if (!text(sections[key])) failures.push(`missing-report-section:${key}`)
   }
-  if (Object.hasOwn(sections, "failures") && !benignEmptySection(sections.failures)) failures.push("verification-reports-failures")
-  if (Object.hasOwn(sections, "unresolved-gaps") && !benignEmptySection(sections["unresolved-gaps"])) failures.push("verification-reports-unresolved-gaps")
+  if (Object.hasOwn(sections, "failures") && !benignFailureSection(sections.failures)) failures.push("verification-reports-failures")
+  if (Object.hasOwn(sections, "unresolved-gaps") && !benignEmptySection(sections["unresolved-gaps"])) {
+    if (outOfScopeGapOnly(sections["unresolved-gaps"])) warnings.push("verification-reports-out-of-scope-gap")
+    else failures.push("verification-reports-unresolved-gaps")
+  }
   if (Object.hasOwn(sections, "checks-not-run") && !benignEmptySection(sections["checks-not-run"])) warnings.push("verification-reports-checks-not-run")
 
   const snapshot = input.workspaceSnapshot || null

package/lib/context-engine-v11.mjs

@@ -101,6 +101,16 @@ export async function buildAdaptiveTaskContext(root, task, options = {}) {
   const policy = options.policy || {}
   const capabilities = options.capabilities || inferTaskCapabilities(taskText(task), options.facts || {})
   const evidenceBudget = options.evidenceBudget || planEvidenceBudget(policy, task, capabilities.required)
+  const contextBuildStartedAt = Date.now()
+  const memoryPromise = retrieveMemories(root, taskText(task), {
+    files: taskFilesForMemory(task),
+    limit: options.memoryLimit ?? 6,
+    taskClass: options.taskClass || task.type || policy.executionProfile || policy.profile?.name || null,
+    touch: options.touchMemories !== false,
+  }).catch(() => ({ schemaVersion: 1, query: taskText(task), eligible: 0, results: [] }))
+  const fabricPromise = capabilityFabricStatus(root).catch(() => null)
+
+  const manifestStartedAt = Date.now()
   const manifest = await buildContextManifest(root, task, {
     budget: evidenceBudget.total,
     evidenceBudget,
@@ -110,21 +120,18 @@ export async function buildAdaptiveTaskContext(root, task, options = {}) {
     changedFiles: options.changedFiles,
     workspaceFingerprint: options.workspaceFingerprint,
   })
+  const manifestMs = Date.now() - manifestStartedAt
 
+  const externalizeStartedAt = Date.now()
   const externalized = await externalizeContextExcerpts(root, manifest, {
     task,
     threshold: options.externalizeThreshold,
     inlineChars: options.inlineChars,
   })
+  const externalizeMs = Date.now() - externalizeStartedAt
 
-  const memoryRetrieval = await retrieveMemories(root, taskText(task), {
-    files: taskFilesForMemory(task),
-    limit: options.memoryLimit ?? 6,
-    taskClass: options.taskClass || task.type || policy.executionProfile || policy.profile?.name || null,
-    touch: options.touchMemories !== false,
-  }).catch(() => ({ schemaVersion: 1, query: taskText(task), eligible: 0, results: [] }))
+  const [memoryRetrieval, fabric] = await Promise.all([memoryPromise, fabricPromise])
   const memories = memoryRetrieval.results || []
-  const fabric = await capabilityFabricStatus(root).catch(() => null)
   const providerHints = (fabric?.rows || [])
     .filter((row) => row.selected)
     .slice(0, 12)
@@ -202,6 +209,12 @@ export async function buildAdaptiveTaskContext(root, task, options = {}) {
       entries: externalized.externalized,
     },
     promptEnvelope,
+    performance: {
+      parallelContextPreparation: true,
+      manifestMs,
+      externalizeMs,
+      totalMs: Date.now() - contextBuildStartedAt,
+    },
     promptCache: {
       stablePrefixHash: promptEnvelope.stablePrefixHash,
       dynamicHash: promptEnvelope.dynamicHash,

package/lib/evidence-store.mjs

@@ -5,6 +5,41 @@ import path from "node:path"
 
 const STORE_VERSION = 1
 const REF_PREFIX = "evidence:sha256:"
+const DEFAULT_MAX_STORE_BYTES = 192 * 1024 * 1024
+const DEFAULT_MAX_STORE_ENTRIES = 1200
+const DEFAULT_MAX_STORE_AGE_DAYS = 14
+const AUTO_GC_EVERY_WRITES = 8
+const AUTO_GC_LARGE_ITEM_BYTES = 16 * 1024 * 1024
+const PUT_COUNTS = new Map()
+
+function boundedNumber(value, fallback, min, max) {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+function defaultStoreLimits() {
+  return {
+    maxBytes: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_BYTES,
+      DEFAULT_MAX_STORE_BYTES,
+      16 * 1024 * 1024,
+      2 * 1024 * 1024 * 1024,
+    ),
+    maxEntries: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_ENTRIES,
+      DEFAULT_MAX_STORE_ENTRIES,
+      100,
+      20_000,
+    ),
+    maxAgeDays: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_AGE_DAYS,
+      DEFAULT_MAX_STORE_AGE_DAYS,
+      1,
+      365,
+    ),
+  }
+}
 
