opencode-immune 1.0.75 → 1.0.77

package/dist/plugin/server.js

@@ -3777,7 +3777,7 @@ import { fileURLToPath } from "url";
 import { createHash } from "crypto";
 import { tmpdir } from "os";
 import { execFile } from "child_process";
-var PLUGIN_VERSION = "1.0.75";
+var PLUGIN_VERSION = "1.0.77";
 var PLUGIN_PACKAGE_NAME = "opencode-immune";
 var PLUGIN_DIRNAME = dirname(fileURLToPath(import.meta.url));
 function getServerAuthHeaders() {
@@ -3852,7 +3852,6 @@ function createState(input) {
     providerRetryWatchdogs: /* @__PURE__ */ new Map(),
     childFallbackRequests: /* @__PURE__ */ new Map(),
     sessionErrorRetryCount: /* @__PURE__ */ new Map(),
-    ultraworkPermissionSessions: /* @__PURE__ */ new Set(),
     fallbackAgentByAgent: /* @__PURE__ */ new Map(),
     baseAgentByFallbackAgent: /* @__PURE__ */ new Map(),
     fallbackModelCandidates: [],
@@ -3889,23 +3888,6 @@ function createState(input) {
   };
 }
 var ULTRAWORK_AGENT = "0-ultrawork";
-var ULTRAWORK_SESSION_PERMISSION = [
-  { permission: "read", pattern: "*", action: "allow" },
-  { permission: "edit", pattern: "*", action: "allow" },
-  { permission: "glob", pattern: "*", action: "allow" },
-  { permission: "grep", pattern: "*", action: "allow" },
-  { permission: "list", pattern: "*", action: "allow" },
-  { permission: "bash", pattern: "*", action: "allow" },
-  { permission: "task", pattern: "*", action: "allow" },
-  { permission: "external_directory", pattern: "*", action: "allow" },
-  { permission: "todowrite", pattern: "*", action: "allow" },
-  { permission: "question", pattern: "*", action: "allow" },
-  { permission: "webfetch", pattern: "*", action: "allow" },
-  { permission: "websearch", pattern: "*", action: "allow" },
-  { permission: "codesearch", pattern: "*", action: "allow" },
-  { permission: "lsp", pattern: "*", action: "allow" },
-  { permission: "skill", pattern: "*", action: "allow" }
-];
 var DIAGNOSTIC_LOG_MAX_BYTES = 5 * 1024 * 1024;
 var activeLogDirectory = null;
 var MANAGED_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
@@ -3913,6 +3895,8 @@ var PROVIDER_RETRY_WATCHDOG_MS = 3e4;
 var RETRY_PROMPT_DELIVERY_ATTEMPTS = 3;
 var CHILD_FALLBACK_REQUEST_TTL_MS = 10 * 60 * 1e3;
 var AUTO_CYCLE_LOCK_TTL_MS = 30 * 60 * 1e3;
+var PROJECT_TMP_RELATIVE_PATH = ".opencode/tmp";
+var PROJECT_LOG_RELATIVE_PATH = ".opencode/state/logs";
 var MODEL_NAME_CAPABILITY_SCORE = {
   "claude-opus-4-7": 100,
   "gpt-5.5": 100,
@@ -3932,11 +3916,16 @@ function isManagedRootUltraworkSession(state, sessionID) {
   const record = getManagedSession(state, sessionID);
   return !!record && record.kind === "root";
 }
+function getProjectTmpDir(state) {
+  return join(state.input.directory, PROJECT_TMP_RELATIVE_PATH);
+}
+function getProjectLogDir(state) {
+  return join(state.input.directory, PROJECT_LOG_RELATIVE_PATH);
+}
 async function createManagedUltraworkSession(state, title) {
   const result = await state.client.session.create({
     directory: state.input.directory,
-    title,
-    permission: ULTRAWORK_SESSION_PERMISSION
+    title
   });
   if (result.error || !result.response.ok) {
     throw new Error(
@@ -3984,31 +3973,7 @@ async function startAutoCycleInNewSession(state, options) {
     state.autoResumeInFlight = false;
   }
 }
-async function applyUltraworkSessionPermissions(state, sessionID) {
-  if (state.ultraworkPermissionSessions.has(sessionID)) return;
-  try {
-    const result = await state.client.session.update({
-      directory: state.input.directory,
-      sessionID,
-      permission: ULTRAWORK_SESSION_PERMISSION
-    });
-    if (result.error || !result.response.ok) {
-      pluginLog.warn(
-        `[opencode-immune] Failed to apply ultrawork permissions to session ${sessionID}:`,
-        result.error ?? result.response.status
-      );
-      return;
-    }
-    state.ultraworkPermissionSessions.add(sessionID);
-  } catch (err) {
-    pluginLog.warn(
-      `[opencode-immune] Failed to apply ultrawork permissions to session ${sessionID}:`,
-      err
-    );
-  }
-}
 async function promptManagedSession(state, sessionID, text, options = {}) {
-  await applyUltraworkSessionPermissions(state, sessionID);
   const result = await state.client.session.promptAsync({
     directory: state.input.directory,
     sessionID,
@@ -4149,7 +4114,6 @@ async function addManagedUltraworkSession(state, sessionID, timestamp = Date.now
     return;
   }
   state.managedUltraworkSessions.set(sessionID, nextRecord);
-  await applyUltraworkSessionPermissions(state, sessionID);
 }
 async function addManagedChildSession(state, sessionID, parentSessionID, timestamp = Date.now()) {
   const parent = state.managedUltraworkSessions.get(parentSessionID);
@@ -4202,7 +4166,6 @@ async function removeManagedUltraworkSession(state, sessionID, reason) {
