opencode-secrets-obfuscation 0.1.0 → 0.1.1

package/docs/history/20-pure-mvp-final-review.md

@@ -1,116 +0,0 @@
-# 20 — Fresh adversarial review of pure MVP after R19
-
-Date: 2026-10-13
-
-## Verdict
-
-**Not ready for MVP-owned tools or an MVP qualification claim.** The R19
-changes close the previously reported proxy-boundary failures in config,
-policy, sanitizer and budgets, and close store quota/collision and proof
-binding gaps. The pure suite passes, but three pure fail-closed/resource gates
-remain open. Host, source-opening, transport and qualification gates are also
-still unverified.
-
-## Evidence run
-
-- `npm.cmd run typecheck` — pass.
-- `node --test tests/unit/config.test.ts tests/unit/dotenv.test.ts tests/unit/sanitize.test.ts tests/unit/store-policy.test.ts tests/unit/budgets.test.ts` — **35 passed, 0 failed**.
-- `npm.cmd run check` — typecheck and pure tests passed; the broader run then
-  failed in 12 pre-existing private run-directory/ACL harness tests with
-  `RUN_DIRECTORY_PERMISSION_FAILED`. This is not host qualification evidence
-  and was not used as evidence for the pure result.
-- No source, OpenCode, real transport, source-opening, or qualification run
-  was performed. No source or test edits were made.
-
-## R19 fixes verified
-
-- Config and policy reject malformed plain records, accessors, proxies,
-  symbols and cycles with fixed errors/denials.
-- Sanitizer public boundaries catch throwing object/pattern/budget traps;
-  malformed projections return `null`, and admission returns the fixed safe
-  failure.
-- Caller-supplied pattern representations are not trusted; the finite derived
-  inventory is used. UUID-language and reserved-output collisions reject the
-  complete admission.
-- Interval collection merges transitive overlaps, final output is rescanned,
-  and default match/output/depth/node bounds deny without partial output.
-- Budget inspection is descriptor-based, rejects malformed boundaries, checks
-  safe-integer addition and commits reservations atomically.
-- Store reservations are made before map mutation, session/handle quotas are
-  enforced when a ledger is supplied, teardown releases them, and UUID
-  collision retries have a finite bound.
-- Authorization proofs are issuer-held and bind session, agent, Location,
-  generation, capability, operation and resource; forged or changed requests
-  do not resolve.
-
-## Must-fix before pure MVP sign-off
-
-### High — sanitizer aggregate pattern work is not reserved or bounded by the operation budget
-
-`src/sanitize/index.ts` bounds each pattern and its derived representation,
-but `collectIntervalsBounded`, `sanitizeText`, `projectPlain` and
-`canonicalTextSink` do not enforce a total pattern/index/identity budget before
-deriving and repeatedly rescanning representations. `MAX_INDEX_ENTRIES` and
-`MAX_IDENTITY_ENTRIES` are declared but unused. `admitPatterns` limits the
-array to 4,096 entries, yet still permits a large aggregate inventory; the
-transform paths do not even apply that count limit consistently. A bounded
-input/output size therefore does not prove bounded allocation or work for an
-adversarial pattern array.
-
-Required: validate and reserve aggregate pattern bytes, representation/index
-entries, interval/identity storage and temporary copies before construction;
