opencode-agent-skill 15.1.0 → 15.1.1

package/lib/permission-policy.mjs

@@ -0,0 +1,232 @@
+import { readFile, stat } from "node:fs/promises"
+
+const EFFECTS = new Set(["allow", "deny", "ask"])
+
+function normalizeSlashes(value) {
+  return String(value || "").replaceAll("\\", "/")
+}
+
+function escapeRegex(value) {
+  return value.replace(/[|\\{}()[\]^$+.\-]/g, "\\$&")
+}
+
+function wildcardRegex(pattern, { caseInsensitive = false, shell = false } = {}) {
+  let value = normalizeSlashes(pattern)
+  const shellBare = shell && value.endsWith(" *")
+    ? value.slice(0, -2)
+    : null
+  const compile = (input) => {
+    let source = ""
+    for (const char of input) {
+      if (char === "*") source += ".*"
+      else if (char === "?") source += "."
+      else source += escapeRegex(char)
+    }
+    return source
+  }
+  const alternatives = shellBare === null
+    ? [compile(value)]
+    : [compile(value), compile(shellBare)]
+  return new RegExp(`^(?:${alternatives.join("|")})$`, caseInsensitive ? "i" : "")
+}
+
+export function permissionPatternMatches(pattern, value, options = {}) {
+  return wildcardRegex(String(pattern || ""), options).test(normalizeSlashes(value))
+}
+
+export function normalizePermissionRules(value) {
+  const rules = Array.isArray(value) ? value : []
+  return rules.map((rule, index) => {
+    if (!rule || typeof rule !== "object" || Array.isArray(rule)) {
+      throw new Error(`permission rule ${index} must be an object`)
+    }
+    const action = String(rule.action || "").trim()
+    const resource = String(rule.resource || "").trim()
+    const effect = String(rule.effect || "").trim().toLowerCase()
+    if (!action || !resource || !EFFECTS.has(effect)) {
+      throw new Error(`permission rule ${index} requires action, resource and effect=allow|deny|ask`)
+    }
+    return { action, resource, effect }
+  })
+}
+
+function resourceValue(action, value) {
+  if (["read", "edit", "external_directory"].includes(String(action || ""))) {
+    return normalizeSlashes(value)
+  }
+  return String(value || "")
+}
+
+function matchRule(rule, request, platform) {
+  const caseInsensitive = platform === "win32"
+  const actionMatches = permissionPatternMatches(rule.action, request.action, { caseInsensitive })
+  if (!actionMatches) return false
+  return permissionPatternMatches(
+    rule.resource,
+    resourceValue(request.action, request.resource),
+    { caseInsensitive, shell: request.action === "shell" },
+  )
+}
+
+export function evaluatePermissionRules(rules, request = {}, options = {}) {
+  const normalized = normalizePermissionRules(rules)
+  const action = String(request.action || "").trim()
+  const resources = (Array.isArray(request.resources) ? request.resources : [request.resource])
+    .filter((value) => value !== undefined && value !== null)
+    .map((value) => String(value))
+  const platform = String(options.platform || process.platform)
+  const defaultEffect = EFFECTS.has(options.defaultEffect) ? options.defaultEffect : "allow"
+  if (!action) throw new Error("permission request requires action")
+  if (!resources.length) resources.push("*")
+
+  const decisions = resources.map((resource) => {
+    let matchedRule = null
+    for (let index = 0; index < normalized.length; index += 1) {
+      const rule = normalized[index]
+      if (matchRule(rule, { action, resource }, platform)) {
+        matchedRule = { ...rule, index }
+      }
+    }
+    return {
+      resource,
+      effect: matchedRule?.effect || defaultEffect,
+      matchedRule,
+    }
+  })
+
+  const effect = decisions.some((item) => item.effect === "deny")
+    ? "deny"
+    : decisions.some((item) => item.effect === "ask")
+      ? "ask"
+      : "allow"
+
+  return {
+    schemaVersion: 1,
+    action,
+    effect,
+    defaultEffect,
+    decisions,
+  }
+}
+
+export function toolPermissionRequest(toolName, input = {}) {
+  const name = String(toolName || "").trim()
+  const lower = name.toLowerCase()
+  if (lower === "bash" || lower === "powershell") {
+    return { action: "shell", resources: [String(input.command || "")] }
+  }
+  if (lower === "read") {
+    return { action: "read", resources: [String(input.path || input.file || input.filePath || "*")] }
+  }
+  if (["edit", "write", "write_file", "apply_patch", "ues_code_edit"].includes(lower)) {
