opencode-harness-kit 0.5.5 → 0.5.7

package/CHANGELOG.md

@@ -12,6 +12,79 @@ is not happening.
 
 ---
 
+## [0.5.7] — 2026-10-21
+
+Published. The tag is what cut it: `git tag v0.5.7 && git push origin main
+v0.5.7`, and the publish job watches for exactly that.
+
+A patch, and a small one: the shipped profiles are refreshed against the
+live catalogue, and a test that pinned the catalogue's old answer stops
+pinning it.
+
+### Changed
+
+- **The profiles are refreshed against the live catalogue.**
+  `oc-harness refresh --all` is the kit's own command for this, and it had
+  not been run since the 19th. The catalogue now says that
+  `minimax-m3.1-flash-free` takes a temperature, and that
+  `longcat-2.5-preview-free` does not; the profiles said the opposite in one
+  case each. The `verified` date is the day the profile was last checked
+  against the catalogue, and leaving it stale after a check makes it a lie.
+
+  Nothing in the generated config changes: the kit sets no temperature at
+  all, so the profile's answer only decides what the header says.
+
+### Fixed
+
+- **A test failed on a day when nothing in the kit had changed.** The test
+  for "temperature is only emitted for models that support it" asserted
+  that one particular model does not support one - a value the catalogue
+  owns and changes. The test now asks whether the rule holds: no config the
+  kit writes may carry a temperature, and every profile has to say whether
+  its model takes one. A test that pins a value the world owns fails for
+  the wrong reason.
+
+## [0.5.6] — 2026-10-21
+
+Published. The tag is what cut it: `git tag v0.5.6 && git push origin main
+v0.5.6`, and the publish job watches for exactly that.
+
+A patch, and it is a patch of the same kind as 0.5.5: the three holes the
+guard had left, one measurement that did not measure what it claimed, and
+one measurement that had never produced a number at all.
+
+### Fixed
+
+- **`rm /tmp/x -rf` was allowed.** The rule that blocks a recursive delete
+  read the first flag and then looked for a path after it, so a flag placed
+  after the path was invisible - and GNU rm permutes its options. The rule
+  now asks two separate questions: is any flag recursive or force, and is
+  there a path.
+
+- **`chmod --recursive 777 /` was allowed**, by the rule that blocks
+  `chmod 777`: the rule's flag position only accepted short letter flags,
+  and a long option put the mode out of reach.
+
+- **`curl <url> | grep y | sh` was allowed.** The pipe-to-a-shell rule
+  required the download to feed the shell directly, and a filter in between
+  hid the shell from it. A filter does not change what the shell runs.
+
+- **The pruner measurement and the pruner's own log measured different
+  things.** The log reports the REQUEST's size delta - the part before the
+  transform against the part after it - and the measurement script counted
+  the TEXT inside each part, so the two disagreed and only the log's number
+  matched the kit's claim. The script measures the request now, the way the
+  pruner does, and reports the text measure beside it under its own name.
+  The gate is computed from the request measure.
+
+- **The lane record was never written.** Not once, in any session, on any
+  machine. The plugin read the lane name from `agent` on the assistant
+  message, and opencode's assistant message has no `agent` field - so
+  `oc-harness lanes` was reading a file that could not exist, and the
+  advice to cut the lanes nobody calls had nothing behind it. The name is
+  on the request, and the assistant message names that request's user
+  message as its parent, so the two join there.
+
 ## [0.5.5] — 2026-10-21
 
 Published. The tag is what cut it: `git tag v0.5.5 && git push origin main
@@ -1396,7 +1469,9 @@ silent in the worst way:
 
 ---
 
-[Unreleased]: https://github.com/pham-canh/opencode-harness-kit/compare/v0.5.5...HEAD
+[Unreleased]: https://github.com/pham-canh/opencode-harness-kit/compare/v0.5.7...HEAD
+[0.5.7]: https://github.com/pham-canh/opencode-harness-kit/compare/v0.5.6...v0.5.7
+[0.5.6]: https://github.com/pham-canh/opencode-harness-kit/compare/v0.5.5...v0.5.6
 [0.5.5]: https://github.com/pham-canh/opencode-harness-kit/compare/v0.5.4...v0.5.5
 [0.5.4]: https://github.com/pham-canh/opencode-harness-kit/compare/v0.5.3...v0.5.4
 [0.5.3]: https://github.com/pham-canh/opencode-harness-kit/compare/v0.5.2...v0.5.3