-apply the same finite limits to every public sanitizer entry point; deny the
-whole operation with no partial result. Add tests for large aggregate pattern
-text, many no-match patterns, representation expansion and reservation
-release.
-
-### High — dotenv option boundary is not fail-closed
-
-`parseDotenv` checks the source, but reads `options.maxBytes`, `maxEntries` and
-`maxValueBytes` outside an exception boundary and does not validate those
-limits. A throwing proxy can escape its fixed `SourceParseError` boundary (a
-direct check with a proxy whose `get` trap throws produced the foreign message
-`foreign`); `Infinity`, negative or otherwise malformed limits can also defeat
-the intended bounded parser behavior.
-
-Required: normalize a plain, data-only options record, validate finite
-positive safe-integer limits, reject unknown fields, and catch all foreign
-object failures as the fixed source error. Add proxy/accessor/invalid-limit
-tests.
-
-### Medium — store safety depends on an optional ledger and charges characters, not UTF-8 bytes
-
-`ActivationStore` permits construction without `budget`, making registration
-and grant map growth unbounded if an integration caller omits the ledger.
-Additionally, `secretBytes`, `indexBytes` and `workingBytes` use
-`value.length`, while the design requires UTF-8/actual buffer accounting.
-The finite collision loop and ledger-backed quota tests pass, but the released
-boundary must either require a validated ledger or impose safe defaults, and
-must reserve byte counts using UTF-8 bytes. Add non-ASCII quota tests and an
-unbudgeted-construction denial/default test.
-
-## Residual host/integration gates
-
-1. **P0/R8 source gate:** opened-handle, canonical containment, symlink/reparse,
-   hard-link, ancestor replacement, filesystem identity, owner/ACL and tracked
-   file tests on every advertised filesystem. No path-only or insecure fallback.
-2. **P0/R7 deployment gate:** prove process-wide quota sharing across activation
-   and package instances, or adopt the explicitly restricted single-instance/
-   single-Location service envelope; measure actual RSS and reload overlap.
-3. **P1/P2 integration:** pinned V2 config/plugin loading, activation closure
-   ownership, source loading, immutable generations, cleanup, source rotation,
-   and no durable secret-derived state.
-4. **P3 sink gate:** independent interval oracle and final normalized/serialized
-   sink-byte tests, scalar/structured echoes, cross-part spill, boundary
-   creation, idempotence and actual allocation measurements.
-5. **P4/P5 host/tool gate:** native Effect entrypoint, explicit enrollment,
-   private executor, fixed status-only HTTPS operation, DNS/address/peer policy,
-   cancellation/body withholding, and real sink/network evidence.
-6. **Active-only limitations:** readiness/unload and fallback rollback,
-   captured executors, late overlays, queued/resumed work, A→B→A moves,
-   sessionless generation, provider-hosted tools, WebSocket/SDK routes,
-   shell/progress/spill paths and host permission deny/ask remain unverified or
-   expected gaps; they cannot be inferred from pure tests.
-7. **P6+ enforced profile:** mandatory host-owned readiness/revision control,
-   host-mediated authorization, final model-egress/publication gates and the
-   isolated broker/sandbox are absent. No enforced-profile claim is permitted.

