opencode-overclock 0.4.0 → 0.5.1

package/src/features/tasks.ts

@@ -4,7 +4,7 @@ import type { FeatureModule } from "../types.ts"
 import { ensureStateDir, shellQuote, writeJson } from "../lib/state.ts"
 import { taskStore, type TaskMirrorEntry } from "../lib/mirror.ts"
 import { inject, toast } from "../lib/inject.ts"
-import { NON_INTERACTIVE_ENV } from "../lib/exec.ts"
+import { killProcessTree, NON_INTERACTIVE_ENV, redactSensitiveOutput, sanitizeEnv } from "../lib/exec.ts"
 import { spawnTaskPane, type TmuxPane } from "../lib/tmux.ts"
 
 const z = tool.schema
@@ -127,12 +127,27 @@ function startStallWatchdog(
   }, checkIntervalMs)
 }
 
+export async function readLogTail(logPath: string, tailLines = 50): Promise<string> {
+  const file = Bun.file(logPath)
+  if (!(await file.exists())) return "(no output)"
+  const s = await stat(logPath).catch(() => null)
+  if (!s || s.size === 0) return "(no output)"
+
+  const effectiveTail = Math.max(1, tailLines)
+  // Cap read window to last 512KB to prevent memory exhaustion on giant log files
+  const maxBytes = 512 * 1024
+  const start = Math.max(0, s.size - maxBytes)
+  const text = await (start > 0 ? file.slice(start).text() : file.text())
+  const lines = text.trimEnd().split("\n")
+  return lines.slice(-effectiveTail).join("\n")
+}
+
 /** Exported for tests. onExit fires after status/exitCode settled. */
 export function createTaskManager(opts: {
   logDir: string
   /** mirror JSON path, written on every state change (spawn/exit/kill); omit to disable */
   mirrorPath?: string
-  onExit?: (task: TaskRecord) => void
+  onExit?: (task: TaskRecord) => void | Promise<void>
   /** enables the stall watchdog; absent -> no polling at all */
   onStall?: (task: TaskRecord, tail: string) => void
   stallCheckIntervalMs?: number
@@ -140,9 +155,27 @@ export function createTaskManager(opts: {
   stallTailBytes?: number
   /** spawn a tmux split pane to tail task logs (only if TMUX is active) */
   tmux?: boolean
+  sanitizeEnv?: boolean
+  envAllowlist?: string[]
+  maxTasks?: number
 }): TaskManager {
   const tasks = new Map<string, TaskEntry>()
   let counter = 0
+  const maxRetainedTasks = opts.maxTasks ?? 100
+
+  function pruneFinishedTasks(): void {
+    if (tasks.size <= maxRetainedTasks) return
+    const finished: string[] = []
+    for (const [id, entry] of tasks) {
+      if (entry.status !== "running") {
+        finished.push(id)
+      }
+    }
+    const toRemove = tasks.size - maxRetainedTasks
+    for (let i = 0; i < Math.min(toRemove, finished.length); i++) {
+      tasks.delete(finished[i]!)
+    }
+  }
 