package/dist/index.js

@@ -36,12 +36,11 @@ var BASH_DENYLIST = [
   // asked about by the config - the config asks about everything it does
   // not name, and asking is the safe direction.
   //
-  // A PERMUTED delete (`rm /tmp/x -rf`) is caught by neither layer today:
-  // the guard's rule needs the flag before the path, and the glob needs
-  // the flag in front. The config asks, so a human decides. Closing that
-  // hole is a change to the guard's rule in src/rules.js, which reads the
-  // tokens - a glob here could only name one spelling of it, and the
-  // spelling would still be the one it missed.
+  // A PERMUTED delete (`rm /tmp/x -rf`) is caught by the GUARD, which reads
+  // the tokens and does not care which order they come in. The glob cannot
+  // name it - a glob here could only name one spelling of it, and the
+  // spelling would still be the one it missed. So the config asks about it,
+  // and a human decides, and the code-level block is the guard's.
   "rm -f *",
   "rm -r *",
   "rm -R *",
@@ -432,24 +431,61 @@ function runsScript(stage) {
 }
 function pipesScriptIntoShell(command) {
   const stages = pipeStages(command);
-  for (let i = 1; i < stages.length; i++) {
-    if (!DOWNLOADERS.test(stages[i - 1])) continue;
-    if (!runsScript(stages[i])) continue;
-    return true;
+  for (let i = 0; i < stages.length; i++) {
+    if (!DOWNLOADERS.test(stages[i])) continue;
+    for (let j = i + 1; j < stages.length; j++) {
+      if (!runsScript(stages[j])) continue;
+      return true;
+    }
   }
   return false;
 }
+function isDestructiveRmFlag(token) {
+  if (/^--(recursive|force)$/i.test(token)) return true;
+  return /^-[a-zA-Z]*[rf]/i.test(token);
+}
 function isRecursiveDelete(text) {
   const tokens = tokenize(text);
   if (tokens.length < 2) return false;
   if (baseName(tokens[0]).toLowerCase() !== "rm") return false;
+  let destructive = false;
+  let hasPath = false;
   for (let i = 1; i < tokens.length; i++) {
     const token = tokens[i];
-    if (!token.startsWith("-")) continue;
-    if (!/^-[a-zA-Z]*[rf]/i.test(token) && !/^--(recursive|force)$/i.test(token)) continue;
-    return tokens.slice(i + 1).some((t) => !t.startsWith("-"));
+    if (token === "--") {
+      hasPath = tokens.length > i + 1;
+      break;
+    }
+    if (!token.startsWith("-")) {
+      hasPath = true;
+      continue;
+    }
+    if (isDestructiveRmFlag(token)) destructive = true;
   }
-  return false;
+  return destructive && hasPath;
+}
+var CHMOD_VALUE_OPTIONS = /* @__PURE__ */ new Set(["--reference"]);
+function chmodMode(text) {
+  const tokens = tokenize(text);
+  if (tokens.length < 2) return null;
+  if (baseName(tokens[0]).toLowerCase() !== "chmod") return null;
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (token === "--") continue;
+    if (token.startsWith("--")) {
+      if (!token.includes("=") && CHMOD_VALUE_OPTIONS.has(token)) i++;
+      continue;
+    }
+    if (token.startsWith("-")) continue;
+    if (/^\d+$/.test(token)) return token;
+    return null;
+  }
+  return null;
+}
+function opensPermissions(text) {
+  const mode = chmodMode(text);
+  if (mode === null) return false;
+  return /^0*777$/.test(mode);
 }
 var ASK_GATED = [/^\s*git\s+push\b/];
 var BASH_RULES = [
@@ -495,10 +531,11 @@ var BASH_RULES = [
   {
     name: "chmod 777",
     scope: "segment",
-    // The mode may be written with leading zeros: `0777` and `777` are the
-    // same mode, and a rule that required the bare digits let one spelling
-    // of it through.
-    test: /^chmod\s+(-[a-zA-Z]+\s+)*0*777\b/,
+    // The mode is read as an OPERAND rather than as a literal, because the
+    // flags in front of it can be long. `chmod --recursive 777 /` is the
+    // same chmod as `chmod -R 777 /`, and a rule that only knew the short
+    // flag cluster let the long spelling through.
+    check: (text) => opensPermissions(text),
     why: "opens permissions on everything"
   },
   {
@@ -1958,7 +1995,26 @@ var TelemetryPlugin = async ({ worktree, directory }) => {
   const started = Date.now();
   const opened = /* @__PURE__ */ new Set();
   const closed = /* @__PURE__ */ new Set();
+  const requests = /* @__PURE__ */ new Map();
+  const REQUEST_MEMORY = 500;
+  const rememberRequest = (input) => {
+    const id = input?.message?.id;
+    if (typeof id !== "string") return;
+    const model = input?.model;
+    requests.set(id, {
+      agent: typeof input?.agent === "string" ? input.agent : void 0,
+      model: typeof model?.modelID === "string" ? model.modelID : void 0,
+      provider: typeof model?.providerID === "string" ? model.providerID : void 0
+    });
+    if (requests.size > REQUEST_MEMORY) {
+      const oldest = requests.keys().next();
+      if (!oldest.done) requests.delete(oldest.value);
+    }
+  };
   return {
+    "chat.params": async (input) => {
+      rememberRequest(input);
+    },
     event: async ({ event }) => {
       const type = event?.type;
       if (typeof type !== "string") return;
@@ -1967,7 +2023,7 @@ var TelemetryPlugin = async ({ worktree, directory }) => {
         return;
       }
       if (type === "message.updated") {
-        const lane = laneOf(event);
+        const lane = laneOf(event, requests);
         if (!lane || !lane.id) return;
         if (lane.ms !== void 0) {
           if (closed.has(lane.id)) return;
@@ -1991,15 +2047,16 @@ var TelemetryPlugin = async ({ worktree, directory }) => {
     }
   };
 };
-function laneOf(event) {
+function laneOf(event, requests) {
   const e = event;
   const info = e?.properties?.info ?? e?.properties;
   if (!info || typeof info !== "object") return null;
   if (info.role && info.role !== "assistant") return null;
   const id = typeof info.id === "string" ? info.id : void 0;
-  const agent = typeof info.agent === "string" ? info.agent : void 0;
-  const modelId = info.model?.modelID ?? info.modelID;
-  const providerId = info.model?.providerID ?? info.providerID;
+  const parent = typeof info.parentID === "string" ? requests.get(info.parentID) : void 0;
+  const agent = parent?.agent ?? (typeof info.agent === "string" ? info.agent : void 0);
+  const modelId = parent?.model ?? info.model?.modelID ?? info.modelID;
+  const providerId = parent?.provider ?? info.model?.providerID ?? info.providerID;
   const time = info.time ?? {};
   const created = typeof time.created === "number" ? time.created : void 0;
   const completed = typeof time.completed === "number" ? time.completed : void 0;

