opencode-dejavu 2.2.0 → 2.2.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2.2.1 — 2026-08-24
+
+### Fixed (adversarial-review round)
+- Escalation order: the gate is written to the global store BEFORE being removed from the project store — a crash between the two writes leaves a duplicate (healed by migrate), never a hole.
+- `dejavu:proceed` inside quoted strings no longer bypasses gates (`echo "dejavu:proceed" && gated-cmd` stays enforced); the marker is honored only outside quotes.
+- Concurrent first-encounter race: calls dispatched in the same burst as a REMINDER (within 500ms) are reminded too instead of slipping through as a "retry".
+- CRLF/CR commands normalize identically to LF; `splitChain` splits on CR — no more line-ending fragmentation.
+- `normalizeCommand` is fully idempotent: quoted spans are parameterized BEFORE path rules (a `<str>` substitution inserts spaces that would expose an adjacent `/` to the path rule only on a second pass), fingerprint payloads are trimmed, and already-parameterized payloads are never re-fingerprinted.
+- Interpreter flags glued to their payload (`node -e"code"`) fingerprint identically to the spaced form.
+- Session state maps: inner key sets are capped — long sessions no longer grow unbounded.
+
+### Added
+- Lock degradation (contention > 3s) emits a `degraded` log event — the only window where concurrent writes can lose updates is now visible.
+- `test/property.ts` — property-based tests for the normalization pipeline (idempotency, no nested tokens, output bound, one-liner distinctness, marker neutrality, splitChain atomicity).
+- `test/fuzz.ts` — seeded mutation fuzzer with a metamorphic oracle and case shrinking; both harnesses run in CI. The harnesses caught the idempotency, marker-neutrality, glued-flag and nested-token-detector bugs above before production did.
+
 ## 2.2.0 — 2026-08-23
 
 ### Added

package/README.md

@@ -66,7 +66,7 @@ Restart OpenCode. Gates appear automatically as failures recur — nothing to co
 - **Intended non-zero exits** — exit 1 from diagnostics is NOT a failure (that is their normal "found nothing / found issues" outcome). Exit ≥ 2 always counts.
 - **Aborted ≠ failed** — cancelled/aborted tool executions ("Tool execution aborted") are infrastructure noise and are never counted as failures.
 - **File content is not command output** — text failure signatures are scanned for `bash` only; `read`/`edit`/`write` failures come exclusively from the event channel (a file containing "TypeError" is not a failure).
-- **Concurrency** — gates.json mutations run under an exclusive lockfile; log appends and rotation take their own lock (every OpenCode window shares the global log); writes are tmp+rename with EPERM/EACCES/EBUSY retry (Windows AV/indexer). NT long paths get the `\\?\` prefix.
+- **Concurrency** — gates.json mutations run under an exclusive lockfile; log appends and rotation take their own lock (every OpenCode window shares the global log); writes are tmp+rename with EPERM/EACCES/EBUSY retry (Windows AV/indexer). NT long paths get the `\\?\` prefix. If a lock cannot be acquired within 3s the critical section degrades to unlocked (the tool pipeline must never hang) and emits a `degraded` log event — the only window where updates can be lost is visible.
 - **Near-duplicate consolidation** — new failures merge into existing patterns via normalized Levenshtein ≤ 0.3 with an absolute floor of 3 edits (replaces token Jaccard, which collapsed all `<str>` placeholders; the floor stops `git push` vs `git pull`-style merges).
 - **Bounded memory** — per-session maps are capped (200 sessions) and freed on `session.deleted`; handled part IDs evict FIFO; TTL expiry re-runs every 6 h in long-lived processes.
 - **Migration** — gates outside the blocking policy are demoted to `watching` automatically; project copies of already-global gates are merged into the global gate (evidence is consolidated, never deleted).

package/index.ts

@@ -25,6 +25,12 @@ const TTL_INTERVAL_MS = 6 * 60 * 60 * 1000
 const REVIEW_FIRES = 10
 /** per-session state maps are capped to bound memory in long-lived processes */
 const SESSION_MAP_CAP = 200
+/** per-session key sets are capped too — one long session must not grow unbounded */
+const SESSION_KEY_CAP = 500
+/** a "retry" arriving this soon after a reminder was dispatched concurrently with it
+ * (same tool-call burst) and never saw the reminder — it gets reminded as well.
+ * A true agent retry needs a full model turn (≥1s in practice), so 500ms separates both. */
+const REMINDER_RACE_WINDOW_MS = 500
 /** handled part IDs are capped FIFO-style */
 const HANDLED_CAP = 5000
 const HANDLED_KEEP = 2500
@@ -41,10 +47,15 @@ function addToSetMap(map: Map<string, Set<string>>, outer: string, inner: string
     map.set(outer, set)
   }
   set.add(inner)
+  while (set.size > SESSION_KEY_CAP) {
+    const oldest = set.values().next()
+    if (oldest.done) break
+    set.delete(oldest.value)
+  }
 }
 