   function persistMirror(): void {
     if (!opts.mirrorPath) return
@@ -165,14 +198,38 @@ export function createTaskManager(opts: {
   }): TaskRecord {
     const id = `t${(++counter).toString(36)}-${crypto.randomUUID().slice(0, 6)}`
     const logPath = `${opts.logDir}/${id}.log`
-    // shell-level redirection: no piping code, survives plugin restart losing streams
-    const proc = Bun.spawn(["bash", "-c", `(${input.command}) >> ${shellQuote(logPath)} 2>&1`], {
-      cwd: input.cwd,
-      env: {
-        ...process.env,
-        ...NON_INTERACTIVE_ENV,
-      },
-    })
+
+    let proc: Bun.Subprocess
+    try {
+      proc = Bun.spawn(["bash", "-c", `(${input.command}) >> ${shellQuote(logPath)} 2>&1`], {
+        cwd: input.cwd,
+        env: {
+          ...(opts.sanitizeEnv === false ? process.env : sanitizeEnv(process.env, opts.envAllowlist)),
+          ...NON_INTERACTIVE_ENV,
+        },
+      })
+    } catch (e) {
+      console.warn(`[overclock] failed to spawn task ${id}: ${e}`)
+      const failedEntry: TaskEntry = {
+        id,
+        description: input.description,
+        command: input.command,
+        cwd: input.cwd,
+        sessionID: input.sessionID,
+        status: "exited",
+        exitCode: 1,
+        logPath,
+        proc: null as any,
+        stallNotified: false,
+        startedAt: Date.now(),
+      }
+      tasks.set(id, failedEntry)
+      pruneFinishedTasks()
+      persistMirror()
+      opts.onExit?.(strip(failedEntry))
+      return strip(failedEntry)
+    }
+
     const entry: TaskEntry = {
       id,
       description: input.description,
@@ -219,7 +276,12 @@ export function createTaskManager(opts: {
       if (entry.status === "running") entry.status = "exited"
       entry.exitCode = code
       persistMirror()
-      opts.onExit?.(strip(entry))
+      try {
+        await opts.onExit?.(strip(entry))
+      } finally {
+        pruneFinishedTasks()
+        persistMirror()
+      }
     })
     return strip(entry)
   }
@@ -228,13 +290,16 @@ export function createTaskManager(opts: {
     const entry = tasks.get(id)
     if (!entry || entry.status !== "running") return false
     entry.status = "killed"
+    pruneFinishedTasks()
     persistMirror()
     if (entry.stallTimer) clearInterval(entry.stallTimer)
     entry.stallTimer = undefined
     if (entry.tmuxPane) void entry.tmuxPane.close()
-    entry.proc.kill("SIGTERM")
-    const hard = setTimeout(() => entry.proc.kill("SIGKILL"), 3000)
-    entry.proc.exited.then(() => clearTimeout(hard))
+    if (entry.proc) {
+      void killProcessTree(entry.proc, "SIGTERM")
+      const hard = setTimeout(() => void killProcessTree(entry.proc, "SIGKILL"), 3000)
+      entry.proc.exited.then(() => clearTimeout(hard))
+    }
     return true
   }
 
@@ -249,10 +314,7 @@ export function createTaskManager(opts: {
     output: async (id, tailLines = 50) => {
       const e = tasks.get(id)
       if (!e) return `no task ${id}`
-      const file = Bun.file(e.logPath)
-      if (!(await file.exists())) return "(no output)"
-      const lines = (await file.text()).split("\n")
-      return lines.slice(-tailLines - 1).join("\n")
+      return readLogTail(e.logPath, tailLines)
     },
     killAll: () => {
       for (const id of tasks.keys()) kill(id)
@@ -285,9 +347,13 @@ export const tasks: FeatureModule = {
       logDir,
       mirrorPath: taskStore.path(ctx.directory),
       tmux: options.tmux === true,
+      sanitizeEnv: options.sanitizeEnv !== false,
+      envAllowlist: Array.isArray(options.envAllowlist) ? (options.envAllowlist as string[]) : undefined,
+      maxTasks: typeof options.maxTasks === "number" ? options.maxTasks : 100,
       onExit: async (task) => {
         if (task.status === "killed") return
-        const tail = await manager.output(task.id, 20)
+        const rawTail = await readLogTail(task.logPath, 20)
+        const tail = redactSensitiveOutput(rawTail)
         const ok = task.exitCode === 0
         await toast(
           ctx.client,
@@ -305,12 +371,13 @@ export const tasks: FeatureModule = {
             stallThresholdMs,
             stallCheckIntervalMs,
             onStall: async (task: TaskRecord, tail: string) => {
+              const safeTail = redactSensitiveOutput(tail.trimEnd())
               await toast(ctx.client, `task ${task.id} looks stalled (waiting for input?)`, "warning")
               await inject(
                 ctx.client,
                 task.sessionID,
                 `[background task ${task.id} "${task.description}" appears to be waiting for interactive input]\n` +
-                  `last output:\n${tail.trimEnd()}\n\n` +
+                  `last output:\n${safeTail}\n\n` +
                   `The command is likely blocked on a prompt. Kill it with ${shared.toolName("task_kill")} and re-run non-interactively ` +
                   `(e.g. pipe input like \`echo y | cmd\`, or pass a --yes/--force flag).`,
               )

package/src/features/truncator.ts

@@ -15,6 +15,7 @@ export interface TruncateResult {
 
 /**
  * Smartly truncate output preserving top context and bottom tail.
+ * Enforces strict character and line bounds so oversized lines never overflow context.
  */
 export function truncateOutput(
   content: string,
@@ -22,16 +23,23 @@ export function truncateOutput(
   headLinesCount = DEFAULT_HEAD_LINES,
   tailLinesCount = DEFAULT_TAIL_LINES,
 ): TruncateResult {
-  if (content.length <= maxChars) {
+  const effectiveMax = Math.max(100, maxChars)
+  if (content.length <= effectiveMax) {
     return { text: content, truncated: false, omittedLines: 0, omittedChars: 0 }
   }
 