package/docs/history/21-pure-mvp-review-final.md

@@ -1,109 +0,0 @@
-# 21 — Final fresh-eye review of pure MVP after R20
-
-Date: 2026-10-13
-
-## Verdict
-
-**NO-GO for the pure MVP-owned tools as a whole.** The dotenv boundary and
-store ledger/byte-accounting findings from R20 are closed. The sanitizer now
-reserves aggregate pattern inventory on every public transform path, but its
-caller-supplied work budgets are not capped by the hard resource ceilings.
-Consequently, an accepted `maxMatches` can permit very large interval
-materialization on a bounded input; analogous unbounded safe-integer values
-are accepted for traversal and output budgets. This is not sufficient evidence
-for bounded sanitizer work or for tools that depend on it.
-
-The config, dotenv parser, policy, budget ledger, and store components are
-**GO as pure component implementations**, subject to the host/integration
-gates below. Sanitizer-dependent owned tools remain **NO-GO** until the
-effective operation budgets are clamped to declared ceilings (or are charged
-against equivalent reservations) and adversarial tests prove that behavior.
-
-## Evidence
-
-- `npm.cmd run typecheck` — pass.
-- `node --test tests/unit/config.test.ts tests/unit/dotenv.test.ts tests/unit/sanitize.test.ts tests/unit/store-policy.test.ts tests/unit/budgets.test.ts` — **38 passed, 0 failed**.
-- No source edits, tool implementation edits, OpenCode launch, ACL test,
-  transport test, or real-host qualification run was performed.
-
-## R20 findings
-
-### Closed: dotenv proxy and limits
-
-`parseDotenv` places option normalization inside the fixed error boundary and
-uses a descriptor-based plain data record. It rejects proxies/accessors,
-symbols, unknown fields, malformed values, and non-positive/non-safe-integer
-limits with `SOURCE_INVALID`. The source byte, entry, and value limits are
-checked before accepting entries, with no partial snapshot returned.
-
-### Closed: store mandatory/default ledger and UTF-8 bytes
-
-`ActivationStore` always installs a bounded default `BudgetLedger` when one is
-not supplied, while still accepting an injected validated ledger. Reservations
-precede map mutation and teardown releases them. Secret, index, and working
-charges use `Buffer.byteLength(value, "utf8")`; the focused non-ASCII quota test
-exercises the denial boundary.
-
-### Partially closed: sanitizer aggregate reservations
-
-`reserveOperation` is now applied at every public sanitizer entry point and
-reserves aggregate pattern bytes, representation/index slots, identity slots,
-temporary input/pattern bytes, and releases reservations on every exit. The
-focused aggregate test covers interval collection, text sanitization, the
-canonical sink, projection, admission, and reservation reuse.
-
-Residual issue: `normalizedBudget` accepts any nonnegative safe integer for
-`maxMatches`, `maxNodes`, `maxDepth`, and `maxOutputBytes`; these values are
-not clamped to hard ceilings. For example, `collectIntervals` can accept a
-very large `maxMatches` and materialize a large `found` array from repeated
-matches in an otherwise bounded input. Output and traversal work likewise
-depend on caller-selected values rather than the declared hard ceilings.
-The aggregate reservation therefore does not by itself prove bounded work.
-This is a NO-GO finding, not a test failure in the current 38-test suite.
-
-## Required follow-up before pure sign-off
-
-1. Define hard effective ceilings for every sanitizer budget dimension and
-   reject or clamp requests above them; preserve fail-closed behavior.
-2. Add focused tests for oversized `maxMatches`, `maxNodes`, `maxDepth`, and
-   `maxOutputBytes`, including repeated-match allocation and reservation
-   release after denied operations.
-3. Re-run typecheck and the focused suite, then independently review all
-   public sanitizer paths for reservation-before-allocation and no partial
-   output.
-
-## Remaining host and integration gates
-
-Pure tests do not qualify the plugin or any OpenCode tool. Remaining blockers
-include:
-
-1. P0 pinned V2 runtime/plugin compatibility, hook ordering, unload/fallback,
-   and an isolated real-host smoke harness.
-2. Handle-relative source loading on each advertised filesystem: containment,
-   symlink/reparse and hard-link rejection, ancestor replacement, identity,
-   ownership, and ACL evidence.
-3. Shared process-wide quota accounting or an explicitly restricted
-   single-instance deployment, including measured allocation/reload overlap.
-4. Native tool and HTTP integration: explicit enrollment, private execution,
-   fixed audience/transport policy, cancellation/body withholding, and safe
-   status-only results.
-5. Actual sink/publication evidence for model requests, structured/scalar
-   echoes, persistence/spill, progress/errors, retries, and unsupported paths.
-6. Rotation, generation invalidation, queued/resumed work, session/location
-   changes, and all documented active-only expected gaps.
-
-No OpenCode, ACL, host, integration, production qualification, or enforced
-profile claim is made by this review.
-
-## R21 remediation status
-
-The sole pure-MVP NO-GO finding is closed in the sanitizer implementation. Effective
-`maxMatches`, `maxNodes`, `maxDepth`, and `maxOutputBytes` values now reject explicit
-requests above fixed ceilings (50,000, 50,000, 32, and 2 MiB respectively), including
-otherwise safe integers such as `Number.MAX_SAFE_INTEGER`. Focused tests cover each
-oversized dimension, repeated-match denial before interval materialization, and
-reservation reuse after denial. Host and integration gates above remain unchanged.
-
-The subsequent R22 review identified and remediated two additional sanitizer boundary
-issues: canonical sink input inspection now occurs inside its fail-closed reservation
-boundary, and plain projection bounds key collection before sorting. See review 22.