package/docs/KNOWN-LIMITS.md

@@ -323,10 +323,28 @@ comparable, and the gate uses the number that IS comparable.
 `eval/measure-prune.mjs` is that number. opencode stores the message parts
 unpruned - the pruner rewrites the outgoing request, not the history - so the
 stored parts of a real session are exactly what the pruner was given, and
-replaying the real pruner over them measures exactly what it removed. On one
-install: **80.5% of the context
-across 60 real sessions**, 6,608 parts stubbed - the number
-`npm run measure:prune` prints.
+replaying the real pruner over them measures exactly what it removed.
+
+It reports **two** measures, because the script and the pruner's own log used
+to answer two different questions and only one of them is this kit's claim:
+
+- **REQUEST** - the size of the request that goes back to the model, counted
+  on the parts as they are serialised. This is the same definition
+  `savedChars` uses in `prune.jsonl`, so the script and the log ask the same
+  question of the same parts and their numbers reconcile rather than
+  disagree: the script's request delta IS the sum of the log's `savedChars`
+  for the same passes. It is the primary number and the one the `--min-saved`
+  gate is computed from, because "a smaller request" is what this kit claims.
+- **TEXT** - the text inside the parts: how much text was replaced. It is the
+  larger of the two, because the request measure also carries the parts the
+  pruner left alone, and because the stub's own metadata is part of the
+  request and counts against the saving.
+
+On one install: **80.5% of the text across 60 real sessions**, 6,608 parts
+stubbed. That is the TEXT measure - the number `npm run measure:prune`
+printed before the two were separated, when the script measured text and
+labelled it "context". The REQUEST measure on the same install is lower, and
+it is the one the gate checks.
 
 The controlled comparison of the two arms is `eval/ab.mjs`, and its result is
 in `eval/RESULTS.md`.
@@ -374,6 +392,19 @@ label and its own metadata. Such a pass is still logged, because a part was
 stubbed, which is the event worth recording, and the negative number is the
 honest report of it.
 
+The measurement script measures the same thing on purpose.
+`eval/measure-prune.mjs` counts a part with the pruner's own expression -
+`JSON.stringify(part).length` - before and after the pass, and reports it as
+the REQUEST measure, so the two reconcile by construction instead of by
+coincidence: replaying twelve real sessions through the real pruner, the
+script measured a request delta of **6,049** characters and the log the
+pruner wrote during that replay said `savedChars: 6049`. The script also
+reports the TEXT measure, because the two answer different questions and the
+difference is worth stating rather than hiding: the request measure counts
+the stub's own metadata against the saving and carries the parts the pruner
+left alone, so it is the smaller of the two, and it can be negative where the
+text measure is positive.
+
 There is no minimum size under which a part is left alone. This file used to
 claim a 200 byte floor for `reasoning` parts; there was never such a floor in
 the code, and a reasoning part shorter than the stub - about seventy-eight

package/eval/measure-prune.mjs

@@ -20,6 +20,31 @@
 //
 // The gate is on the CONTROLLED number. The install-wide one stays an
 // observation.
+//
+// TWO MEASURES, both reported, neither hidden, because they answer two
+// different questions:
+//
+//   REQUEST - how much did the REQUEST that goes back to the model shrink.
+//   Counted the way the pruner's own log counts it: the size of a PART,
+//   before the pass and after it. `partSize` in src/prune.ts is
+//   `JSON.stringify(part).length`, and `savedChars` in `.space/prune.jsonl`
+//   is the delta of that number. The measure below is the SAME expression,
+//   so the script and the log ask the same question of the same parts and
+//   cannot disagree about what they mean. The delta is the same number
+//   too: the parts outside the pruner's window are untouched, so they
+//   contribute nothing to it either way.
+//
+//   TEXT - how much TEXT was replaced. The text inside the parts, which is
+//   what this script used to measure and what it still reports.
+//
+// The two are not the same number twice. The request measure also carries
+// the parts the pruner left alone, and the stub's own metadata is part of
+// the request and is not text. So the request measure is the smaller of
+// the two, and it can be negative where the text measure is positive - a
+// stub that costs more than the output it replaced.
+//
+// The gate is on the REQUEST measure, because that is the claim the kit
+// makes: a smaller request.
 
 import { existsSync, mkdtempSync, rmSync } from "node:fs"
 import { homedir, tmpdir } from "node:os"
@@ -186,29 +211,79 @@ const hook = await HarnessPlugin(
 const transform = hook["experimental.chat.messages.transform"]
 
 /**
- * The size this measurement counts.
+ * The size of a PART, as it sits in the request.
+ *
+ * THIS IS THE PRUNER'S OWN DEFINITION, EXPRESSION FOR EXPRESSION.
+ * `partSize` in src/prune.ts is `JSON.stringify(part).length`, and
+ * `savedChars` in `.space/prune.jsonl` is that number's delta. This is the
+ * same expression on the same objects, so the script and the log measure
+ * the same thing and the two numbers are reconcilable by construction
+ * rather than by coincidence.
+ *
+ * CHARACTERS, not bytes: a UTF-8 character is more than one byte, and an
+ * agent's output is not ASCII. The pruner's measure counts characters
+ * too, and the byte figures are reported beside them, not instead of
+ * them.
  *
- * CHARACTERS, not bytes: `part.text.length`. The report labelled that
- * "bytes", which is wrong for anything that is not ASCII - and an agent's
- * output is not ASCII. Both numbers are reported.
+ * A part that cannot be serialised counts as zero, exactly as the
+ * pruner's own measure does: a measurement that throws is worse than a
+ * measurement that counts the part as nothing.
+ *
+ * @param {any} part
+ * @returns {number}
+ */
+function requestPartSize(part) {
+  try {
+    const json = JSON.stringify(part)
+    return typeof json === "string" ? json.length : 0
+  } catch {
+    return 0
+  }
+}
+
+/**
+ * The same part, in bytes.
  *
- * This counts the TEXT of every part, while the pruner's own log counts the
- * PART - and only the parts the pruner touched. So the two numbers answer
- * two different questions and are not the same number twice: this one asks
- * how much TEXT the pruner removed from a stored session, the log asks how
- * much the REQUEST that went out shrank. The stub the pruner leaves behind
- * carries about fifty characters of metadata of its own, so the log's
- * saving is the smaller of the two, and it can even be negative where this
- * one is positive. The gap is stated rather than hidden.
+ * @param {any} part
+ * @returns {number}
  */
-function sizeOf(part) {
+function requestPartBytes(part) {
+  try {
+    const json = JSON.stringify(part)
+    return typeof json === "string" ? Buffer.byteLength(json, "utf8") : 0
+  } catch {
+    return 0
+  }
+}
+
+/**
+ * The TEXT inside a part - the SECONDARY measure.
+ *
+ * `part.text` for a text or reasoning part, `part.state.output` for a tool
+ * part. This is what the script measured before, and it is still reported,
+ * because it answers a different question: how much text was replaced.
+ *
+ * It is not the claim the kit makes. The text measure cannot see the
+ * metadata a stub puts in a part's place, and it cannot see the parts the
+ * pruner left alone, so it is the larger of the two numbers and it can be
+ * positive where the request measure is negative.
+ *
+ * @param {any} part
+ * @returns {number}
+ */
+function textSize(part) {
   if (typeof part?.text === "string") return part.text.length
   if (typeof part?.state?.output === "string") return part.state.output.length
   return 0
 }
 