+  const headCount = Math.max(0, headLinesCount)
+  const tailCount = Math.max(0, tailLinesCount)
   const lines = content.split("\n")
-  if (lines.length <= headLinesCount + tailLinesCount) {
+
+  const maxHeadChars = Math.floor(effectiveMax * 0.3)
+  const maxTailChars = Math.floor(effectiveMax * 0.7)
+
+  if (lines.length <= headCount + tailCount) {
     // If few lines but very long strings, hard slice
-    const head = content.slice(0, Math.floor(maxChars * 0.3))
-    const tail = content.slice(-Math.floor(maxChars * 0.7))
-    const omittedChars = content.length - head.length - tail.length
+    const head = content.slice(0, maxHeadChars)
+    const tail = maxTailChars > 0 ? content.slice(-maxTailChars) : ""
+    const omittedChars = Math.max(0, content.length - head.length - tail.length)
     return {
       text: `${head}\n\n[... truncated ${omittedChars} characters to stay within context limits ...]\n\n${tail}`,
       truncated: true,
@@ -40,10 +48,19 @@ export function truncateOutput(
     }
   }
 
-  const head = lines.slice(0, headLinesCount).join("\n")
-  const tail = lines.slice(-tailLinesCount).join("\n")
-  const omittedLines = lines.length - headLinesCount - tailLinesCount
-  const omittedChars = content.length - head.length - tail.length
+  let head = headCount > 0 ? lines.slice(0, headCount).join("\n") : ""
+  let tail = tailCount > 0 ? lines.slice(-tailCount).join("\n") : ""
+
+  // Guard against giant single lines in head or tail violating maxChars limit
+  if (head.length > maxHeadChars) {
+    head = head.slice(0, maxHeadChars) + "\n... [line truncated]"
+  }
+  if (tail.length > maxTailChars) {
+    tail = "[line truncated] ...\n" + (maxTailChars > 0 ? tail.slice(-maxTailChars) : "")
+  }
+
+  const omittedLines = Math.max(0, lines.length - headCount - tailCount)
+  const omittedChars = Math.max(0, content.length - head.length - tail.length)
 
   const text = `${head}\n\n[... truncated ${omittedLines} lines (${omittedChars} chars) to stay within context limits ...]\n\n${tail}`
   return {

package/src/features/usage.ts

@@ -12,6 +12,8 @@ export interface SessionUsage {
 }
 
 const RETENTION_DAYS = 60
+const MAX_SEEN_PER_DAY = 1000
+const MAX_TRACKED_SESSIONS = 200
 
 function zeroTokens(): UsageTokens {
   return { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0 }
@@ -73,6 +75,7 @@ export function createUsageTracker(opts: UsageTrackerOpts): UsageTracker {
   }
 
   async function flush(): Promise<void> {
+    pruneOldDays(state, Date.now())
     await writeJson(opts.statePath, state)
   }
 
@@ -93,6 +96,13 @@ export function createUsageTracker(opts: UsageTrackerOpts): UsageTracker {
 
   function onEvent(event: { type: string; properties?: unknown }): void {
     try {
+      if (event.type === "session.deleted") {
+        const props = event.properties as { sessionID?: string; info?: { id?: string } } | undefined
+        const id = props?.sessionID ?? props?.info?.id
+        if (id) sessions.delete(id)
+        return
+      }
+
       if (event.type !== "message.updated") return
       const info = (event.properties as any)?.info
       if (!info || info.role !== "assistant" || !info.time?.completed) return
@@ -103,6 +113,10 @@ export function createUsageTracker(opts: UsageTrackerOpts): UsageTracker {
       const bucket = state.days[day] ?? emptyBucket()
       state.days[day] = bucket
       if (bucket.seen.includes(info.id)) return
+
+      if (bucket.seen.length >= MAX_SEEN_PER_DAY) {
+        bucket.seen = bucket.seen.slice(-MAX_SEEN_PER_DAY + 1)
+      }
       bucket.seen.push(info.id)
 
       const cost = info.cost ?? 0
@@ -126,6 +140,12 @@ export function createUsageTracker(opts: UsageTrackerOpts): UsageTracker {
       sess.tokens.output += tok.output
       sessions.set(info.sessionID, sess)
 