package/docs/history/22-pure-mvp-signoff-review.md

@@ -1,113 +0,0 @@
-# 22 — Pure MVP sign-off review after R21
-
-Date: 2026-10-13
-
-## Verdict
-
-**NO-GO for the pure component layer as a complete sign-off.** R21 closes the
-previous hard-ceiling finding: explicit sanitizer budgets above the fixed
-ceilings are denied, repeated matches are denied before interval materialization,
-and reservations are released. The dotenv parser, config, policy, budget
-ledger, and store remain GO as isolated pure implementations.
-
-Two sanitizer boundary/resource findings remain before the whole pure layer can
-be called signed off:
-
-1. `canonicalTextSink` computes its initial reservation with `parts.reduce`
-   outside the `try`/`finally` boundary. A hostile `Array` proxy can therefore
-   throw a foreign error instead of returning the sanitizer's safe `null`
-   result. This is a public sanitizer path and regresses the fail-closed
-   boundary expected of the other paths.
-2. `projectPlain` calls `Object.keys(current).sort()` before applying its
-   `maxNodes` limit. A large plain object can force unbounded key-array
-   allocation and sorting even when the caller requests `maxNodes: 0` or `1`.
-   The traversal ceiling bounds visited values, but does not currently bound
-   this pre-traversal work.
-
-These are pure-layer blockers, not host qualification claims.
-
-## Evidence run
-
-- `npm.cmd run typecheck` — pass.
-- `node --test tests/unit/config.test.ts tests/unit/dotenv.test.ts tests/unit/sanitize.test.ts tests/unit/store-policy.test.ts tests/unit/budgets.test.ts` — **40 passed, 0 failed**.
-- Direct boundary probe: a throwing `parts.reduce` proxy causes
-  `canonicalTextSink` to throw `foreign`; a 100,000-key object with
-  `maxNodes: 1` returns `null` only after key enumeration/sorting.
-- No source or test edits, OpenCode launch, ACL test, transport test, or
-  real-host qualification run was performed.
-
-## R21 hard-ceiling review
-
-`normalizedBudget` is used by `collectIntervals`, `sanitizeText`,
-`canonicalTextSink`, and `projectPlain`, and rejects explicit values above the
-hard ceilings of 50,000 matches, 50,000 nodes, depth 32, and 2 MiB output.
-`reserveOperation` is present on all public sanitizer transforms, including
-`representationsFor`, `patternRepresentations`, `admitPatterns`, interval
-collection, text sanitization, canonical text sinks, and plain projection.
-The focused aggregate/repeated-match tests demonstrate release and reuse after
-denial. No R21 regression was observed in those paths.
-
-The reservation does not cure the two findings above: the canonical sink's
-pre-reservation traversal is outside its error boundary, and plain projection's
-key enumeration occurs before traversal accounting.
-
-## Closed pure components
-
-- **Dotenv:** non-executing parsing, descriptor-based option normalization,
-  finite positive limits, duplicate rejection, lexical preservation, and fixed
-  `SOURCE_INVALID` failures are covered.
-- **Budget ledger:** descriptor validation, atomic reservations, safe-integer
-  addition checks, idempotent disposal, and fixed denial behavior are covered.
-- **Store/policy:** bounded default ledger, UTF-8 byte charges, teardown release,
-  finite handle collisions, generation/Location/session binding, and issuer-held
-  authorization proofs are covered.
-- **Config:** plain-data/cycle/accessor/proxy rejection and hard configured
-  ceilings are covered.
-
-## Required follow-up
-
-1. Put all canonical-sink input inspection and reservation calculation inside a
-   fixed fail-closed boundary, with a regression test for throwing array/proxy
-   traps and reservation reuse.
-2. Bound plain-object key enumeration/sorting before materializing the complete
-   key list, or otherwise reserve and enforce a finite key/temporary-work
-   ceiling before that operation. Add a large-key object test at low node
-   budgets.
-3. Re-run typecheck and the focused pure suite, then repeat this review.
-
-## Remaining host and tool gates
-
-Even after those pure blockers close, the plugin/tool layer remains unqualified:
-
-1. Pinned V2 runtime/plugin compatibility, lifecycle ordering,
-   unload/fallback behavior, and an isolated real-host smoke harness.
-2. Handle-relative source loading with containment, symlink/reparse and
-   hard-link rejection, identity/ancestor replacement, ownership, and ACL
-   evidence on each advertised filesystem.
-3. Process-wide quota sharing across activations/package copies, or the
-   explicitly restricted single-instance/single-Location service envelope,
-   including measured RSS and reload overlap.
-4. Native tool and HTTP integration: explicit enrollment, private execution,
-   fixed audience/transport policy, cancellation/body withholding, and safe
-   status-only results.
-5. Actual normalized/serialized sink evidence for model requests, structured
-   and scalar echoes, persistence/spill, progress/errors, retries, and
-   unsupported paths.
-6. Rotation, generation invalidation, queued/resumed work, session/Location
-   changes, and documented active-only gaps.
-
-No OpenCode, ACL, host, integration, production qualification, or enforced
-profile claim is made by this review.
-
-## R22 remediation status
-
-Both residual sanitizer blockers are closed. `canonicalTextSink` now performs all
-parts inspection and initial reservation calculation inside its fail-closed
-`try`/`finally`, returning `null` for throwing array proxies and releasing any
-reservation on every path. `projectPlain` incrementally collects enumerable keys with
-a finite ceiling tied to the effective node ceiling before sorting, rejecting large
-objects without unbounded key-array materialization. Regression tests cover proxy
-containment, reservation reuse, and large-key objects with low `maxNodes`.
-
-The pure component implementation is GO subject to the host/tool gates listed above;
-this remediation does not claim host qualification.