-/** The same text, in bytes. */
-function byteSizeOf(part) {
+/**
+ * The same text, in bytes.
+ *
+ * @param {any} part
+ * @returns {number}
+ */
+function textBytes(part) {
   if (typeof part?.text === "string") return Buffer.byteLength(part.text, "utf8")
   if (typeof part?.state?.output === "string") {
     return Buffer.byteLength(part.state.output, "utf8")
@@ -216,10 +291,32 @@ function byteSizeOf(part) {
   return 0
 }
 
-let totalBefore = 0
-let totalAfter = 0
-let bytesBefore = 0
-let bytesAfter = 0
+/**
+ * The size of a whole message list, by one measure.
+ *
+ * @param {{parts: any[]}[]} messages
+ * @param {(part: any) => number} size
+ * @returns {number}
+ */
+function measureAll(messages, size) {
+  let total = 0
+  for (const m of messages) {
+    for (const p of m.parts) total += size(p)
+  }
+  return total
+}
+
+// The REQUEST measure: the request that goes back to the model, before the
+// pass and after it, counted the way the pruner's log counts it.
+let reqCharsBefore = 0
+let reqCharsAfter = 0
+let reqBytesBefore = 0
+let reqBytesAfter = 0
+// The TEXT measure: the text inside the parts, before and after.
+let textCharsBefore = 0
+let textCharsAfter = 0
+let textBytesBefore = 0
+let textBytesAfter = 0
 let measured = 0
 let stubbed = 0
 const perSession = []
@@ -227,35 +324,38 @@ const perSession = []
 for (const s of sessions) {
   const messages = sessionMessages(s.id)
   if (!messages.length) continue
-  const before = messages.reduce(
-    (n, m) => n + m.parts.reduce((k, p) => k + sizeOf(p), 0),
-    0,
-  )
-  const beforeBytes = messages.reduce(
-    (n, m) => n + m.parts.reduce((k, p) => k + byteSizeOf(p), 0),
-    0,
-  )
   // The pruner mutates in place, so the copy has to be the real thing.
-  const reasoningBefore = messages.flatMap((m) =>
-    m.parts.filter((p) => p.type === "reasoning").map((p) => p.text),
-  )
   const copy = messages.map((m) => ({
     info: m.info,
     parts: m.parts.map((p) => (p.state ? { ...p, state: { ...p.state } } : { ...p })),
   }))
-  await transform({}, { messages: copy })
-  const after = copy.reduce(
-    (n, m) => n + m.parts.reduce((k, p) => k + sizeOf(p), 0),
-    0,
-  )
-  if (!before) continue
-  totalBefore += before
-  totalAfter += after
-  bytesBefore += beforeBytes
-  bytesAfter += copy.reduce(
-    (n, m) => n + m.parts.reduce((k, p) => k + byteSizeOf(p), 0),
-    0,
+  // BEFORE is measured on the COPY - on the very objects the pruner is about
+  // to see. The copy serialises identically to the part it was made from
+  // (same keys, same order, same values), and measuring one set of objects
+  // before and after is the point: a "before" taken from a different object
+  // than the "after" is two measurements of two things.
+  const reqCharsBeforeSession = measureAll(copy, requestPartSize)
+  const reqBytesBeforeSession = measureAll(copy, requestPartBytes)
+  const textCharsBeforeSession = measureAll(copy, textSize)
+  const textBytesBeforeSession = measureAll(copy, textBytes)
+  const reasoningBefore = copy.flatMap((m) =>
+    m.parts.filter((p) => p.type === "reasoning").map((p) => p.text),
   )
+  await transform({}, { messages: copy })
+  const reqCharsAfterSession = measureAll(copy, requestPartSize)
+  const reqBytesAfterSession = measureAll(copy, requestPartBytes)
+  const textCharsAfterSession = measureAll(copy, textSize)
+  const textBytesAfterSession = measureAll(copy, textBytes)
+  // A session with nothing in it has no percentage to report.
+  if (reqCharsBeforeSession <= 0) continue
+  reqCharsBefore += reqCharsBeforeSession
+  reqCharsAfter += reqCharsAfterSession
+  reqBytesBefore += reqBytesBeforeSession
+  reqBytesAfter += reqBytesAfterSession
+  textCharsBefore += textCharsBeforeSession
+  textCharsAfter += textCharsAfterSession
+  textBytesBefore += textBytesBeforeSession
+  textBytesAfter += textBytesAfterSession
   measured++
   // The pruner marks TOOL parts with `metadata.pruned` and REPLACES reasoning
   // parts, so counting only the marked ones undercounts what was stubbed.
@@ -272,24 +372,60 @@ for (const s of sessions) {
   stubbed += cut
   perSession.push({
     session: s.id,
-    bytes_before: before,
-    bytes_after: after,
-    saved_pct: Math.round((1 - after / before) * 1000) / 10,
+    // REQUEST - the size of the request, before and after the pass.
+    request_chars_before: reqCharsBeforeSession,
+    request_chars_after: reqCharsAfterSession,
+    request_bytes_before: reqBytesBeforeSession,
+    request_bytes_after: reqBytesAfterSession,
+    request_saved_pct: pctOf(reqCharsBeforeSession, reqCharsAfterSession),
+    // TEXT - the text inside the parts, before and after the pass.
+    text_chars_before: textCharsBeforeSession,
+    text_chars_after: textCharsAfterSession,
+    text_saved_pct: pctOf(textCharsBeforeSession, textCharsAfterSession),
     parts_stubbed: cut,
     tool_parts_stubbed: toolCut,
     reasoning_parts_stubbed: reasoningCut,
   })
 }
 