+      if (sessions.size > MAX_TRACKED_SESSIONS) {
+        // Evict oldest session to bound memory
+        const oldest = sessions.keys().next().value
+        if (oldest) sessions.delete(oldest)
+      }
+
       scheduleFlush()
     } catch (e) {
       console.warn(`[overclock] usage: event handling failed: ${e}`)

package/src/features/workflow.ts

@@ -0,0 +1,270 @@
+import { existsSync } from "node:fs"
+import { resolve, dirname } from "node:path"
+import { fileURLToPath } from "node:url"
+import type { FeatureModule, WorkflowOptions } from "../core/types.ts"
+import { DEFINE_TEMPLATE } from "../workflow/templates/define.ts"
+import { PLAN_TEMPLATE } from "../workflow/templates/plan.ts"
+import { BUILD_TEMPLATE } from "../workflow/templates/build.ts"
+import { DIAGNOSE_TEMPLATE } from "../workflow/templates/diagnose.ts"
+import { SHIP_TEMPLATE } from "../workflow/templates/ship.ts"
+import { STANDARDS_REVIEWER_PROMPT } from "../workflow/agents/standards-reviewer.ts"
+import { SPEC_REVIEWER_PROMPT } from "../workflow/agents/spec-reviewer.ts"
+import { SECURITY_AUDITOR_PROMPT } from "../workflow/agents/security-auditor.ts"
+import { TEST_ENGINEER_PROMPT } from "../workflow/agents/test-engineer.ts"
+import { PERFORMANCE_AUDITOR_PROMPT } from "../workflow/agents/performance-auditor.ts"
+import { DOUBT_REVIEWER_PROMPT } from "../workflow/agents/doubt-reviewer.ts"
+import { CODEBASE_RESEARCHER_PROMPT } from "../workflow/agents/codebase-researcher.ts"
+import { DESIGN_EXPLORER_PROMPT } from "../workflow/agents/design-explorer.ts"
+import { ENGINEERING_COACH_PROMPT } from "../workflow/agents/engineering-coach.ts"
+import { CRAFTSMAN_PROMPT } from "../workflow/agents/craftsman.ts"
+import { DOC_WRITER_PROMPT } from "../workflow/agents/doc-writer.ts"
+
+function getBundledSkillsDir(customPath?: string): string {
+  if (customPath) return customPath
+  const currentDir =
+    typeof import.meta.dir === "string" ? import.meta.dir : dirname(fileURLToPath(import.meta.url))
+  return resolve(currentDir, "../../skills")
+}
+
+export const WORKFLOW_COMMANDS = {
+  define: {
+    description: "Interrogate requirements and draft SPEC.md with recommended defaults",
+    template: DEFINE_TEMPLATE,
+  },
+  plan: {
+    description: "Decompose spec into vertical tracer-bullet tasks in tasks/plan.md",
+    template: PLAN_TEMPLATE,
+  },
+  build: {
+    description: "Autonomous TDD implementation with tripwires and atomic commits",
+    template: BUILD_TEMPLATE,
+  },
+  diagnose: {
+    description: "Disciplined bug reproduction and isolation loop ([DEBUG-xxxx] tags)",
+    template: DIAGNOSE_TEMPLATE,
+  },
+  ship: {
+    description: "3-way parallel review (Standards, Spec, Security) with GO/NO-GO verdict",
+    template: SHIP_TEMPLATE,
+  },
+}
+
+export const WORKFLOW_AGENTS = {
+  "standards-reviewer": {
+    mode: "subagent" as const,
+    description: "Senior Staff Engineer auditing diffs for repo conventions and code smells",
+    prompt: STANDARDS_REVIEWER_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "spec-reviewer": {
+    mode: "subagent" as const,
+    description: "Product Engineer auditing diffs strictly against originating specifications",
+    prompt: SPEC_REVIEWER_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "security-auditor": {
+    mode: "subagent" as const,
+    description: "Adversarial Security Engineer auditing diffs for OWASP vulnerabilities and secrets",
+    prompt: SECURITY_AUDITOR_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "test-engineer": {
+    mode: "subagent" as const,
+    description: "QA Engineer auditing test strategy, coverage gaps, and Prove-It verification",
+    prompt: TEST_ENGINEER_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "performance-auditor": {
+    mode: "subagent" as const,
+    description: "Senior Performance Engineer auditing latency, N+1 queries, and resource leaks",
+    prompt: PERFORMANCE_AUDITOR_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "doubt-reviewer": {
+    mode: "all" as const,
+    description: "Adversarial Verification Engineer evaluating artifacts without author bias",
+    prompt: DOUBT_REVIEWER_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "codebase-researcher": {
+    mode: "all" as const,
+    description: "Scout Agent tracing seams, dependencies, and call graphs without polluting context",
+    prompt: CODEBASE_RESEARCHER_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "design-explorer": {