+    return { action: "edit", resources: [String(input.path || input.file || input.filePath || input.target || "*")] }
+  }
+  if (lower === "grep") {
+    return { action: "grep", resources: [String(input.pattern || input.query || "*")] }
+  }
+  if (lower === "find" || lower === "glob") {
+    return { action: "glob", resources: [String(input.pattern || input.glob || input.query || "*")] }
+  }
+  if (lower === "ues_dispatch") {
+    return { action: "subagent", resources: [String(input.agent || input.target || "*")] }
+  }
+  if (lower === "ues_session") {
+    return { action: "session", resources: [String(input.action || "*")] }
+  }
+  const action = lower.replace(/[^a-z0-9_]+/g, "_") || "tool"
+  return { action, resources: ["*"] }
+}
+
+export function permissionRecoveryHint(request = {}, decision = null, options = {}) {
+  const action = String(request.action || decision?.action || "tool").trim() || "tool"
+  const resources = (
+    Array.isArray(request.resources)
+      ? request.resources
+      : request.resource !== undefined
+        ? [request.resource]
+        : []
+  ).map((value) => String(value)).filter(Boolean)
+  const denied = Array.isArray(decision?.decisions)
+    ? decision.decisions.filter((item) => item?.effect === "deny" || item?.effect === "ask")
+    : []
+  const resource = String(denied[0]?.resource || resources[0] || "*")
+  const effect = String(options.effect || decision?.effect || "deny")
+  const prefix = effect === "ask"
+    ? "UES approval was not granted for this action."
+    : "UES policy denied this action."
+
+  return [
+    prefix,
+    `Do not repeat the same blocked ${action} request for ${resource}.`,
+    "Continue by choosing the narrowest allowed, reversible alternative that still advances the task.",
+    "Prefer read-only inspection or a less-privileged resource when possible.",
+    "If no allowed path can satisfy the task, report the blocker with evidence instead of bypassing the guard.",
+  ].join(" ")
+}
+
+function normalizedConfig(parsed) {
+  if (Array.isArray(parsed)) {
+    return { permissions: normalizePermissionRules(parsed), agents: {}, defaultEffect: "allow" }
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error("permission config must be an array or object")
+  }
+  const permissions = normalizePermissionRules(parsed.permissions || [])
+  const agents = {}
+  for (const [agent, value] of Object.entries(parsed.agents || {})) {
+    const rules = Array.isArray(value) ? value : value?.permissions
+    agents[String(agent)] = normalizePermissionRules(rules || [])
+  }
+  const defaultEffect = EFFECTS.has(parsed.defaultEffect) ? parsed.defaultEffect : "allow"
+  return { permissions, agents, defaultEffect }
+}
+
+export class PermissionPolicyStore {
+  constructor(file) {
+    this.file = String(file || "")
+    this.cacheKey = null
+    this.cached = null
+  }
+
+  async load() {
+    if (!this.file) return { configured: false, config: null }
+    const info = await stat(this.file).catch((error) => {
+      if (error?.code === "ENOENT") return null
+      throw error
+    })
+    if (!info?.isFile()) {
+      this.cacheKey = null
+      this.cached = null
+      return { configured: false, config: null }
+    }
+
+    const cacheKey = `${info.mtimeMs}:${info.size}`
+    if (this.cached && this.cacheKey === cacheKey) {
+      return { configured: true, config: this.cached, cached: true }
+    }
+
+    const parsed = JSON.parse(await readFile(this.file, "utf8"))
+    const config = normalizedConfig(parsed)
+    this.cacheKey = cacheKey
+    this.cached = config
+    return { configured: true, config, cached: false }
+  }
+
+  async evaluate(request, options = {}) {
+    const loaded = await this.load()
+    if (!loaded.configured) return { configured: false, decision: null }
+    const agent = String(options.agent || "")
+    const agentRules = agent ? (loaded.config.agents[agent] || []) : []
+    const rules = [...loaded.config.permissions, ...agentRules]
+    const decision = evaluatePermissionRules(rules, request, {
+      platform: options.platform,
+      defaultEffect: loaded.config.defaultEffect,
+    })
+    return {
+      configured: true,
+      decision,
+      agent: agent || null,
+      cached: loaded.cached === true,
+    }
+  }
+}

