opencode-agent-skill 9.0.0 → 11.0.0

package/lib/evidence-store.mjs

@@ -0,0 +1,178 @@
+import { createHash } from "node:crypto"
+import { existsSync } from "node:fs"
+import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises"
+import path from "node:path"
+
+const STORE_VERSION = 1
+const REF_PREFIX = "evidence:sha256:"
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue)
+  if (!value || typeof value !== "object" || Buffer.isBuffer(value)) return value
+  return Object.fromEntries(
+    Object.keys(value).sort().map((key) => [key, stableValue(value[key])]),
+  )
+}
+
+function toBytes(value, options = {}) {
+  if (Buffer.isBuffer(value)) return { bytes: value, encoding: "binary", mediaType: options.mediaType || "application/octet-stream" }
+  if (typeof value === "string") return { bytes: Buffer.from(value, "utf8"), encoding: "utf8", mediaType: options.mediaType || "text/plain; charset=utf-8" }
+  const text = JSON.stringify(stableValue(value), null, options.pretty === false ? 0 : 2)
+  return { bytes: Buffer.from(text, "utf8"), encoding: "utf8", mediaType: options.mediaType || "application/json" }
+}
+
+function normalizeHash(ref) {
+  const value = String(ref || "").trim()
+  const hash = value.startsWith(REF_PREFIX) ? value.slice(REF_PREFIX.length) : value.replace(/^sha256:/, "")
+  if (!/^[a-f0-9]{64}$/i.test(hash)) throw new Error("Invalid evidence reference")
+  return hash.toLowerCase()
+}
+
+export function evidenceReference(hash) {
+  return REF_PREFIX + normalizeHash(hash)
+}
+
+export function evidenceStoreRoot(root = process.cwd()) {
+  return path.join(path.resolve(root), ".ues-cache", "evidence-v1")
+}
+
+function evidencePaths(root, hash) {
+  const normalized = normalizeHash(hash)
+  const dir = path.join(evidenceStoreRoot(root), normalized.slice(0, 2))
+  return {
+    dir,
+    meta: path.join(dir, normalized + ".json"),
+    data: path.join(dir, normalized + ".blob"),
+  }
+}
+
+export async function putEvidence(root, value, options = {}) {
+  root = path.resolve(root)
+  const encoded = toBytes(value, options)
+  const hash = createHash("sha256").update(encoded.bytes).digest("hex")
+  const target = evidencePaths(root, hash)
+  await mkdir(target.dir, { recursive: true })
+
+  const now = new Date().toISOString()
+  const existing = existsSync(target.meta)
+    ? JSON.parse(await readFile(target.meta, "utf8").catch(() => "{}"))
+    : null
+
+  if (!existsSync(target.data)) await writeFile(target.data, encoded.bytes)
+
+  const preview = encoded.encoding === "utf8"
+    ? encoded.bytes.toString("utf8", 0, Math.min(encoded.bytes.length, 600))
+    : null
+
+  const metadata = {
+    schemaVersion: STORE_VERSION,
+    ref: evidenceReference(hash),
+    sha256: hash,
+    bytes: encoded.bytes.length,
+    encoding: encoded.encoding,
+    mediaType: encoded.mediaType,
+    kind: options.kind || existing?.kind || "tool-output",
+    source: options.source || existing?.source || null,
+    summary: options.summary || existing?.summary || null,
+    createdAt: existing?.createdAt || now,
+    lastSeenAt: now,
+    preview,
+  }
+  await writeFile(target.meta, JSON.stringify(metadata, null, 2) + "\n", "utf8")
+  return metadata
+}
+
+export async function getEvidence(root, ref, options = {}) {
+  const hash = normalizeHash(ref)
+  const target = evidencePaths(root, hash)
+  const metadata = JSON.parse(await readFile(target.meta, "utf8"))
+  const bytes = await readFile(target.data)
+  const start = Math.max(0, Number(options.start || 0))
+  const maxBytes = Math.max(1, Number(options.maxBytes || options.maxChars || 24_000))
+  const slice = bytes.subarray(start, Math.min(bytes.length, start + maxBytes))
+  return {
+    ...metadata,
+    truncated: start + slice.length < bytes.length,
+    start,
+    returnedBytes: slice.length,
+    content: metadata.encoding === "utf8" ? slice.toString("utf8") : slice.toString("base64"),
+  }
+}
+
+async function metadataFiles(root) {
+  const base = evidenceStoreRoot(root)
+  const prefixes = await readdir(base, { withFileTypes: true }).catch(() => [])
+  const files = []
+  for (const prefix of prefixes) {
+    if (!prefix.isDirectory()) continue
+    const dir = path.join(base, prefix.name)
+    for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+      if (entry.isFile() && entry.name.endsWith(".json")) files.push(path.join(dir, entry.name))
+    }
+  }
+  return files
+}
+
+export async function evidenceStoreStatus(root = process.cwd()) {
+  const files = await metadataFiles(root)
+  let bytes = 0
+  let oldest = null
+  let newest = null
+  for (const file of files) {
+    const meta = JSON.parse(await readFile(file, "utf8").catch(() => "{}"))
+    bytes += Number(meta.bytes || 0)
+    if (meta.createdAt && (!oldest || meta.createdAt < oldest)) oldest = meta.createdAt
+    if (meta.lastSeenAt && (!newest || meta.lastSeenAt > newest)) newest = meta.lastSeenAt
+  }
+  return {
+    schemaVersion: STORE_VERSION,
+    root: evidenceStoreRoot(root),
+    entries: files.length,
+    bytes,
+    oldest,
+    newest,
+  }
+}
+
+export async function gcEvidenceStore(root = process.cwd(), options = {}) {
+  const files = await metadataFiles(root)
+  const maxEntries = Math.max(10, Number(options.maxEntries || 2_000))
+  const maxAgeMs = Math.max(0, Number(options.maxAgeDays ?? 30)) * 86_400_000
+  const now = Date.now()
+  const rows = []
+  for (const metaFile of files) {
+    const meta = JSON.parse(await readFile(metaFile, "utf8").catch(() => "{}"))
+    const time = Date.parse(meta.lastSeenAt || meta.createdAt || 0) || 0
+    rows.push({ metaFile, meta, time })
+  }
+  rows.sort((a, b) => b.time - a.time)
+
+  const removed = []
+  for (let index = 0; index < rows.length; index += 1) {
+    const row = rows[index]
+    const tooMany = index >= maxEntries
+    const tooOld = maxAgeMs > 0 && row.time > 0 && now - row.time > maxAgeMs
+    if (!tooMany && !tooOld) continue
+    const hash = row.meta.sha256 || path.basename(row.metaFile, ".json")
+    const target = evidencePaths(root, hash)
+    await rm(target.meta, { force: true })
+    await rm(target.data, { force: true })
+    removed.push(evidenceReference(hash))
+  }
+
+  return {
+    removed,
+    removedCount: removed.length,
+    status: await evidenceStoreStatus(root),
+  }
+}
+
+export async function evidenceExists(root, ref) {
+  try {
+    const target = evidencePaths(root, normalizeHash(ref))
+    const info = await stat(target.data)
+    return info.isFile()
+  } catch {
+    return false
+  }
+}