package/docs/history/23-pure-mvp-signoff-review.md

@@ -1,75 +0,0 @@
-# 23 — Pure MVP sign-off review after R22 fixes
-
-Date: 2026-10-13
-
-## Verdict
-
-**GO for the reviewed pure component layer, subject to the host and tool gates
-below.** The two R22 sanitizer blockers are closed. This is a pure-layer
-verdict only; it is not OpenCode, filesystem/ACL, integration, or production
-qualification.
-
-## R22 fixes verified
-
-### Canonical sink proxy boundary
-
-`canonicalTextSink` performs the `Array.isArray` check, part inspection, UTF-8
-input-byte accounting, reservation, join, and sanitization inside one
-fail-closed `try`/`finally` boundary. A throwing array proxy can therefore
-only produce `null`; it cannot escape a foreign trap error. If a reservation
-has already been acquired, the `finally` path releases it. The indexed second
-pass is also inside the same boundary, so a proxy that changes behavior
-between passes is contained as well.
-
-### Plain projection key work
-
-`projectPlain` rejects non-plain values and collects enumerable own keys with a
-finite rejection probe before sorting. Key collection stops when it exceeds
-the effective `maxNodes` or the fixed `MAX_OBJECT_KEYS` ceiling, so a low node
-budget does not permit construction and sorting of an unbounded ordinary plain
-object key list. Descriptor reads, recursive visits, output construction, and
-the final scan remain inside the fail-closed boundary; cycles and reflection
-failures return `null`.
-
-This bounds the implementation's retained key list and sorting input for the
-supported plain-data boundary. It is not a claim that JavaScript can impose a
-global heap ceiling on arbitrary hostile proxy traps or the entire runtime;
-such resource and host behavior require the process/host gates below.
-
-## Evidence
-
-- `npm.cmd run typecheck` — pass.
-- Focused pure suites — **42 passed, 0 failed, 0 skipped, 0 todo**:
-  `tests/unit/config.test.ts`, `dotenv.test.ts`, `sanitize.test.ts`,
-  `store-policy.test.ts`, and `budgets.test.ts`.
-- Regression coverage includes a throwing array proxy with reservation reuse
-  and a 100,000-key plain object under `maxNodes: 1`.
-- `git diff --check` — pass (existing line-ending warnings only).
-
-The review inspected the implementation and tests directly. No OpenCode
-launch, source/ACL probe, integration qualification, or source edit was done.
-
-## Remaining host/tool gates
-
-The pure verdict does not close these release blockers:
-
-1. Pinned V2 runtime/plugin compatibility, lifecycle ordering, unload/fallback
-   behavior, and an isolated real-host P0-BOOT/P0-HOOKS/P0-ABORT harness.
-2. Handle-relative source loading with canonical containment, symlink/reparse
-   and hard-link rejection, identity/ancestor replacement, ownership, and ACL
-   evidence on each advertised filesystem.
-3. Process-wide quota ownership across activations/package copies, or an
-   explicitly restricted single-instance/single-Location envelope, including
-   measured RSS and reload overlap.
-4. Native tool and HTTP integration: explicit enrollment, private execution,
-   fixed audience/transport policy, cancellation/body withholding, and safe
-   status-only results.
-5. Actual normalized/serialized sink evidence for model requests, structured
-   and scalar echoes, persistence/spill, progress/errors, retries, and
-   unsupported paths.
-6. Rotation, generation invalidation, queued/resumed work, session/Location
-   changes, active-only gaps, and the applicable plugin-only MVP qualification
-   matrix.
-
-Until those gates pass on a compatible runner, do not claim host protection,
-production qualification, or an enforced profile.

