opencode-api-security-testing 5.4.1 → 5.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-api-security-testing",
-  "version": "5.4.1",
+  "version": "5.4.3",
   "description": "API Security Testing Plugin for OpenCode - Automated vulnerability scanning and penetration testing",
   "type": "module",
   "main": "src/index.ts",

package/src/index.ts

@@ -334,6 +334,40 @@ const CYBER_SUPERVISOR = DEFAULT_CONFIG.cyber_supervisor;
 const modelFailureCounts = new Map<string, Map<string, number>>();
 const sessionFailures = new Map<string, number>();
 
+// 首条消息追踪 (参考 oh-my-opencode 的 FirstMessageVariantGate 模式)
+const pendingFirstMessages = new Set<string>();
+const injectedSessions = new Set<string>();
+
+// 标记新会话创建（由 event hook 调用）
+function markSessionCreated(sessionID: string | undefined): void {
+  if (sessionID) {
+    pendingFirstMessages.add(sessionID);
+    console.log(`[api-security-testing] Session marked for first message injection: ${sessionID}`);
+  }
+}
+
+// 检查是否是首条消息（由 chat.message hook 调用）
+function isFirstMessage(sessionID: string | undefined): boolean {
+  if (!sessionID) return false;
+  return pendingFirstMessages.has(sessionID);
+}
+
+// 标记首条消息已处理（由 chat.message hook 调用，注入后立即调用）
+function markFirstMessageApplied(sessionID: string | undefined): void {
+  if (sessionID) {
+    pendingFirstMessages.delete(sessionID);
+    injectedSessions.add(sessionID); // 记录已注入
+  }
+}
+
+// 清理会话状态（由 event hook 在 session.deleted 时调用）
+function clearSessionState(sessionID: string | undefined): void {
+  if (sessionID) {
+    pendingFirstMessages.delete(sessionID);
+    injectedSessions.delete(sessionID);
+  }
+}
+
 function getConfigPath(ctx: { directory: string }): string {
   return join(ctx.directory, SKILL_DIR, "assets", CONFIG_FILE);
 }
@@ -1266,20 +1300,25 @@ print(json.dumps(result, ensure_ascii=False))
     },
 
     // 赛博监工 Hook - chat.message
+    // 参考 oh-my-opencode 的 FirstMessageVariantGate 模式：只在首条消息注入一次
     "chat.message": async (input, output) => {
       const sessionID = input.sessionID;
       
-      // 注入 agents prompt（首次）
-      const agentsPrompt = getInjectedAgentsPrompt();
-      if (agentsPrompt) {
-        const parts = output.parts as Array<{ type: string; text?: string }>;
-        const textPart = parts.find(p => p.type === "text");
-        if (textPart && textPart.text) {
-          textPart.text += agentsPrompt;
+      // 只在首条消息时注入 agents prompt (参考 oh-my-opencode 的 firstMessageVariantGate)
+      if (isFirstMessage(sessionID)) {
+        const agentsPrompt = getInjectedAgentsPrompt();
+        if (agentsPrompt) {
+          const parts = output.parts as Array<{ type: string; text?: string }>;
+          const textPart = parts.find(p => p.type === "text");
+          if (textPart && textPart.text) {
+            textPart.text += agentsPrompt;
+          }
         }
+        // 标记该 session 已注入 (参考 oh-my-opencode 的 markApplied)
+        markFirstMessageApplied(sessionID);
       }
       
-      // 赛博监工压力注入
+      // 赛博监工压力注入（仅在失败时）
       if (config.cyber_supervisor.enabled && config.cyber_supervisor.auto_trigger) {
         const failures = getFailureCount(sessionID);
         if (failures > 0 && failures <= config.cyber_supervisor.max_retries) {
@@ -1353,10 +1392,22 @@ ${LEVEL_PROMPTS[level]}
       return output;
     },
 
-    // 会话清理
+    // 会话事件处理
     event: async (input) => {
       const { event } = input;
 
+      // 新会话创建 - 标记为首条消息待注入 (参考 oh-my-opencode)
+      if (event.type === "session.created") {
+        const props = event.properties as Record<string, unknown> | undefined;
+        const sessionInfo = props?.info as { id?: string; parentID?: string } | undefined;
+        // 只有主会话（非 fork）才注入
+        if (sessionInfo?.id && !sessionInfo.parentID) {
+          markSessionCreated(sessionInfo.id);
+          console.log(`[api-security-testing] New session created: ${sessionInfo.id}`);
+        }
+      }
+
+      // 会话删除或压缩 - 清理状态
       if (event.type === "session.deleted" || event.type === "session.compacted") {
         const props = event.properties as Record<string, unknown> | undefined;
         let sessionID: string | undefined;
@@ -1368,6 +1419,7 @@ ${LEVEL_PROMPTS[level]}
         }
 
         if (sessionID) {
+          clearSessionState(sessionID);
           resetFailureCount(sessionID);
           resetModelFailures(sessionID);
         }