package/lib/hermes-bridge.mjs

@@ -1,11 +1,20 @@
 import { spawnSync } from "node:child_process"
+import { resolveWindowsCommand } from "./windows-shim.mjs"
+
+function runHermesVersion() {
+  if (process.platform !== "win32") return spawnSync("hermes", ["--version"], { encoding: "utf8" })
+  const resolved = resolveWindowsCommand("hermes")
+  if (!resolved) return { status: 127, stdout: "", stderr: "Hermes CLI not found" }
+  return spawnSync(resolved.executable, [...resolved.argsPrefix, "--version"], { encoding: "utf8" })
+}
 
 export function hermesStatus() {
-  const result = spawnSync("hermes", ["--version"], { encoding: "utf8", shell: process.platform === "win32" })
+  const result = runHermesVersion()
   return {
     available: result.status === 0,
     version: result.status === 0 ? String(result.stdout || result.stderr || "").trim() : null,
     error: result.status === 0 ? null : String(result.stderr || result.stdout || "Hermes CLI not found").trim(),
+    mode: "optional-sidecar",
   }
 }
 
@@ -15,11 +24,46 @@ export function buildHermesDelegationPrompt(contextPack) {
     "Implement exactly the approved task described below.",
     "Do not broaden scope, merge, push, publish, deploy, or alter durable UES state.",
     "Run the declared verification and return a concise structured report.",
+    "Large evidence is referenced by evidence:sha256 pointers; fetch only the slice required for the task.",
+    "",
+    JSON.stringify(contextPack, null, 2),
+  ].join("\n")
+}
+
+export function buildHermesWorkflowPrompt(contextPack, schedule) {
+  return [
+    "You are the optional Hermes sidecar for a UES V11 dynamic workflow.",
+    "Follow the supplied bounded wave schedule. Deterministic tasks are not delegated to LLM children.",
+    "Never exceed declared task ownership or concurrency. Persist outputs/evidence to files instead of conversational summaries.",
+    "Do not merge, push, publish, deploy, or mutate durable UES state except through explicitly supplied UES commands.",
+    "",
+    "SCHEDULE:",
+    JSON.stringify(schedule, null, 2),
     "",
+    "CONTEXT:",
     JSON.stringify(contextPack, null, 2),
   ].join("\n")
 }
 