package/lib/pi-rpc-pool.mjs

@@ -180,6 +180,95 @@ class RpcWorker {
     return { accepted: true }
   }
 
+  async followUp(message) {
+    if (!this.proc || this.dead || !this.active) {
+      return { accepted: false, reason: "worker-not-active" }
+    }
+    await this.send(
+      { type: "follow_up", message: String(message || "") },
+      { timeoutMs: RPC_CONTROL_TIMEOUT_MS },
+    )
+    return { accepted: true }
+  }
+
+  async getState() {
+    if (!this.proc || this.dead) return null
+    const response = await this.send(
+      { type: "get_state" },
+      { timeoutMs: RPC_CONTROL_TIMEOUT_MS },
+    )
+    return response?.data || null
+  }
+
+  async clearQueue() {
+    if (!this.proc || this.dead) return { steering: [], followUp: [] }
+    const response = await this.send(
+      { type: "clear_queue" },
+      { timeoutMs: RPC_CONTROL_TIMEOUT_MS },
+    )
+    return response?.data || { steering: [], followUp: [] }
+  }
+
+  async setModel(provider, modelId) {
+    if (!this.proc || this.dead) throw new Error("Pi RPC worker is not available")
+    const response = await this.send(
+      { type: "set_model", provider: String(provider || ""), modelId: String(modelId || "") },
+      { timeoutMs: RPC_CONTROL_TIMEOUT_MS },
+    )
+    return response?.data || null
+  }
+
+  async setThinkingLevel(level) {
+    if (!this.proc || this.dead) throw new Error("Pi RPC worker is not available")
+    await this.send(
+      { type: "set_thinking_level", level: String(level || "") },
+      { timeoutMs: RPC_CONTROL_TIMEOUT_MS },
+    )
+    return { level: String(level || "") }
+  }
+
+  async compact(customInstructions = "") {
+    if (!this.proc || this.dead) throw new Error("Pi RPC worker is not available")
+    const response = await this.send(
+      {
+        type: "compact",
+        ...(String(customInstructions || "").trim()
+          ? { customInstructions: String(customInstructions).trim() }
+          : {}),
+      },
+      { timeoutMs: Math.max(RPC_CONTROL_TIMEOUT_MS, 5 * 60_000) },
+    )
+    return response?.data || null
+  }
+
+  async waitForIdle(timeoutMs = 30_000) {
+    if (!this.proc || this.dead) {
+      return { idle: true, state: null, reason: "worker-unavailable" }
+    }
+    const timeout = clamp(timeoutMs, 30_000, 500, 30 * 60_000)
+    const deadline = Date.now() + timeout
+    let state = await this.getState()
+    let pollMs = 100
+
+    while (
+      state &&
+      (
+        state.isStreaming === true ||
+        state.isCompacting === true ||
+        Number(state.pendingMessageCount || 0) > 0
+      )
+    ) {
+      if (Date.now() >= deadline) {
+        return { idle: false, state, reason: "timeout" }
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollMs))
+      pollMs = Math.min(500, Math.max(100, Math.trunc(pollMs * 1.6)))
+      state = await this.getState()
+    }
+
+    return { idle: true, state, reason: null }
+  }
+
   async abortTransport() {
     if (!this.proc || this.dead) return false
     try {
@@ -216,7 +305,7 @@ class RpcWorker {
     const execute = async () => {
       try {
         await this.start()
-        if (this.runs > 0) {
+        if (this.runs > 0 && options.reuseSession !== true) {
           await this.send({ type: "new_session" }, { timeoutMs: 30_000 })
         }
       } catch (error) {
@@ -407,6 +496,11 @@ export class PiRpcWorkerPool {
   async run(key, spec, message, options = {}) {
     let worker = this.workers.get(key)
     let workerReused = Boolean(worker && !worker.dead && worker.runs > 0)
+    if (options.reuseSession === true && !workerReused) {
+      const error = new Error("Pi RPC same-session resume unavailable")
+      error.code = "UES_RPC_SESSION_UNAVAILABLE"
+      throw error
+    }
     if (!worker || worker.dead) {
       if (worker) {
         await worker.stop().catch(() => {})
@@ -443,19 +537,90 @@ export class PiRpcWorkerPool {
       }))
   }
 