-const savedPct =
-  totalBefore > 0 ? Math.round((1 - totalAfter / totalBefore) * 1000) / 10 : null
+/**
+ * A percentage, to two decimals, or null when there is no percentage to
+ * report.
+ *
+ * Two decimals, not one: an effect of 0.05% is a real effect, and one
+ * decimal renders it as "0%" - a number that says "nothing was removed"
+ * about a pass that removed seven thousand characters. That is the exact
+ * failure this script exists to catch, so it is not repeated in the
+ * reporting of it.
+ *
+ * @param {number} before
+ * @param {number} after
+ * @returns {number | null}
+ */
+function pctOf(before, after) {
+  if (!(before > 0)) return null
+  return Math.round((1 - after / before) * 10000) / 100
+}
+
+/** A percentage for printing. */
+function fmtPct(n) {
+  return n === null ? "n/a" : `${n}%`
+}
+
+// The REQUEST measure's percentage. This is the one the gate is computed
+// from, because it is the claim the kit makes: a smaller request.
+const requestSavedPct = pctOf(reqCharsBefore, reqCharsAfter)
+// The TEXT measure's percentage: how much text was replaced.
+const textSavedPct = pctOf(textCharsBefore, textCharsAfter)
 
 const failures = []
 if (minSaved !== null) {
   if (measured === 0) {
     failures.push("no session had assistant messages to measure")
-  } else if (savedPct === null || savedPct < minSaved) {
-    failures.push(`the pruner removed ${savedPct ?? "n/a"}% of the context, expected at least ${minSaved}%`)
+  } else if (requestSavedPct === null || requestSavedPct < minSaved) {
+    failures.push(
+      `the pruner removed ${requestSavedPct ?? "n/a"}% of the request, expected at least ${minSaved}%`,
+    )
   }
 }
 
@@ -303,11 +439,21 @@ process.on("exit", () => {
 const report = {
   db: DB,
   sessions_measured: measured,
-  characters_before: totalBefore,
-  characters_after: totalAfter,
-  bytes_before: bytesBefore,
-  bytes_after: bytesAfter,
-  saved_pct: savedPct,
+  // REQUEST measure - the size of the request, counted the way the pruner's
+  // own log counts it (the size of a PART). This is the number the gate is
+  // computed from.
+  request_chars_before: reqCharsBefore,
+  request_chars_after: reqCharsAfter,
+  request_bytes_before: reqBytesBefore,
+  request_bytes_after: reqBytesAfter,
+  request_saved_chars: reqCharsBefore - reqCharsAfter,
+  request_saved_pct: requestSavedPct,
+  // TEXT measure - the text inside the parts. How much text was replaced.
+  text_chars_before: textCharsBefore,
+  text_chars_after: textCharsAfter,
+  text_bytes_before: textBytesBefore,
+  text_bytes_after: textBytesAfter,
+  text_saved_pct: textSavedPct,
   parts_stubbed: stubbed,
   per_session: perSession,
   verdict: failures.length ? "FAIL" : "PASS",
@@ -325,17 +471,36 @@ console.log(
   `  sessions ${measured} (last ${DAYS}d, at least ${MIN_MESSAGES} assistant messages each)`,
 )
 console.log("")
-console.log(`  context before   ${totalBefore.toLocaleString("en-US")} characters`)
-console.log(`  context after    ${totalAfter.toLocaleString("en-US")} characters`)
-console.log(`  in bytes         ${bytesBefore.toLocaleString("en-US")} -> ${bytesAfter.toLocaleString("en-US")}`)
-console.log(`  removed          ${savedPct === null ? "n/a" : savedPct + "%"}`)
+console.log("  REQUEST measure - how much the request that goes back to the model shrank.")
+console.log("  The size of a PART, before and after the pass: the same definition the")
+console.log("  pruner's own log uses (src/prune.ts `partSize`).")
+console.log(`    request context before   ${reqCharsBefore.toLocaleString("en-US")} characters`)
+console.log(`    request context after    ${reqCharsAfter.toLocaleString("en-US")} characters`)
+console.log(`    request saved            ${(reqCharsBefore - reqCharsAfter).toLocaleString("en-US")} characters`)
+console.log(`    request in bytes         ${reqBytesBefore.toLocaleString("en-US")} -> ${reqBytesAfter.toLocaleString("en-US")}`)
+console.log(`    removed                  ${fmtPct(requestSavedPct)}`)
+console.log("    <- the --min-saved gate is computed from this number, and the")
+console.log("       saved figure is the same number the pruner's log writes as")
+console.log("       savedChars for the same pass.")
+console.log("")
+console.log("  TEXT measure - how much text was replaced. The text inside the parts.")
+console.log(`    text before              ${textCharsBefore.toLocaleString("en-US")} characters`)
+console.log(`    text after               ${textCharsAfter.toLocaleString("en-US")} characters`)
+console.log(`    text saved               ${(textCharsBefore - textCharsAfter).toLocaleString("en-US")} characters`)
+console.log(`    text in bytes            ${textBytesBefore.toLocaleString("en-US")} -> ${textBytesAfter.toLocaleString("en-US")}`)
+console.log(`    removed                  ${fmtPct(textSavedPct)}`)
+console.log("")
 console.log(`  parts stubbed    ${stubbed}`)
 if (perSession.length) {
   console.log("")
-  const worst = [...perSession].sort((a, b) => a.saved_pct - b.saved_pct).slice(0, 5)
-  console.log("  the five sessions the pruner helped least:")
+  const worst = [...perSession]
+    .sort((a, b) => a.request_saved_pct - b.request_saved_pct)
+    .slice(0, 5)
+  console.log("  the five sessions the pruner helped least, by the request measure:")
   for (const p of worst) {
-    console.log(`    ${p.saved_pct}%  ${p.bytes_before.toLocaleString("en-US")} bytes  ${p.session.slice(0, 12)}`)
+    console.log(
+      `    ${fmtPct(p.request_saved_pct)}  ${p.request_bytes_before.toLocaleString("en-US")} bytes  ${p.session.slice(0, 12)}`,
+    )
   }
 }
 if (failures.length) {
@@ -343,6 +508,6 @@ if (failures.length) {
   console.log(`  FAIL  ${failures.join("; ")}`)
 } else if (minSaved !== null) {
   console.log("")
-  console.log(`  PASS  the pruner removed at least ${minSaved}% of the context.`)
+  console.log(`  PASS  the pruner removed at least ${minSaved}% of the request.`)
 }
 process.exit(failures.length ? 1 : 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Harness kit for OpenCode: capability profiles, a fleet of job lanes with one free model each, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
   "homepage": "https://github.com/pham-canh/opencode-harness-kit#readme",