+export function hermesSidecarPlan(input = {}) {
+  return {
+    schemaVersion: 2,
+    adapter: "hermes",
+    optional: true,
+    mode: input.mode || "one-shot",
+    maxConcurrent: Math.max(1, Math.min(16, Number(input.maxConcurrent || 4))),
+    durableStateOwner: "ues",
+    evidenceTransport: "content-addressed-pointers",
+    allowNestedDelegation: input.allowNestedDelegation === true,
+    safety: {
+      merge: false,
+      push: false,
+      publish: false,
+      deploy: false,
+      destructiveGit: false,
+    },
+  }
+}
 
 export function hermesOneShotArgs(prompt) {
   const text = String(prompt || "").trim()

package/lib/model-config.mjs

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs"
 import { mkdir, readFile, writeFile } from "node:fs/promises"
 import path from "node:path"
 import { defaultModelPolicy, resolveModel } from "./model-policy.mjs"
+import { normalizeCapabilityProfile } from "./capability-registry.mjs"
 
 const TIERS = new Set(["light", "standard", "heavy"])
 
@@ -23,14 +24,20 @@ function normalize(policy) {
     if (TIERS.has(tier)) roleTiers[role] = tier
   }
 
+  const capabilities = {}
+  for (const [model, profile] of Object.entries(input.capabilities || {})) {
+    if (validModelID(model)) capabilities[model] = normalizeCapabilityProfile(profile)
+  }
+
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     enabled: input.enabled === true,
     maxEscalations: Number.isInteger(input.maxEscalations)
       ? Math.max(0, Math.min(input.maxEscalations, 2))
       : base.maxEscalations,
     tiers,
     roleTiers,
+    capabilities,
   }
 }
 
@@ -56,6 +63,7 @@ export async function writeModelPolicy(configDir, patch = {}) {
     ...patch,
     tiers: { ...current.tiers, ...(patch.tiers || {}) },
     roleTiers: { ...current.roleTiers, ...(patch.roleTiers || {}) },
+    capabilities: { ...(current.capabilities || {}), ...(patch.capabilities || {}) },
   })
   const file = modelPolicyFile(configDir)
   await mkdir(path.dirname(file), { recursive: true })

package/lib/model-policy.mjs

@@ -1,3 +1,5 @@
+import { inferTaskCapabilities, modelCandidatesFromPolicy, selectCapabilityCandidate } from "./capability-registry.mjs"
+
 const ROLE_TIERS = {
   "codebase-mapper": "standard",
   architect: "heavy",
@@ -9,6 +11,8 @@ const ROLE_TIERS = {
   critic: "heavy",
   verifier: "standard",
   "integration-verifier": "heavy",
+  "visual-verifier": "standard",
+  "merge-arbiter": "heavy",
 }
 
 const ORDER = ["light", "standard", "heavy"]
@@ -41,11 +45,12 @@ export function resolveModel(role, attempt, config = {}) {
 
 export function defaultModelPolicy() {
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     enabled: false,
     maxEscalations: 2,
     tiers: { light: null, standard: null, heavy: null },
     roleTiers: { ...ROLE_TIERS },
+    capabilities: {},
   }
 }
 