-  async steerActive(message) {
+  selectSingleActive() {
     const active = [...this.workers.entries()]
       .filter(([, worker]) => worker && !worker.dead && worker.active)
     if (active.length !== 1) {
       return {
-        accepted: false,
+        ok: false,
         reason: active.length === 0 ? "no-active-worker" : "multiple-active-workers",
         active: active.length,
       }
     }
     const [key, worker] = active[0]
-    const result = await worker.steer(message)
-    return { ...result, key, active: 1 }
+    return { ok: true, key, worker, active: 1 }
+  }
+
+  async controlActive(action, input = {}) {
+    const name = String(action || "").trim().toLowerCase()
+    if (name === "status") return { ok: true, action: name, ...this.status() }
+
+    const selected = this.selectSingleActive()
+    if (!selected.ok) return { ...selected, action: name }
+    const { key, worker } = selected
+    let data
+
+    if (name === "get-state") {
+      data = await worker.getState()
+    } else if (name === "steer") {
+      data = await worker.steer(input.message)
+    } else if (name === "follow-up") {
+      data = await worker.followUp(input.message)
+    } else if (name === "abort") {
+      data = { aborted: await worker.abort() }
+    } else if (name === "clear-queue") {
+      data = await worker.clearQueue()
+    } else if (name === "set-model") {
+      if (!String(input.provider || "").trim() || !String(input.modelId || "").trim()) {
+        return { ok: false, action: name, reason: "provider-and-model-required", active: 1, key }
+      }
+      data = await worker.setModel(input.provider, input.modelId)
+    } else if (name === "set-thinking") {
+      if (!String(input.level || "").trim()) {
+        return { ok: false, action: name, reason: "thinking-level-required", active: 1, key }
+      }
+      data = await worker.setThinkingLevel(input.level)
+    } else if (name === "compact") {
+      data = await worker.compact(input.customInstructions)
+    } else if (name === "wait") {
+      data = await worker.waitForIdle(input.timeoutMs)
+    } else {
+      return { ok: false, action: name, reason: "unknown-control-action", active: 1, key }
+    }
+
+    return { ok: true, action: name, key, active: 1, data }
+  }
+
+  async steerActive(message) {
+    const result = await this.controlActive("steer", { message })
+    if (!result.ok) {
+      return {
+        accepted: false,
+        reason: result.reason,
+        active: result.active || 0,
+      }
+    }
+    return {
+      accepted: result.data?.accepted !== false,
+      key: result.key,
+      active: 1,
+    }
+  }
+
+  async followUpActive(message) {
+    const result = await this.controlActive("follow-up", { message })
+    if (!result.ok) {
+      return {
+        accepted: false,
+        reason: result.reason,
+        active: result.active || 0,
+      }
+    }
+    return {
+      accepted: result.data?.accepted !== false,
+      key: result.key,
+      active: 1,
+    }
   }
 
   async abortActive() {

package/lib/provider-recovery.mjs

@@ -0,0 +1,51 @@
+const EMPTY_PROVIDER_SIGNAL = /(?:provider\s+returned\s+an?\s+empty\s+response|empty\s+provider\s+response|empty\s+response\s*\(no\s+content\s+emitted\)|no\s+content\s+emitted)/i
+
+function finiteInt(value, fallback, min, max) {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+export function classifyProviderFailure(result = {}) {
+  const output = String(result.output || "").trim()
+  const diagnostics = [result.errorMessage, result.stderr]
+    .filter(Boolean)
+    .map(String)
+    .join("\n")
+  const toolCalls = Math.max(0, Number(result.toolCalls || 0))
+  const explicitEmpty = EMPTY_PROVIDER_SIGNAL.test(diagnostics)
+  const missingAssistant =
+    result.noAssistantMessage === true ||
+    /^\(no assistant output\)$/i.test(output) ||
+    /^\(no output\)$/i.test(output)
+  const transient =
+    explicitEmpty ||
+    missingAssistant ||
+    result.providerFailure === "empty-provider-response"
+  const reason = transient
+    ? explicitEmpty || result.providerFailure === "empty-provider-response"
+      ? "empty-provider-response"
+      : "missing-assistant-output"
+    : null
+
+  return {
+    transient,
+    reason,
+    safeReplay: transient && toolCalls === 0,
+    safeSessionResume: transient && toolCalls > 0,
+    toolCalls,
+    stopReason: String(result.stopReason || ""),
+    message: transient
+      ? toolCalls === 0
+        ? "Provider produced no usable assistant content before any tool side effect; a bounded fresh-session retry is safe."
+        : "Provider produced no usable assistant content after tool execution; blind replay is blocked, but the same live RPC session may continue without repeating completed side effects."
+      : null,
+  }
+}
+
+export function providerRecoveryBackoffMs(retryNumber, options = {}) {
+  const attempt = finiteInt(retryNumber, 1, 1, 8)
+  const baseMs = finiteInt(options.baseMs, 250, 0, 10_000)
+  const maxMs = finiteInt(options.maxMs, 2_000, baseMs, 30_000)
+  return Math.min(maxMs, baseMs * (2 ** (attempt - 1)))
+}

package/lib/repo-graph.mjs

@@ -31,6 +31,22 @@ async function walk(root, maxFiles = 2500, maxDepth = 8) {
   return files
 }
 