 /** Drop oldest entries (Map preserves insertion order) to bound memory. */
-function capMap(map: Map<string, Set<string>>, cap: number): void {
+function capMap<K, V>(map: Map<K, V>, cap: number): void {
   while (map.size > cap) {
     const oldest = map.keys().next()
     if (oldest.done) break
@@ -89,8 +100,8 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
       : null
   const stores = new Stores(globalStore, projectStore)
 
-  /** sessions in which a gate key was already reminded about */
-  const reminded = new Map<string, Set<string>>()
+  /** sessions in which a gate key was already reminded about; value = remind time (race guard) */
+  const reminded = new Map<string, Map<string, number>>()
   /** sessions in which a reminded pattern failed again — next attempt is blocked */
   const failedAfterReminder = new Map<string, Set<string>>()
   /** callID -> signature fallback when the after-hook does not receive args */
@@ -169,7 +180,10 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
         const session = typeof input.sessionID === "string" ? input.sessionID : "unknown"
 
         // Explicit escape hatch — checked only in the actionable text field,
-        // with word boundaries, so unrelated args cannot bypass gates.
+        // with word boundaries, so unrelated args cannot bypass gates. Quoted
+        // spans are stripped first: `echo "dejavu:proceed" && gated-cmd` must
+        // NOT bypass the gate on the chained command — the marker is a
+        // comment-style annotation, not data.
         const commandText =
           typeof rawArgs.command === "string"
             ? rawArgs.command
@@ -178,7 +192,7 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
               : typeof rawArgs.filePath === "string"
                 ? rawArgs.filePath
                 : ""
-        if (/\bdejavu:proceed\b/.test(commandText)) {
+        if (/\bdejavu:proceed\b/.test(commandText.replace(/"[^"]*"|'[^']*'/g, " "))) {
           await stores.logAll({ type: "override", key: gate.key, tool: gate.tool, session, project: directory })
           return
         }
@@ -193,9 +207,16 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
         }
 
         // First encounter this session -> remind (the call is aborted; agent may retry corrected).
-        if (!reminded.get(session)?.has(gate.key)) {
-          addToSetMap(reminded, session, gate.key)
-          addToSetMap(reminded, session, patternKey(signature)) // exact key too: retry may fuzzy-match differently
+        // Race guard: calls dispatched in the same burst all arrive before the agent can
+        // have seen any reminder, so a "retry" within REMINDER_RACE_WINDOW_MS of the
+        // remind is itself a concurrent first encounter and gets reminded too.
+        const sessionReminded = reminded.get(session) ?? new Map<string, number>()
+        if (!reminded.has(session)) reminded.set(session, sessionReminded)
+        const remindedAt = sessionReminded.get(gate.key)
+        if (remindedAt === undefined || Date.now() - remindedAt < REMINDER_RACE_WINDOW_MS) {
+          sessionReminded.set(gate.key, Date.now())
+          sessionReminded.set(patternKey(signature), Date.now()) // exact key too: retry may fuzzy-match differently
+          capMap(sessionReminded, SESSION_KEY_CAP)
           capMap(reminded, SESSION_MAP_CAP)
           gate.remindedCount += 1
           await found.store.save()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-dejavu",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Cross-session memory prosthesis for OpenCode: detects recurring tool-call failures and promotes them into enforced gates. Remind first, block on same-session repeat offense.",
   "type": "module",
   "main": "index.ts",

package/src/AGENTS.md

@@ -24,11 +24,13 @@ Two dependency-free modules: `patterns.ts` (pure functions — call identity, no
 ## INVARIANTS (do not break)
 