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue)
@@ -21,6 +56,24 @@ function toBytes(value, options = {}) {
   return { bytes: Buffer.from(text, "utf8"), encoding: "utf8", mediaType: options.mediaType || "application/json" }
 }
 
+async function protectedEvidenceHashes(root) {
+  const file = path.join(path.resolve(root), ".ues-memory", "MEMORY.json")
+  const parsed = await readFile(file, "utf8")
+    .then((raw) => JSON.parse(raw))
+    .catch(() => null)
+  const protectedHashes = new Set()
+  const now = Date.now()
+  for (const memory of parsed?.memories || []) {
+    if (memory?.status !== "verified" || memory?.supersededBy) continue
+    const expiresAt = Date.parse(String(memory?.expiresAt || ""))
+    if (expiresAt && expiresAt <= now) continue
+    for (const ref of memory?.evidenceRefs || []) {
+      try { protectedHashes.add(normalizeHash(ref)) } catch {}
+    }
+  }
+  return protectedHashes
+}
+
 function normalizeHash(ref) {
   const value = String(ref || "").trim()
   const hash = value.startsWith(REF_PREFIX) ? value.slice(REF_PREFIX.length) : value.replace(/^sha256:/, "")
@@ -79,6 +132,13 @@ export async function putEvidence(root, value, options = {}) {
     preview,
   }
   await writeFile(target.meta, JSON.stringify(metadata, null, 2) + "\n", "utf8")
+
+  const writes = (PUT_COUNTS.get(root) || 0) + 1
+  PUT_COUNTS.set(root, writes)
+  if (writes % AUTO_GC_EVERY_WRITES === 0 || encoded.bytes.length >= AUTO_GC_LARGE_ITEM_BYTES) {
+    await gcEvidenceStore(root, defaultStoreLimits()).catch(() => null)
+  }
+
   return metadata
 }
 
@@ -216,25 +276,44 @@ export async function evidenceStoreStatus(root = process.cwd()) {
 }
 
 export async function gcEvidenceStore(root = process.cwd(), options = {}) {
+  root = path.resolve(root)
   const files = await metadataFiles(root)
-  const maxEntries = Math.max(10, Number(options.maxEntries || 2_000))
-  const maxAgeMs = Math.max(0, Number(options.maxAgeDays ?? 30)) * 86_400_000
+  const defaults = defaultStoreLimits()
+  const maxEntries = Math.max(10, Number(options.maxEntries ?? defaults.maxEntries))
+  const maxBytes = Math.max(1024 * 1024, Number(options.maxBytes ?? defaults.maxBytes))
+  const maxAgeMs = Math.max(0, Number(options.maxAgeDays ?? defaults.maxAgeDays)) * 86_400_000
   const now = Date.now()
+  const protectedHashes = options.protectMemoryRefs === false
+    ? new Set()
+    : await protectedEvidenceHashes(root)
   const rows = []
   for (const metaFile of files) {
     const meta = JSON.parse(await readFile(metaFile, "utf8").catch(() => "{}"))
     const time = Date.parse(meta.lastSeenAt || meta.createdAt || 0) || 0
-    rows.push({ metaFile, meta, time })
+    rows.push({ metaFile, meta, time, bytes: Math.max(0, Number(meta.bytes || 0)) })
   }
   rows.sort((a, b) => b.time - a.time)
 
   const removed = []
-  for (let index = 0; index < rows.length; index += 1) {
-    const row = rows[index]
-    const tooMany = index >= maxEntries
+  let retainedEntries = 0
+  let retainedBytes = 0
+  let protectedEntries = 0
+  let protectedBytes = 0
+  for (const row of rows) {
+    const hash = normalizeHash(row.meta.sha256 || path.basename(row.metaFile, ".json"))
+    const protectedByMemory = protectedHashes.has(hash)
+    const tooMany = retainedEntries >= maxEntries
     const tooOld = maxAgeMs > 0 && row.time > 0 && now - row.time > maxAgeMs
-    if (!tooMany && !tooOld) continue
-    const hash = row.meta.sha256 || path.basename(row.metaFile, ".json")
+    const tooLarge = retainedBytes + row.bytes > maxBytes
+    if (protectedByMemory || (!tooMany && !tooOld && !tooLarge)) {
+      retainedEntries += 1
+      retainedBytes += row.bytes
+      if (protectedByMemory) {
+        protectedEntries += 1
+        protectedBytes += row.bytes
+      }
+      continue
+    }
     const target = evidencePaths(root, hash)
     await rm(target.meta, { force: true })
     await rm(target.data, { force: true })
@@ -244,6 +323,11 @@ export async function gcEvidenceStore(root = process.cwd(), options = {}) {
   return {
     removed,
     removedCount: removed.length,
+    retainedEntries,
+    retainedBytes,
+    protectedEntries,
+    protectedBytes,
+    limits: { maxEntries, maxBytes, maxAgeMs },
     status: await evidenceStoreStatus(root),
   }
 }