opencode-muse 0.1.0 → 0.1.1

package/README.md

@@ -16,7 +16,7 @@ Add the published package to your project-level `opencode.jsonc` (or
 ```jsonc
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugins": ["opencode-muse@0.1.0"],
+  "plugins": ["opencode-muse@0.1.1"],
 }
 ```
 
@@ -117,5 +117,6 @@ setup placeholder rather than advertising a model that will fail on use.
 
 ## Related projects
 
-- [opencode-muse-auth](https://github.com/TheStreamCode/opencode-muse-auth) lets OpenCode use a Muse Code subscription by extracting the credentials (API key) embedded in that subscription. Unsure this abides by the Muse Code subscription ToS (issue #12](https://github.com/TheStreamCode/opencode-muse-auth/issues/12)).
-- [Official Muse Code documenation](https://dev.meta.ai/docs/quickstart#agent-setup), describing how to use the Muse models in OpenCode via API key (a lot more expensive)
+- [opencode-muse-auth](https://github.com/TheStreamCode/opencode-muse-auth) is another credential-extraction/direct-API approach; see its [issue #12](https://github.com/TheStreamCode/opencode-muse-auth/issues/12) for its discussion of subscription-term concerns.
+- [opencode-muse-code](https://github.com/swalker326/opencode-muse-code) is an unofficial direct-API alternative. It reads the Muse CLI login, requests an API key from Meta, and sends model requests to Meta's API from OpenCode instead of routing inference through `muse serve` and MSP. Its subscription eligibility is separate from this plugin's CLI-mediated approach and has not been established by this project.
+- [Official Muse Code documentation](https://dev.meta.ai/docs/quickstart#agent-setup) describes using Muse models in OpenCode through the Meta API.

package/dist/session/registry.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
-import { closeSync, chmodSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { closeSync, chmodSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readlinkSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
+import { dirname, isAbsolute, join, posix, win32 } from "node:path";
 import { RegistryCorruptError, RegistryStorageError, RegistryValidationError, RegistryWorkspaceMismatchError, } from "../errors.js";
 const REGISTRY_VERSION = 1;
 const MAX_ENTRY_BYTES = 1_048_576;
@@ -9,29 +9,82 @@ const HASH_PATTERN = /^[a-f0-9]{64}$/;
 const UUID_V7_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-7[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
 const IDENTIFIER_PATTERN = /^[A-Za-z0-9._:@+_-]{1,512}$/;
 const METHOD_PATTERN = /^[a-z][A-Za-z0-9]*(?:\/[A-Za-z][A-Za-z0-9]*)+$/;
+const MAX_PATH_SYMLINKS = 40;
+/** Resolve existing path components while retaining a normalized not-yet-created suffix. */
+function canonicalPath(path, platform) {
+    const pathApi = platform === "win32" ? win32 : posix;
+    if (platform !== process.platform)
+        return pathApi.resolve(path);
+    const absolute = pathApi.resolve(path);
+    const root = pathApi.parse(absolute).root;
+    let current = root;
+    let remaining = absolute.slice(root.length).split(pathApi.sep).filter(Boolean);
+    let followedSymlinks = 0;
+    while (remaining.length > 0) {
+        const [component, ...rest] = remaining;
+        const candidate = pathApi.join(current, component);
+        let stats;
+        try {
+            stats = lstatSync(candidate);
+        }
+        catch (error) {
+            // A missing component ends filesystem traversal; normalize the remaining suffix lexically.
+            if (isMissingFile(error))
+                return pathApi.resolve(current, ...remaining);
+            throw new RegistryValidationError();
+        }
+        if (stats.isSymbolicLink()) {
+            followedSymlinks += 1;
+            if (followedSymlinks > MAX_PATH_SYMLINKS)
+                throw new RegistryValidationError();
+            let target;
+            try {
+                target = readlinkSync(candidate);
+            }
+            catch {
+                throw new RegistryValidationError();
+            }
+            const absoluteTarget = pathApi.isAbsolute(target)
+                ? pathApi.resolve(target)
+                : pathApi.resolve(current, target);
+            const targetRoot = pathApi.parse(absoluteTarget).root;
+            current = targetRoot;
+            remaining = [
+                ...absoluteTarget.slice(targetRoot.length).split(pathApi.sep).filter(Boolean),
+                ...rest,
+            ];
+            continue;
+        }
+        try {
+            current = realpathSync(candidate);
+        }
+        catch {
+            throw new RegistryValidationError();
+        }
+        remaining = rest;
+    }
+    return pathApi.resolve(current);
+}
 /** Refuse a caller-selected state root inside Muse's CLI-owned config directory. */
 export function assertSafeStateDirectory(path, options = {}) {
     const env = options.env ?? process.env;
     const homeDirectory = options.homeDirectory ?? homedir();
     const platform = options.platform ?? process.platform;
     const windows = platform === "win32";
-    const pathJoin = windows ? win32.join : join;
-    const pathResolve = windows ? win32.resolve : resolve;
-    const pathRelative = windows ? win32.relative : relative;
-    const pathSeparator = windows ? win32.sep : sep;
-    const pathIsAbsolute = windows ? win32.isAbsolute : isAbsolute;
+    const pathApi = windows ? win32 : posix;
     const configuredHome = env.XDG_CONFIG_HOME;
-    const configHome = requiredString(configuredHome) && pathIsAbsolute(configuredHome)
+    const configHome = requiredString(configuredHome) && pathApi.isAbsolute(configuredHome)
         ? configuredHome
-        : pathJoin(homeDirectory, ".config");
-    const museConfigDirectory = pathResolve(pathJoin(configHome, "muse"));
-    const relativePath = pathRelative(museConfigDirectory, pathResolve(path));
+        : pathApi.join(homeDirectory, ".config");
+    const museConfigDirectory = canonicalPath(pathApi.join(configHome, "muse"), platform);
+    const canonicalStateDirectory = canonicalPath(path, platform);
+    const relativePath = pathApi.relative(museConfigDirectory, canonicalStateDirectory);
     const outsideMuseConfig = relativePath === ".."
-        || relativePath.startsWith(`..${pathSeparator}`)
-        || pathIsAbsolute(relativePath);
+        || relativePath.startsWith(`..${pathApi.sep}`)
+        || pathApi.isAbsolute(relativePath);
     if (!outsideMuseConfig)
         throw new RegistryValidationError();
-    return path;
+    return canonicalStateDirectory;
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-muse",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OpenCode plugin backed by the official Muse Code CLI and MSP",
   "license": "MIT",
   "type": "module",