 - Rule order in `PARAM_RULES` matters: quoted strings first, specific tokens (uuid/sha/ip/url/date), generic numbers last — reordering fragments signatures
+- Rule order in `normalizeCommand` matters too: quoted strings are parameterized BEFORE path rules — a `<str>` substitution inserts spaces that would expose an adjacent `/` to the path rule on a second pass (idempotency); interpreter payload hashing runs while the payload is still raw
 - `scrubSecrets()` runs on every string before it touches disk; `recordFailure` re-scrubs defensively
 - `canBlock(tool, sig)` = bash && non-diagnostic && not a bare one-liner shape — the ONLY path to `blocking`; probe tools use `PROMOTE_COUNT_PROBE` and never block
 - `DIAGNOSTIC_VERBS` serves two callers (exit-1 allowlist + blocking policy) — one list, two uses; edit knowing both move
 - Lock order is always project → global, gates → index (see `recordFailure` escalation) — reversing deadlocks; the log lock is separate and leaf-level
 - Cross-project evidence lives ONLY in the global `index.json` — a gate's own `projects` array sees one store and never drives escalation alone
+- Escalation writes the global gate FIRST, then removes the project copy — a crash between the two writes must leave a duplicate (healed by migrate), never a hole
 - Inside `runLocked` always `load(true)`; unlocked `load()` peeks are routing hints only, never a basis for mutation
 - `GateStore.load` caches by mtime — after external edits the cache refreshes on next stat; `save()` refreshes it manually
 - Log appends and rotation take the log lock — every OpenCode window shares the global log; unlocked appends interleave into broken JSON

package/src/patterns.ts

@@ -51,16 +51,24 @@ export function scrubSecrets(text: string): string {
  * Secrets are scrubbed before hashing so they neither persist nor fragment.
  */
 const INTERPRETER_ONELINER =
-  /(?:^|[|;&(\n]\s*)(?:\S+[\\/])?(python3?|node|bun|deno|perl|ruby|pwsh|powershell)(?:\.exe)?(?:\s+-\w+)*\s+(-c|-e|--eval|-command)\s+/i
+  /(?:^|[|;&(\n]\s*)(?:\S+[\\/])?(python3?|node|bun|deno|perl|ruby|pwsh|powershell)(?:\.exe)?(?:\s+-\w+)*\s+(-c|-e|--eval|-command)\s*/i
 
 function hashInterpreterPayload(command: string): string {
   const match = INTERPRETER_ONELINER.exec(command)
   if (!match) return command
   const payload = command.slice(match.index + match[0].length)
   if (payload.trim() === "") return command
+  // Already fingerprinted (re-normalization) — keep the existing token so
+  // normalizeCommand stays idempotent.
+  if (/^<code:[0-9a-f]+>$/.test(payload.trim())) return command
+  // Already-parameterized placeholders are data, not code — never hash them
+  // (idempotency: a second pass must not fingerprint a <str>).
+  if (/^(?:<(?:str|path|n|hash|uuid|sha|md5|ip|url|email|date)>\s*)+$/.test(payload.trim())) return command
   // For whole (unchained) commands the payload runs to end of string; chain
   // segments are normalized separately, so segment keys stay exact.
-  const fingerprint = createHash("sha1").update(scrubSecrets(payload)).digest("hex").slice(0, 8)
+  // Trim before hashing: trailing whitespace (e.g. a stripped override marker)
+  // is not part of the code's identity.
+  const fingerprint = createHash("sha1").update(scrubSecrets(payload.trim())).digest("hex").slice(0, 8)
   return `${command.slice(0, match.index + match[0].length)}<code:${fingerprint}>`
 }
 
@@ -70,11 +78,18 @@ function hashInterpreterPayload(command: string): string {
  * away so that "same failure, different instance" collapses into one pattern.
  */
 export function normalizeCommand(command: string): string {
-  let s = command.replace(COMMENT_LINE, "$1").toLowerCase()
+  // CRLF/CR commands (Windows pastes, agent multi-line) normalize to LF —
+  // otherwise the same command fragments across line-ending styles.
+  let s = command.replace(/\r\n?/g, "\n")
+  s = s.replace(COMMENT_LINE, "$1").toLowerCase()
   s = hashInterpreterPayload(s)
+  // Quoted spans come out FIRST: they are data, and removing them before the
+  // path rules keeps normalization idempotent — a <str> replacement inserts
+  // spaces that would otherwise expose an adjacent "/" to the path rule only
+  // on a second pass.
+  s = s.replace(/"[^"]*"|'[^']*'/g, " <str> ")
   s = s.replace(/[a-z]:[\\/][^\s"']+/gi, " <path> ")
   s = s.replace(/(^|\s)\/[^\s"']+/g, "$1<path> ")
-  s = s.replace(/"[^"]*"|'[^']*'/g, " <str> ")
   // lookbehind: never re-parameterize the <code:...> fingerprint hex
   s = s.replace(/(?<!<code:)\b[0-9a-f]{7,64}\b/gi, " <hash> ")
   s = s.replace(/(?<!<code:)\b\d[\d.]*\b/g, " <n> ")
@@ -213,7 +228,7 @@ export function splitChain(command: string): string[] {
       continue
     }
     if (depth === 0) {
-      if (ch === ";" || ch === "\n") {
+      if (ch === ";" || ch === "\n" || ch === "\r") {
         flush()
         i += 1
         continue

package/src/store.ts

@@ -4,7 +4,7 @@ import { canBlock, fuzzySimilar, scrubSecrets } from "./patterns"
 import { coerceGateShape, repairGate } from "./validate"
 