package/docs/history/24-owned-tools-implementation.md

@@ -1,27 +0,0 @@
-# P4 owned tool core
-
-Implemented the host-independent `credentials_read` and `credential_http` executors in
-`src/tools/index.ts`. Both use explicit session/agent/location/generation checks,
-`ActivationStore`, policy proofs, and bounded fixed-result publication. The read tool accepts
-only an immutable, generation-bound `admitSourceView` snapshot: handles are supplied by the
-snapshot, source/key/capability bindings carry session scope, and only entries authorized for
-the current session and optional capability filter are rendered. Catalogs require a separate
-immutable `admitCapabilityCatalog` boundary; identifiers, NUL/UTF-8 sizes, and plain data
-shapes are validated, and no store registration occurs while rendering. Enumeration accounts
-source IDs, keys, handles, separators, catalog names, arrays, and working copies before output
-allocation; source headers are included in both source and sink ceiling checks before lines are
-joined. Admission rejects duplicate source IDs, source entries, capability bindings, and catalog
-identities atomically. Caller budgets cannot exceed fixed ceilings and the canonical sink receives
-hard budgets.
-
-The HTTP tool supports only the fixed GitHub repository operation, injects the credential
-privately into a trusted transport request, and projects only `accessible`/`unavailable`
-outcomes. Its transport contract requires bounded cancellation completion for both in-flight
-timeout/abort and resolved-response cleanup; failure is a fixed operation error rather than a
-status result.
-
-Unit and integration tests use synthetic stores and an injected transport. This boundary does
-not qualify native OpenCode source adapters, host serialization, or a production HTTP transport.
-DNS/address selection and pinning, TLS peer verification, proxy and redirect policy,
-parser/header limits, and socket cancellation remain explicit trusted-transport responsibilities;
-no plugin entrypoint or OpenCode process is launched here.

package/docs/history/25-v2-plugin-integration.md

@@ -1,53 +0,0 @@
-# 25 — Native V2 Effect plugin integration
-
-Date: 2026-10-13
-
-## Implemented
-
-- Added the native `@opencode/plugin/effect` entrypoint with the required
-  `Plugin.define({ id, effect })` default export.
-- Registered only documented V2 Effect surfaces: session request hooks for all
-  four request kinds, native HTTP request/response hooks, tool before/after
-  hooks, and synchronous tool transforms.
-- Kept the integration boundary typed and secret-free. Core policy, source
-  loading, storage, sanitization and transport are supplied through
-  `CoreRuntimeFactory`; no raw event value is copied into diagnostics or tool
-  metadata.
-- Wired the existing `src/tools` executors through `makeToolExecutors`. The
-  adapter passes only public arguments and V2 `Tool.Context` session/agent
-  identity into core-owned closures, returning `Tool.Result` through Effect.
-- The default factory is explicitly unavailable and credential tools fail with
-  the fixed `CREDENTIAL_RUNTIME_UNAVAILABLE` error. It is not a fake runtime
-  or a qualification claim.
-
-This entrypoint still requires an injected core/source runtime factory and is
-not a functional installed MVP. No protection or shipping claim is made by
-this integration alone.
-
-## Version evidence
-
-The package contract was inspected from the published `@opencode/plugin@2.0.28`
-tarball. Its Effect entrypoint defines scoped registrations and typed
-`Tool.Error` failure for `execute.before`; `effect@4.0.1` is the matching
-runtime dependency. Both are exact development pins in `package.json` and
-`package-lock.json`; installation was regenerated with `npm install
---ignore-scripts`.
-
-The repository's strict compiler uses `skipLibCheck` only to isolate upstream
-declaration incompatibilities in the pinned OpenCode AI dependency graph; all
-project and plugin-integration declarations remain checked. No broad ambient
-`any` declaration was added.
-
-## Deferred qualification and gaps
-
-No OpenCode host or user configuration was launched. The contract tests and
-TypeScript check validate package identity and public API typing only; they do
-not qualify hook execution, ordering, abort semantics, serialization sinks,
-or unload behavior. Real-host qualification remains deferred to the isolated
-smoke harness.
-
-The native source-opening/handle loader is not integrated here. The reviewed
-HTTP transport and WebSocket/SDK interception adapters are also not supplied by
-this boundary. Until those implementations and their host tests exist, this
-integration must not be described as protecting source files, provider traffic,
-or arbitrary tool execution.