+    mode: "all" as const,
+    description: "Principal Architect producing contrasting 'Design It Twice' interface proposals",
+    prompt: DESIGN_EXPLORER_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  "engineering-coach": {
+    mode: "all" as const,
+    description: "Elite Staff Mentor providing Socratic debugging guidance and design critique",
+    prompt: ENGINEERING_COACH_PROMPT,
+    tools: {
+      write: false,
+      edit: false,
+    },
+    permission: {
+      edit: "deny" as const,
+    },
+  },
+  craftsman: {
+    mode: "all" as const,
+    description:
+      "Disciplined software craftsman enforcing TDD, minimal vertical slices, and clean architecture",
+    prompt: CRAFTSMAN_PROMPT,
+  },
+  "doc-writer": {
+    mode: "all" as const,
+    description:
+      "Technical writer synthesizing accurate documentation, API references, and architecture records from code",
+    prompt: DOC_WRITER_PROMPT,
+  },
+}
+
+export const workflow: FeatureModule = {
+  name: "workflow",
+  defaultEnabled: true,
+  tools: [],
+  async init(_ctx, options) {
+    const opts = (options ?? {}) as WorkflowOptions
+    if (opts.enabled === false) {
+      return {}
+    }
+
+    const skillsPath = getBundledSkillsDir(opts.skillsPath)
+
+    return {
+      config: async (cfg: any) => {
+        if (opts.commands !== false) {
+          cfg.command = {
+            ...WORKFLOW_COMMANDS,
+            ...(cfg.command ?? {}),
+          }
+        }
+
+        if (opts.subagents !== false) {
+          cfg.agent = {
+            ...WORKFLOW_AGENTS,
+            ...(cfg.agent ?? {}),
+          }
+        }
+
+        if (existsSync(skillsPath)) {
+          cfg.skills = typeof cfg.skills === "object" && cfg.skills !== null ? cfg.skills : {}
+          if (!Array.isArray(cfg.skills.paths)) {
+            cfg.skills.paths = []
+          }
+          if (!cfg.skills.paths.includes(skillsPath)) {
+            cfg.skills.paths.push(skillsPath)
+          }
+        }
+      },
+    }
+  },
+
+  setup: async (v2Context, options) => {
+    const opts = (options ?? {}) as WorkflowOptions
+    if (opts.enabled === false) return
+
+    if (opts.commands !== false && v2Context.command?.transform) {
+      await v2Context.command.transform(async (draft) => {
+        for (const [name, cmd] of Object.entries(WORKFLOW_COMMANDS)) {
+          draft.update(name, (current) => {
+            current.name = current.name ?? name
+            current.description = current.description ?? cmd.description
+            current.template = current.template ?? cmd.template
+          })
+        }
+      })
+    }
+
+    if (opts.subagents !== false && v2Context.agent?.transform) {
+      await v2Context.agent.transform(async (draft) => {
+        for (const [id, ag] of Object.entries(WORKFLOW_AGENTS)) {
+          draft.update(id, (current) => {
+            current.mode = current.mode ?? ag.mode
+            current.description = current.description ?? ag.description
+            current.system = current.system ?? ag.prompt
+            if ("permission" in ag && ag.permission?.edit === "deny") {
+              const perms = (current.permissions as any[]) ?? []
+              const hasDenyEdit = perms.some((p: any) => p.action === "edit" && p.effect === "deny")
+              if (!hasDenyEdit) {
+                perms.push({
+                  action: "edit",
+                  resource: "*",
+                  effect: "deny",
+                })
+                current.permissions = perms as any
+              }
+            }
+          })
+        }
+      })
+    }
+
+    const skillsPath = getBundledSkillsDir(opts.skillsPath)
+    if (existsSync(skillsPath) && v2Context.skill?.transform) {
+      await v2Context.skill.transform(async (draft) => {
+        const existing = draft.list?.() ?? []
+        const alreadyAdded = existing.some((s: any) => s.type === "directory" && s.path === skillsPath)
+        if (!alreadyAdded) {
+          draft.source({
+            type: "directory",
+            path: skillsPath,
+          } as any)
+        }
+      })
+    }
+  },
+}

package/src/lib/exec.ts

@@ -1,7 +1,13 @@
 export {
-  NON_INTERACTIVE_ENV,
   execBash,
+  killProcessTree,
   shellQuote,
+  sanitizeEnv,
+  redactSensitiveOutput,
+  NON_INTERACTIVE_ENV,
+  DEFAULT_PRESERVED_ENV,
+  SENSITIVE_ENV_PATTERN,
+  SENSITIVE_OUTPUT_PATTERNS,
   type ExecBashOptions,
   type ExecBashResult,
 } from "../platform/process/exec.ts"