   cancelPendingSessionRetry(state, sessionID, reason);
   cancelProviderRetryWatchdog(state, sessionID, reason);
   state.sessionErrorRetryCount.delete(sessionID);
-  state.ultraworkPermissionSessions.delete(sessionID);
   const existed = state.managedUltraworkSessions.delete(sessionID);
   if (!existed) return;
   writePluginLog(
@@ -5110,6 +5073,104 @@ async function fileHash(filePath) {
     return "";
   }
 }
+function parseImmunePluginSpec(value) {
+  const trimmed = value.trim();
+  const match = trimmed.match(/^opencode-immune(?:@(.+))?$/);
+  if (!match) return null;
+  return {
+    spec: trimmed,
+    version: match[1] ?? null
+  };
+}
+async function readProjectImmunePluginSpec(directory) {
+  try {
+    const raw = await readFile(join(directory, "opencode.json"), "utf-8");
+    const config = JSON.parse(raw);
+    const plugins = Array.isArray(config.plugin) ? config.plugin : [];
+    for (let index = plugins.length - 1; index >= 0; index--) {
+      const value = plugins[index];
+      if (typeof value !== "string") continue;
+      const parsed = parseImmunePluginSpec(value);
+      if (parsed) return parsed;
+    }
+  } catch {
+  }
+  return null;
+}
+function execFileAsync(command, args, options) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, options ?? {}, (err, stdout, stderr) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      resolve({ stdout, stderr });
+    });
+  });
+}
+async function clearProjectPluginOverride(directory) {
+  const overridePath = join(directory, ".opencode", "opencode.json");
+  try {
+    const raw = await readFile(overridePath, "utf-8");
+    const config = JSON.parse(raw);
+    const keys = Object.keys(config ?? {});
+    const plugins = Array.isArray(config.plugin) ? config.plugin : [];
+    const isGeneratedVersionPin = plugins.length === 1 && typeof plugins[0] === "string" && /^opencode-immune@.+$/.test(plugins[0]) && keys.every((key) => key === "plugin" || key === "$schema");
+    if (!isGeneratedVersionPin) {
+      return false;
+    }
+    await unlink(overridePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function installPinnedProjectPlugin(state, pluginSpec) {
+  if (!pluginSpec.version) return false;
+  const currentVersion = await getPluginVersion();
+  if (pluginSpec.version === currentVersion) {
+    const overrideRemoved = await clearProjectPluginOverride(state.input.directory);
+    if (overrideRemoved) {
+      pluginLog.info(
+        `[opencode-immune] Harness sync: removed stale local plugin override after confirming ${pluginSpec.spec}.`
+      );
+    }
+    return false;
+  }
+  try {
+    pluginLog.info(
+      `[opencode-immune] Harness sync: installing ${pluginSpec.spec} in ${state.input.directory}`
+    );
+    await execFileAsync("opencode", ["plugin", pluginSpec.spec, "--force"], {
+      cwd: state.input.directory,
+      env: process.env
+    });
+    const overrideRemoved = await clearProjectPluginOverride(state.input.directory);
+    if (overrideRemoved) {
+      pluginLog.info(
+        `[opencode-immune] Harness sync: removed local plugin override after installing ${pluginSpec.spec}.`
+      );
+    }
+    state.pluginUpdateMessage = `[PLUGIN UPDATE] Harness synced this project to ${pluginSpec.spec}. Restart opencode to load the new plugin version.`;
+    await writeDiagnosticLog(state, "harness-sync:plugin-install", {
+      pluginSpec: pluginSpec.spec,
+      status: "installed"
+    });
+    return true;
+  } catch (err) {
+    pluginLog.warn(
+      `[opencode-immune] Harness sync: automatic install failed for ${pluginSpec.spec}.`,
+      err instanceof Error ? err.message : String(err)
+    );
+    state.pluginUpdateMessage = `[PLUGIN UPDATE] Harness synced this project to ${pluginSpec.spec}, but automatic install failed. Run \`opencode plugin ${pluginSpec.spec} --force\` in this project, then restart opencode.`;
+    await writeDiagnosticLog(state, "harness-sync:plugin-install", {
+      pluginSpec: pluginSpec.spec,
+      status: "failed",
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return false;
+  }
+}
 async function syncHarness(state) {
   const token = await resolveEnvValue(state.input.directory, HARNESS_TOKEN_ENV);
   if (!token) {
@@ -5160,19 +5221,36 @@ async function syncHarness(state) {
         release.tagName + "\n",
         "utf-8"
       );
+      const projectPluginSpec = await readProjectImmunePluginSpec(state.input.directory);
+      const pluginInstalled = projectPluginSpec ? await installPinnedProjectPlugin(state, projectPluginSpec) : false;
+      if (!projectPluginSpec) {
+        const overrideRemoved = await clearProjectPluginOverride(state.input.directory);
+        if (overrideRemoved) {
+          pluginLog.info(