@@ -58,14 +63,66 @@ export function resolveAdaptiveModel(role, attempt, taskPolicy = {}, config = {}
     ...config,
     roleTiers: { ...(config.roleTiers || {}), [role]: baseTier },
   })
+  const normalizedAttempt = Math.max(1, Number(attempt || 1))
   return {
     ...resolved,
+    recoveryStage:
+      normalizedAttempt <= 1 ? "initial" :
+      normalizedAttempt === 2 ? "diagnose" :
+      "deep-recovery",
     policy: {
       mode: taskPolicy.mode || null,
       risk: taskPolicy.risk || null,
+      executionProfile: taskPolicy.executionProfile || null,
       score: Number(taskPolicy.score || 0),
       maxAttempts: Number(taskPolicy.maxAttempts || 0) || null,
       contextBudget: Number(taskPolicy.contextBudget || 0) || null,
     },
   }
 }
+
+
+export function resolveCapabilityModel(role, attempt, taskText = "", taskPolicy = {}, config = {}, facts = {}) {
+  const base = resolveAdaptiveModel(role, attempt, taskPolicy, config)
+  const requirements = inferTaskCapabilities(taskText, {
+    ...facts,
+    ...(role === "visual-verifier" && facts.coding === undefined ? { coding: false } : {}),
+  })
+  const candidates = modelCandidatesFromPolicy(config)
+    .filter((candidate) => tierIndex(candidate.tier) >= tierIndex(base.tier))
+  const selection = selectCapabilityCandidate(requirements, candidates, {
+    role,
+    preferredTier: base.tier,
+  })
+  const capabilityEnforced = config.enabled === true && candidates.length > 0
+  if (capabilityEnforced && !selection.selected) {
+    return {
+      ...base,
+      model: null,
+      capabilityRequirements: requirements,
+      capabilitySelection: selection,
+      capabilityFallback: true,
+      capabilityBlocked: true,
+      capabilityBlockReason: "no-configured-model-satisfies-required-capabilities",
+    }
+  }
+  if (!config.enabled || !selection.selected) {
+    return {
+      ...base,
+      capabilityRequirements: requirements,
+      capabilitySelection: selection,
+      capabilityFallback: selection.fallbackNeeded,
+      capabilityBlocked: false,
+    }
+  }
+  const selected = selection.selected
+  return {
+    ...base,
+    tier: selected.tier || base.tier,
+    model: selected.id,
+    capabilityRequirements: requirements,
+    capabilitySelection: selection,
+    capabilityFallback: false,
+    capabilityBlocked: false,
+  }
+}

package/lib/orchestrator-policy.mjs

@@ -1,4 +1,4 @@
-const HIGH_RISK = /(auth|security|permission|payment|migration|schema|database|production|deploy|public api|breaking|secret|credential|phân quyền|bảo mật|thanh toán|cơ sở dữ liệu|triển khai|migrate|migration)/i
+const HIGH_RISK = /(\bauth\b|authorization|authentication|security|permission|payment|migration|schema|database|production|deploy|public api|breaking|secret|credential|phân quyền|bảo mật|thanh toán|cơ sở dữ liệu|triển khai|migrate|migration)/i
 const LONG = /(whole repo|whole repository|whole project|entire repo|entire project|large refactor|major refactor|long[- ](?:running|horizon)|durable state|dependency graph|integration verification|resume|migration|refactor all|toàn bộ repo|toàn bộ repository|toàn bộ dự án|toàn bộ project|refactor lớn|tác vụ dài|nhiều file|nhiều module|tiếp tục công việc|refactor toàn bộ|xác minh tích hợp|kiểm tra tích hợp|chia (?:công việc|task|tác vụ).*(?:dependency|phụ thuộc))/i
 const DEBUG = /(fix|bug|debug|crash|regression|failure|error|broken|sửa lỗi|lỗi|điều tra lỗi|không chạy)/i
 const CONTRACT = /(public api|api contract|openapi|response schema|request schema|breaking api|hợp đồng api|api công khai)/i
@@ -13,8 +13,9 @@ function profileFor(mode, risk) {
     return {
       name: "fast",
       maxSkills: 2,
-      contextBudget: 12_000,
+      contextBudget: 8_000,
       contextStrategy: "incremental-semantic",
+      skillLoading: "direct-only",
       durableState: false,
       worktree: "off",
       critic: "off",
@@ -29,6 +30,7 @@ function profileFor(mode, risk) {
       maxSkills: 5,
       contextBudget: 48_000,
       contextStrategy: "semantic+graph+git",
+      skillLoading: "orchestrated",
       durableState: true,
       worktree: "auto-writers",
       critic: "required-for-high-risk-or-final",
@@ -40,8 +42,9 @@ function profileFor(mode, risk) {
   return {
     name: "standard",
     maxSkills: 4,
-    contextBudget: 24_000,
+    contextBudget: 20_000,
     contextStrategy: "incremental-semantic+git",
+    skillLoading: "selective",
     durableState: false,
     worktree: "auto-on-conflict",
     critic: "on-failure-or-elevated-risk",
@@ -51,12 +54,97 @@ function profileFor(mode, risk) {
   }
 }
 