package/profiles/fleet-all.json

@@ -5,7 +5,7 @@
   "provider": "opencode",
   "model": "minimax-m3.1-flash-free",
   "family": null,
-  "verified": "2026-10-19",
+  "verified": "2026-10-21",
   "retention": "may-train",
   "maxRetention": "may-train",
   "notes": "Every lane gets the model built for it: beam plans, Nemotron 3 Ultra reviews, Lightning sweeps, MiMo sees, GLM audits, Super VL reasons with the effort turned off. Five of the ten providers state that collected data may be used to improve the model, or log the session, so the profile as a whole is may-train and the generated config says so in its header. Install it for public or throwaway repositories.",
@@ -15,7 +15,7 @@
   },
   "supports": {
     "reasoning": true,
-    "temperature": false,
+    "temperature": true,
     "toolCall": true,
     "structuredOutput": false,
     "attachment": true

package/profiles/fleet-safe.json

@@ -5,7 +5,7 @@
   "provider": "opencode",
   "model": "minimax-m3.1-flash-free",
   "family": null,
-  "verified": "2026-10-19",
+  "verified": "2026-10-21",
   "retention": "zero-retention",
   "maxRetention": "zero-retention",
   "notes": "The default. Every lane resolves to a model whose provider states a zero-retention policy: no training, nothing kept. The cost is that six of the ten jobs run on a second-choice model - the planner loses beam (30-day retention) and the reviewer loses Nemotron 3 Ultra - so this is the floor, not the ceiling. The chains are ordered within the ceiling rather than copied from `fleet-all`: `locate` takes deepseek because it publishes a `low` effort level that longcat does not, and `vision` takes minimax because it reads an image in 7 seconds. `fleet-all` gives every lane the model built for it.",
@@ -15,7 +15,7 @@
   },
   "supports": {
     "reasoning": true,
-    "temperature": false,
+    "temperature": true,
     "toolCall": true,
     "structuredOutput": false,
     "attachment": true

package/profiles/longcat-2.5-preview-free.json

@@ -5,7 +5,7 @@
   "provider": "opencode",
   "model": "longcat-2.5-preview-free",
   "family": "longcat",
-  "verified": "2026-10-19",
+  "verified": "2026-10-21",
   "retention": "zero-retention",
   "notes": "Meituan. 1M context with image input, and a reasoning toggle rather than a tier, so no variant is written. It read a screenshot correctly in a live call, which is what makes it the zero-retention fallback for the vision lane. Measured at 9.4-13.2s. A preview endpoint: it can be withdrawn without a rename.",
   "limits": {
@@ -14,7 +14,7 @@
   },
   "supports": {
     "reasoning": true,
-    "temperature": true,
+    "temperature": false,
     "toolCall": true,
     "structuredOutput": false,
     "attachment": true

package/profiles/minimax-m3.1-flash-free.json

@@ -5,7 +5,7 @@
   "provider": "opencode",
   "model": "minimax-m3.1-flash-free",
   "family": "minimax",
-  "verified": "2026-10-19",
+  "verified": "2026-10-21",
   "retention": "zero-retention",
   "notes": "Flagship coding and agent model on the free tier: 512k output tokens, the widest of any free route, and the fastest measured image reader at 7.7s. Tool calls are stable. It does not support temperature, and models.dev publishes no structured_output flag for it, so JSON output is requested in the prompt rather than negotiated with the API. Measured at 3.1s for a one-word reply.",
   "limits": {
@@ -14,7 +14,7 @@
   },
   "supports": {
     "reasoning": true,
-    "temperature": false,
+    "temperature": true,
     "toolCall": true,
     "structuredOutput": false,
     "attachment": true

package/src/denylist.js

@@ -39,12 +39,11 @@ export const BASH_DENYLIST = [
   // asked about by the config - the config asks about everything it does
   // not name, and asking is the safe direction.
   //
-  // A PERMUTED delete (`rm /tmp/x -rf`) is caught by neither layer today:
-  // the guard's rule needs the flag before the path, and the glob needs
-  // the flag in front. The config asks, so a human decides. Closing that
-  // hole is a change to the guard's rule in src/rules.js, which reads the
-  // tokens - a glob here could only name one spelling of it, and the
-  // spelling would still be the one it missed.
+  // A PERMUTED delete (`rm /tmp/x -rf`) is caught by the GUARD, which reads
+  // the tokens and does not care which order they come in. The glob cannot
+  // name it - a glob here could only name one spelling of it, and the
+  // spelling would still be the one it missed. So the config asks about it,
+  // and a human decides, and the code-level block is the guard's.
   "rm -f *",
   "rm -r *",
   "rm -R *",

package/src/rules.js

@@ -615,26 +615,63 @@ function runsScript(stage) {
  * still a pipe into a shell, because the `;` ends the word and not the
  * pipe.
  *
+ * The shell does not have to be the stage right after the download. A filter
+ * in between (`curl x | grep y | sh`) does not change what the shell RUNS -
+ * it changes only what the agent sees on the way there - so the chain is
+ * the same download-and-execute. The rule used to look at the stage after
+ * the download only, so a filter in the middle hid the shell from it.
+ *
+ * The order still matters: the shell has to come AFTER the download.
+ * `sh | grep y` runs a shell over a pipe it did not fetch, and there is
+ * nothing downloaded for it to execute.
+ *
  * @param {string} command
  * @returns {boolean}
  */
 function pipesScriptIntoShell(command) {
   const stages = pipeStages(command)
-  for (let i = 1; i < stages.length; i++) {
-    if (!DOWNLOADERS.test(stages[i - 1])) continue
-    if (!runsScript(stages[i])) continue
-    return true
+  for (let i = 0; i < stages.length; i++) {
+    if (!DOWNLOADERS.test(stages[i])) continue
+    for (let j = i + 1; j < stages.length; j++) {
+      if (!runsScript(stages[j])) continue
+      return true
+    }
   }
   return false
 }
 