 /** Bumped on behavior changes; stamped into init log events so stale sessions are visible. */
-export const PLUGIN_VERSION = "2.2.0"
+export const PLUGIN_VERSION = "2.2.1"
 
 export interface Gate {
   /** sha1 signature prefix — the pattern identity */
@@ -62,6 +62,7 @@ export type LogEventType =
   | "init"
   | "repaired"
   | "quarantined"
+  | "degraded"
 
 export interface LogEvent {
   type: LogEventType
@@ -137,7 +138,7 @@ const LOCK_WAIT_MS = 3000
  * degradation: if the lock cannot be acquired within LOCK_WAIT_MS the
  * critical section runs unlocked rather than hanging the tool pipeline.
  */
-async function withLock<T>(lockTarget: string, fn: () => Promise<T>): Promise<T> {
+async function withLock<T>(lockTarget: string, fn: () => Promise<T>, onDegrade?: () => void): Promise<T> {
   const lock = `${lockTarget}.lock`
   await mkdir(ntPath(dirname(lock)), { recursive: true })
   const started = Date.now()
@@ -157,7 +158,11 @@ async function withLock<T>(lockTarget: string, fn: () => Promise<T>): Promise<T>
       } catch {
         continue // lock vanished between attempts
       }
-      if (Date.now() - started > LOCK_WAIT_MS) break
+      if (Date.now() - started > LOCK_WAIT_MS) {
+        // The only window where concurrent writes can lose updates — make it visible.
+        if (onDegrade) onDegrade()
+        break
+      }
       await new Promise((resolve) => setTimeout(resolve, 50))
     }
   }
@@ -194,7 +199,9 @@ export class GateStore {
 
   /** Run a load→mutate→save section under the store's exclusive lock. */
   async runLocked<T>(fn: () => Promise<T>): Promise<T> {
-    return withLock(this.gatesPath, fn)
+    return withLock(this.gatesPath, fn, () => {
+      this.log({ type: "degraded", key: "gates.lock", snippet: `lock contention exceeded ${LOCK_WAIT_MS}ms; critical section ran unlocked` }).catch(() => {})
+    })
   }
 
   /**
@@ -273,7 +280,9 @@ export class GateStore {
 
   /** Run an index load→mutate→save section under the index's own lock. */
   async runLockedIndex<T>(fn: () => Promise<T>): Promise<T> {
-    return withLock(this.indexPath, fn)
+    return withLock(this.indexPath, fn, () => {
+      this.log({ type: "degraded", key: "index.lock", snippet: `lock contention exceeded ${LOCK_WAIT_MS}ms; critical section ran unlocked` }).catch(() => {})
+    })
   }
 
   /**
@@ -776,9 +785,8 @@ export class Stores {
 
       let wentGlobal = false
       if (store !== this.globalStore && this.projectStore && indexProjects >= input.globalProjects) {
-        const idx = gates.findIndex((g) => g.key === moved.key)
-        if (idx >= 0) gates.splice(idx, 1)
-        await store.save()
+        // Global FIRST, then remove the local copy: a crash between the two
+        // writes must leave a duplicate (healed by migrate), never a hole.
         await this.globalStore.runLocked(async () => {
           const globalGates = await this.globalStore.load(true)
           const existing = globalGates.find((g) => g.key === moved.key)
@@ -789,6 +797,9 @@ export class Stores {
           }
           await this.globalStore.save()
         })
+        const idx = gates.findIndex((g) => g.key === moved.key)
+        if (idx >= 0) gates.splice(idx, 1)
+        await store.save()
         wentGlobal = true
       }
 

package/src/validate.ts

@@ -97,11 +97,11 @@ export function repairGate(gate: Gate): boolean {
 }
 
 /**
- * Corruption fingerprint of tokens re-parameterized inside other tokens
- * (e.g. `<code: <n> >` — a fingerprint eaten by the number rule). Such a
- * signature is stable under re-normalization, so only an explicit shape
- * check catches it.
+ * Corruption fingerprint of a placeholder re-parameterized inside another
+ * token (`<code: <n> >` — a fingerprint eaten by the number rule). Only the
+ * `<code:` token carries nested content, so the check is scoped to it —
+ * shell text like heredoc `<<eof:` must NOT trip the detector.
  */
 export function hasNestedTokens(signature: string): boolean {
-  return /<[a-z]+:\s*</.test(signature)
+  return /<code:\s*</.test(signature)
 }