+async function mapLimit(items, limit, worker) {
+  if (!items.length) return []
+  const output = new Array(items.length)
+  let cursor = 0
+  const width = Math.min(items.length, Math.max(1, Number(limit || 1)))
+  const runners = Array.from({ length: width }, async () => {
+    while (true) {
+      const index = cursor++
+      if (index >= items.length) return
+      output[index] = await worker(items[index], index)
+    }
+  })
+  await Promise.all(runners)
+  return output
+}
+
 function rel(root, file) {
   return path.relative(root, file).replaceAll("\\", "/")
 }
@@ -84,29 +100,46 @@ export async function buildRepoGraph(root = process.cwd(), options = {}) {
   const nodes = []
   const edges = []
   const external = new Map()
+  const ioConcurrency = Math.max(1, Math.min(32, Number(options.ioConcurrency ?? 12)))
 
-  for (const file of files) {
+  const scanned = await mapLimit(files, ioConcurrency, async (file) => {
     const info = await stat(file).catch(() => null)
-    if (!info || info.size > 768 * 1024) continue
+    if (!info || info.size > 768 * 1024) return null
     const source = await readFile(file, "utf8").catch(() => "")
     const relative = rel(root, file)
     const ext = path.extname(file).toLowerCase()
     const imports = importsFor(source, ext)
     const local = []
+    const fileEdges = []
+    const externalKeys = []
 
     for (const specifier of imports) {
       const resolved = resolveRelativeImport(root, file, specifier, fileSet)
       if (resolved) {
         local.push(resolved)
-        edges.push({ from: relative, to: resolved, kind: "local-import" })
+        fileEdges.push({ from: relative, to: resolved, kind: "local-import" })
       } else {
         const parts = specifier.split("/")
         const key = parts[0].startsWith("@") ? parts.slice(0, 2).join("/") : parts[0]
-        external.set(key, (external.get(key) || 0) + 1)
+        if (key) externalKeys.push(key)
       }
     }
 
-    nodes.push({ path: relative, imports: imports.length, localImports: [...new Set(local)].sort() })
+    return {
+      node: { path: relative, imports: imports.length, localImports: [...new Set(local)].sort() },
+      edges: fileEdges,
+      externalKeys,
+    }
+  })
+
+  // Preserve discovery-order aggregation so concurrency changes latency, not graph output.
+  for (const result of scanned) {
+    if (!result) continue
+    nodes.push(result.node)
+    edges.push(...result.edges)
+    for (const key of result.externalKeys) {
+      external.set(key, (external.get(key) || 0) + 1)
+    }
   }
 
   const incoming = new Map()

package/lib/runtime-events.mjs

@@ -4,6 +4,25 @@ import { appendFile, readFile, stat, writeFile } from "node:fs/promises"
 const DEFAULT_MAX_EVENT_FILE_BYTES = 4 * 1024 * 1024
 const DEFAULT_RETAIN_EVENT_BYTES = 2 * 1024 * 1024
 
+const EVENT_WRITE_TAILS = new Map()
+
+async function withEventWriteLock(file, fn) {
+  const key = String(file)
+  const previous = EVENT_WRITE_TAILS.get(key) || Promise.resolve()
+  let release
+  const barrier = new Promise((resolve) => { release = resolve })
+  const tail = previous.catch(() => {}).then(() => barrier)
+  EVENT_WRITE_TAILS.set(key, tail)
+
+  await previous.catch(() => {})
+  try {
+    return await fn()
+  } finally {
+    release()
+    if (EVENT_WRITE_TAILS.get(key) === tail) EVENT_WRITE_TAILS.delete(key)
+  }
+}
+
 async function compactRuntimeEventFile(file, options = {}) {
   const maxBytes = Math.max(
     256 * 1024,
@@ -33,16 +52,18 @@ async function compactRuntimeEventFile(file, options = {}) {
 }
 
 export async function appendRuntimeEvent(file, type, data = {}) {
-  await compactRuntimeEventFile(file).catch(() => false)
-  const event = {
-    schemaVersion: 1,
-    id: randomUUID(),
-    type: String(type || "unknown"),
-    at: new Date().toISOString(),
-    ...data,
-  }
-  await appendFile(file, JSON.stringify(event) + "\n", "utf8")
-  return event
+  return withEventWriteLock(file, async () => {
+    await compactRuntimeEventFile(file).catch(() => false)
+    const event = {
+      schemaVersion: 1,
+      id: randomUUID(),
+      type: String(type || "unknown"),
+      at: new Date().toISOString(),
+      ...data,
+    }
+    await appendFile(file, JSON.stringify(event) + "\n", "utf8")
+    return event
+  })
 }
 
 export async function readRuntimeEvents(file, options = {}) {