+function boundedInt(value, fallback, min, max) {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.min(max, Math.max(min, Math.round(parsed)))
+}
+
+export function recoveryPolicyForAttempt(taskPolicy = {}, attempt = 1) {
+  const normalizedAttempt = boundedInt(attempt, 1, 1, 99)
+  const baseBudget = boundedInt(
+    taskPolicy.contextBudget ?? taskPolicy.profile?.contextBudget,
+    20_000,
+    4_000,
+    48_000,
+  )
+  const baseSkills = boundedInt(
+    taskPolicy.maxSkills ?? taskPolicy.profile?.maxSkills,
+    4,
+    1,
+    5,
+  )
+  const baseStrategy = taskPolicy.profile?.contextStrategy || "incremental-semantic+git"
+
+  if (normalizedAttempt <= 1) {
+    return {
+      schemaVersion: 1,
+      stage: "initial",
+      attempt: normalizedAttempt,
+      contextBudget: baseBudget,
+      maxSkills: baseSkills,
+      contextStrategy: baseStrategy,
+      requireDiagnosis: false,
+      requireCritic: false,
+      modelEscalation: false,
+      directives: [],
+    }
+  }
+
+  if (normalizedAttempt === 2) {
+    return {
+      schemaVersion: 1,
+      stage: "diagnose",
+      attempt: normalizedAttempt,
+      contextBudget: Math.min(48_000, Math.max(baseBudget, Math.round(baseBudget * 1.35))),
+      maxSkills: Math.min(5, baseSkills + 1),
+      contextStrategy:
+        taskPolicy.executionProfile === "fast"
+          ? "incremental-semantic+git"
+          : baseStrategy,
+      requireDiagnosis: true,
+      requireCritic: false,
+      modelEscalation: true,
+      directives: [
+        "reproduce or capture the exact previous failure before editing",
+        "inspect the direct caller, nearest test and failure-adjacent evidence",
+        "do not stack another speculative patch on top of the failed attempt",
+      ],
+    }
+  }
+
+  return {
+    schemaVersion: 1,
+    stage: "deep-recovery",
+    attempt: normalizedAttempt,
+    contextBudget: Math.min(48_000, Math.max(20_000, Math.round(baseBudget * 1.75))),
+    maxSkills: Math.min(5, baseSkills + 2),
+    contextStrategy: "semantic+graph+git",
+    requireDiagnosis: true,
+    requireCritic: true,
+    modelEscalation: true,
+    directives: [
+      "re-investigate from fresh evidence and explicitly reject the failed hypothesis",
+      "expand to callers, dependencies, tests and boundary contracts before editing",
+      "challenge the architecture or coupling if repeated fixes expose a wider problem",
+      "run an independent critic or review pass before accepting the recovery",
+    ],
+  }
+}
+
 export function classifyEngineeringTask(text, facts = {}) {
   const value = String(text || "")
   const declaredHighRisk =
     ["high", "critical"].includes(String(facts.risk || "").toLowerCase()) ||
-    /\b(?:risk|rủi ro)\s*[:=-]?\s*(?:high|critical|cao|nghiêm trọng)\b/i.test(value)
-  const explicitLongHorizon = LONG.test(value)
+    /\b(?:risk|rủi ro)\s*[:=\/-]?\s*(?:high|critical|cao|nghiêm trọng)\b/i.test(value) ||
+    /\b(?:high|critical)[-\s]?(?:risk|rủi ro)\b/i.test(value)
+  const declaredLongHorizon =
+    facts.longHorizon === true ||
+    ["long", "long-horizon", "deep"].includes(String(facts.mode || "").toLowerCase())
+  const compoundLongRisk =
+    /\blong\s*[/|,+]\s*(?:high|critical)[-\s]?risk\b/i.test(value) ||
+    /\b(?:high|critical)[-\s]?risk\s*[/|,+]\s*long\b/i.test(value)
+  const explicitLongHorizon = declaredLongHorizon || compoundLongRisk || LONG.test(value)
   const signals = [
     signal("long-request-text", value.length > 700, 1),
     signal("medium-request-text", value.length > 250, 1),
@@ -91,8 +179,9 @@ export function classifyEngineeringTask(text, facts = {}) {
   if (/(docker|kubernetes|terraform|github actions|ci\/cd|deploy|triển khai)/i.test(value)) domains.push("devops")
 
   return {
-    schemaVersion: 3,
+    schemaVersion: 4,
     score,
+    signals,
     risk,
     mode,
     executionProfile: profile.name,
@@ -105,7 +194,11 @@ export function classifyEngineeringTask(text, facts = {}) {
     requireFreshEvidence: true,
     profile,
     domains: [...new Set(domains)],
-    signals,
+    recovery: {
+      escalateAfterFailure: true,
+      diagnosisBeforePatch: true,
+      deepRecoveryFromAttempt: 3,
+    },
     antiHallucination: {
       evidenceFirst: true,
       noCompletionWithoutVerification: mode !== "inline" || risk === "high",