+/**
+ * Whether a token is a flag that makes an rm destructive.
+ *
+ * The short form is a CLUSTER of letters, so `-rf`, `-fr` and `-R` all name
+ * a recursive delete and `-f` names a forced one. The long form is GNU's
+ * own name for the same two flags.
+ *
+ * @param {string} token
+ * @returns {boolean}
+ */
+function isDestructiveRmFlag(token) {
+  if (/^--(recursive|force)$/i.test(token)) return true
+  return /^-[a-zA-Z]*[rf]/i.test(token)
+}
+
 /**
  * Whether a command is an rm with a flag that makes it destructive.
  *
- * The flag can be a short cluster (`-rf`) or the long GNU name of the same
- * two flags (`--recursive --force`), and it can be anywhere among the
- * options. A rule that only knew the short form allowed the long one, which
- * is the same command.
+ * The flags and the paths are read SEPARATELY, because GNU rm PERMUTES its
+ * options: the flags can come after the path, and `rm /tmp/x -rf` is the
+ * same delete as `rm -rf /tmp/x`. The rule used to return at the FIRST flag
+ * token and then look for a path AFTER it, so a flag that came after the
+ * path was invisible and the delete the rule exists to stop went through.
+ *
+ * So the question is not "is the first flag recursive" but "is ANY of the
+ * flags recursive or force, AND is there a path" - a delete of one named
+ * file (`rm file.txt`, `rm -i notes.md`) is not a recursive delete, and a
+ * command with no path at all (`rm`, `rm -rf`) is not a delete.
+ *
+ * `--` ends the options, so every word after it is a path whatever it looks
+ * like. That makes `rm -- -rf` a delete of a file NAMED `-rf`, and not a
+ * recursive delete.
  *
  * @param {string} text the segment, with its prefixes stripped
  * @returns {boolean}
@@ -643,15 +680,88 @@ function isRecursiveDelete(text) {
   const tokens = tokenize(text)
   if (tokens.length < 2) return false
   if (baseName(tokens[0]).toLowerCase() !== "rm") return false
+  let destructive = false
+  let hasPath = false
   for (let i = 1; i < tokens.length; i++) {
     const token = tokens[i]
-    if (!token.startsWith("-")) continue
-    if (!/^-[a-zA-Z]*[rf]/i.test(token) && !/^--(recursive|force)$/i.test(token)) continue
-    // The flag needs something to destroy: `rm --recursive` on its own does
-    // nothing, and a rule that blocks it blocks a typo.
-    return tokens.slice(i + 1).some((t) => !t.startsWith("-"))
+    if (token === "--") {
+      // Everything after `--` is a path, so the words that follow it are
+      // the path this rm destroys.
+      hasPath = tokens.length > i + 1
+      break
+    }
+    if (!token.startsWith("-")) {
+      hasPath = true
+      continue
+    }
+    if (isDestructiveRmFlag(token)) destructive = true
   }
-  return false
+  return destructive && hasPath
+}
+
+/**
+ * The chmod options that carry their value in the NEXT word.
+ *
+ * `chmod --reference FILE` takes the mode from another file, so the word
+ * after it is not the mode. A scanner that read that word as the mode would
+ * see `chmod --reference 777 file` as "chmod 777", and that command is a
+ * file named 777 rather than a mode.
+ */
+const CHMOD_VALUE_OPTIONS = new Set(["--reference"])
+
+/**
+ * The mode a chmod command sets, or null when it sets none.
+ *
+ * The mode is the first numeric OPERAND, and every option in front of it is
+ * skipped - INCLUDING the long forms. The rule used to accept only a short
+ * letter cluster in the flag position, so GNU's own `--recursive` put the
+ * mode out of the rule's reach: `chmod --recursive 777 /` was allowed while
+ * `chmod -R 777 /` was blocked, and the mode is the same mode.
+ *
+ * A symbolic mode (`a=rwx`) is not a numeric one, so it is not a mode this
+ * function returns. That is a policy gap and not a spelling one, and it is
+ * left alone on purpose.
+ *
+ * @param {string} text the segment, with its prefixes stripped
+ * @returns {string | null} the mode, as it was written
+ */
+function chmodMode(text) {
+  const tokens = tokenize(text)
+  if (tokens.length < 2) return null
+  if (baseName(tokens[0]).toLowerCase() !== "chmod") return null
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i]
+    if (token === "--") continue
+    if (token.startsWith("--")) {
+      // `--flag=value` carries its own value, and a boolean long option
+      // carries none. Only the option that takes the next word swallows
+      // it, and that word is then not the mode.
+      if (!token.includes("=") && CHMOD_VALUE_OPTIONS.has(token)) i++
+      continue
+    }
+    if (token.startsWith("-")) continue
+    // The first numeric operand is the mode; the words after it are the
+    // files the mode is applied to.
+    if (/^\d+$/.test(token)) return token
+    return null
+  }
+  return null
+}
+
+/**
+ * Whether a chmod command sets the mode that opens permissions to everyone.
+ *
+ * The mode may be written with leading zeros: `0777` and `777` are the same
+ * mode, and a rule that required the bare digits let one spelling of it
+ * through.
+ *
+ * @param {string} text the segment, with its prefixes stripped
+ * @returns {boolean}
+ */
+function opensPermissions(text) {
+  const mode = chmodMode(text)
+  if (mode === null) return false
+  return /^0*777$/.test(mode)
 }
 