+            `[opencode-immune] Harness sync: removed local plugin override to keep project config authoritative.`
+          );
+        }
+      }
       const hashAfter = await fileHash(configPath);
       if (hashBefore && hashAfter && hashBefore !== hashAfter) {
         pluginLog.warn(
           `[opencode-immune] \u26A0 Harness sync: opencode.json was updated. Please restart opencode for the new agent configuration to take effect.`
         );
       }
+      if (pluginInstalled) {
+        pluginLog.warn(
+          `[opencode-immune] \u26A0 Harness sync: installed updated plugin from project config. Restart opencode to load the new plugin code.`
+        );
+      }
       pluginLog.info(
         `[opencode-immune] Harness sync: successfully updated to ${release.tagName}`
       );
       await writeDiagnosticLog(state, "harness-sync:success", {
         from: localVersion,
         to: release.tagName,
-        configChanged: hashBefore !== hashAfter
+        configChanged: hashBefore !== hashAfter,
+        pluginSpec: projectPluginSpec?.spec ?? null,
+        pluginInstalled
       });
     } finally {
       try {
@@ -5968,17 +6046,59 @@ function createPermissionAskHandler(state) {
       state.recoveryContext = recovery;
       await addManagedUltraworkSession(state, sessionID);
       pluginLog.info(
-        `[opencode-immune] Permission request recovered AUTO-RESUME session ${sessionID}; applying managed ultrawork auto-allow.`
+        `[opencode-immune] Permission request recovered AUTO-RESUME session ${sessionID}; tracking as managed ultrawork session.`
       );
     }
-    output.status = "allow";
-    await writeDiagnosticLog(state, "permission:auto-allow", {
+    const permissionType = getPermissionType(input);
+    const patterns = getPermissionPatterns(input);
+    if (isManagedUltraworkSession(state, sessionID) && permissionType === "external_directory" && patterns.some(isExternalTmpPattern)) {
+      output.status = "deny";
+      await writeDiagnosticLog(state, "permission:auto-deny-external-tmp", {
+        sessionID,
+        status: output.status,
+        permission: permissionType,
+        patterns,
+        projectTmpDir: getProjectTmpDir(state),
+        projectLogDir: getProjectLogDir(state)
+      });
+      return;
+    }
+    await writeDiagnosticLog(state, "permission:ask", {
       sessionID,
-      permission: input.permission,
-      patterns: input.patterns
+      status: output.status,
+      permission: permissionType,
+      patterns
     });
   };
 }
+function getPermissionType(input) {
+  if (!input || typeof input !== "object") return void 0;
+  const value = input;
+  return typeof value.type === "string" ? value.type : typeof value.permission === "string" ? value.permission : void 0;
+}
+function getPermissionPatterns(input) {
+  if (!input || typeof input !== "object") return [];
+  const value = input;
+  const source = value.pattern ?? value.patterns;
+  if (Array.isArray(source)) return source.filter((item) => typeof item === "string");
+  return typeof source === "string" ? [source] : [];
+}
+function isExternalTmpPattern(pattern) {
+  return pattern === "/tmp" || pattern.startsWith("/tmp/") || pattern === "/tmp/*";
+}
+function createShellEnvHandler(state) {
+  return async (_input, output) => {
+    const projectTmpDir = getProjectTmpDir(state);
+    const projectLogDir = getProjectLogDir(state);
+    await mkdir(projectTmpDir, { recursive: true });
+    await mkdir(projectLogDir, { recursive: true });
+    output.env.TMPDIR = projectTmpDir;
+    output.env.TMP = projectTmpDir;
+    output.env.TEMP = projectTmpDir;
+    output.env.OPENCODE_TMP_DIR = projectTmpDir;
+    output.env.OPENCODE_LOG_DIR = projectLogDir;
+  };
+}
 async function server(input) {
   const state = createState(input);
   checkPluginUpdate(state).catch(() => {
@@ -6118,6 +6238,11 @@ async function server(input) {
       state,
       "permission.ask",
       createPermissionAskHandler(state)
+    ),
+    "shell.env": withErrorBoundary(
+      state,
+      "shell.env",
+      createShellEnvHandler(state)
     )
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-immune",
-  "version": "1.0.75",
+  "version": "1.0.77",
   "type": "module",
   "description": "OpenCode plugin: session recovery, auto-retry, multi-cycle automation, context monitoring",
   "exports": {
@@ -12,7 +12,7 @@
     "dist/plugin/server.js"
   ],
   "scripts": {
-    "build": "esbuild plugin.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/plugin/server.js",
+    "build": "esbuild plugin.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/plugin/server.js && esbuild plugin.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/plugin.js",
     "dev": "node ./node_modules/typescript/bin/tsc --project tsconfig.json --watch",
     "prepublishOnly": "npm run build"
   },