 /**
@@ -711,10 +821,11 @@ export const BASH_RULES = [
   {
     name: "chmod 777",
     scope: "segment",
-    // The mode may be written with leading zeros: `0777` and `777` are the
-    // same mode, and a rule that required the bare digits let one spelling
-    // of it through.
-    test: /^chmod\s+(-[a-zA-Z]+\s+)*0*777\b/,
+    // The mode is read as an OPERAND rather than as a literal, because the
+    // flags in front of it can be long. `chmod --recursive 777 /` is the
+    // same chmod as `chmod -R 777 /`, and a rule that only knew the short
+    // flag cluster let the long spelling through.
+    check: (text) => opensPermissions(text),
     why: "opens permissions on everything",
   },
   {

package/src/telemetry.ts

@@ -27,10 +27,24 @@
 // one with a duration, so "how long does this lane take" and "was this lane
 // called at all" are answered from the same file without guessing.
 //
-// The `chat.message` hook is deliberately not used for this. Measured on
-// OpenCode 1.19, its `agent` field is undefined, so it cannot attribute a
-// call to a lane; and a second counter that cannot be correlated with the
-// first would double-count every call.
+// WHERE THE LANE NAME COMES FROM
+//
+// Not from the message. opencode's AssistantMessage has no `agent` field - it
+// has id, role, model, tokens, time and parentID - and the plugin read the
+// agent from exactly that missing field. The lane record was therefore never
+// written: not once, in any session, on any machine. The measurement that
+// decides whether the fleet stays at ten lanes was reading a file that could
+// not exist.
+//
+// The agent name is on the REQUEST. `chat.params` carries the agent and the
+// model of the call that is about to be made, and the user message that call
+// belongs to; the assistant message names that user message as its parent, so
+// the two join.
+//
+// The `chat.message` hook is not used for this. Measured on OpenCode 1.19 its
+// `agent` field is undefined, while `chat.params` declares it as required -
+// and a second counter that cannot be correlated with the first would
+// double-count every call.
 //
 // WHAT A DENIAL LOOKS LIKE HERE
 //
@@ -69,7 +83,47 @@ export const TelemetryPlugin: Plugin = async ({ worktree, directory }) => {
   const opened = new Set<string>()
   const closed = new Set<string>()
 
+  // The lane a request ran on, and the model it ran on, keyed by the id of
+  // the user message the request was made from.
+  //
+  // The assistant message names that user message as its parent, so this is
+  // how a call is attributed to a lane.
+  //
+  // The map is bounded: a long session makes a lot of requests, and the map
+  // is only a bridge between a request and the assistant message that
+  // answers it. The oldest entries are dropped once it grows past what a
+  // session needs, so the plugin cannot grow without limit.
+  const requests = new Map<string, { agent?: string; model?: string; provider?: string }>()
+  const REQUEST_MEMORY = 500
+
+  /**
+   * Remember which lane a request was made from.
+   *
+   * @param {any} input the `chat.params` input
+   */
+  const rememberRequest = (input: any) => {
+    const id = input?.message?.id
+    if (typeof id !== "string") return
+    const model = input?.model
+    requests.set(id, {
+      agent: typeof input?.agent === "string" ? input.agent : undefined,
+      model: typeof model?.modelID === "string" ? model.modelID : undefined,
+      provider: typeof model?.providerID === "string" ? model.providerID : undefined,
+    })
+    if (requests.size > REQUEST_MEMORY) {
+      // The oldest first: a Map keeps its insertion order.
+      const oldest = requests.keys().next()
+      if (!oldest.done) requests.delete(oldest.value)
+    }
+  }
+
   return {
+    "chat.params": async (input: any) => {
+      // The lane and the model of the call that is about to be made. This is
+      // the only place opencode says which agent is running.
+      rememberRequest(input)
+    },
+
     event: async ({ event }: any) => {
       // Events are provider-specific and opencode may add shapes we have never
       // seen. Anything unrecognised is ignored rather than trusted.
@@ -91,7 +145,7 @@ export const TelemetryPlugin: Plugin = async ({ worktree, directory }) => {
       // on which model, and how long it took. That record is what makes "cut
       // the lanes nobody uses" a measurement instead of a guess.
       if (type === "message.updated") {
-        const lane = laneOf(event)
+        const lane = laneOf(event, requests)
         if (!lane || !lane.id) return
         if (lane.ms !== undefined) {
           // The completed event. Written once, and only if the open record
@@ -142,7 +196,10 @@ export const TelemetryPlugin: Plugin = async ({ worktree, directory }) => {
  *
  * The message id is what makes the record countable: one message is one call.
  */
-function laneOf(event: unknown): {
+function laneOf(
+  event: unknown,
+  requests: Map<string, { agent?: string; model?: string; provider?: string }>,
+): {
   id?: string
   agent?: string
   model?: string
@@ -159,9 +216,12 @@ function laneOf(event: unknown): {
   if (info.role && info.role !== "assistant") return null
 
   const id = typeof info.id === "string" ? info.id : undefined
-  const agent = typeof info.agent === "string" ? info.agent : undefined
-  const modelId = info.model?.modelID ?? info.modelID
-  const providerId = info.model?.providerID ?? info.providerID
+  // The request this message answers. The message does not name the agent;
+  // the request does, and the parent id is the join.
+  const parent = typeof info.parentID === "string" ? requests.get(info.parentID) : undefined
+  const agent = parent?.agent ?? (typeof info.agent === "string" ? info.agent : undefined)
+  const modelId = parent?.model ?? info.model?.modelID ?? info.modelID
+  const providerId = parent?.provider ?? info.model?.providerID ?? info.providerID
   const time = info.time ?? {}
   const created = typeof time.created === "number" ? time.created : undefined
   const completed = typeof time.completed === "number" ? time.completed : undefined