package/docs/history/26-owned-tools-review.md

@@ -1,138 +0,0 @@
-# 26 — Adversarial review of owned tools
-
-Date: 2026-10-13
-
-## Scope and conclusion
-
-Reviewed `src/tools/index.ts`, `tests/unit/tools.test.ts`,
-`tests/integration/tools.test.ts`, the native registration in
-`src/opencode/v2/index.ts`, and [24](24-owned-tools-implementation.md) against
-the design and plan. No source or test files were changed.
-
-**Conclusion:** the HTTP executor is a useful *injected, trusted-transport
-boundary* for the narrow status-only operation. It is not suitable for plugin
-integration or a release claim yet. `credentials_read` is not safe as a
-general source-view boundary until snapshot validation, catalog authorization,
-and output/resource accounting are moved into this path (or guaranteed by a
-stronger runtime contract).
-
-## Findings
-
-### High — source view can partially register and is not atomic
-
-`credentialsRead` calls `store.register` while iterating source entries
-(`src/tools/index.ts:61-68`). If a later entry is malformed, registration
-throws, or final sink construction fails, earlier registrations remain in the
-store. This violates the whole-snapshot admission rule and can leave a
-partially initialized source/capability state. It also means the tool is
-performing source loading/registration rather than rendering an immutable,
-already-admitted snapshot.
-
-The executor accepts arbitrary `SourceView` values and does not enforce the
-config parser's admissibility predicate, supported lexical/UTF-8
-representations, duplicate rules, or source-generation invariants. A caller
-can therefore supply values that conflict with the handle language or fixed
-output inventory and still obtain a handle. The later `canonicalTextSink` call
-uses no patterns, so it cannot correct this.
-
-### High — source-view and catalog disclosure are not capability-scoped
-
-An enrolled caller may select any supplied source ID and receives every entry
-in that source. Separately, every valid `runtime.capabilities` handle/name is
-published unless filtered by the optional name (`src/tools/index.ts:70-73`).
-There is no source/key-to-capability mapping and no per-capability policy
-authorization in `credentialsRead`. `ActivationStore.withSecret` correctly
-binds an HTTP proof to session, agent, Location, generation, operation and
-resource, but that proof path is absent from the read tool.
-
-This can disclose handles and capability names belonging to other configured
-operations or sessions. The handles do not automatically grant authority, but
-opaque-reference existence and catalog membership are still public reference
-disclosures. The registration in `src/opencode/v2/index.ts` makes this tool
-available with only `codemode: false`; it does not add this missing binding.
-
-### High — read output and source-view work are unbounded by configured budgets
-
-The tool constructs an unbounded `lines` array/string from source IDs, keys,
-values-as-input-to-registration, and capability names. `canonicalTextSink` is
-called with its defaults rather than the configured `inputBytes`,
-`outputBytes`, traversal, and working-memory budgets. Store reservations cover
-individual registered values, not the aggregate source view, metadata, joins,
-or temporary copies. There is no quota reservation before enumeration.
-
-This is especially relevant for UTF-8: store accounting uses UTF-8 bytes, but
-the source-view construction has no equivalent byte bound and can allocate
-large JS strings before the sink rejects them. The tests only cover one small
-ASCII entry and do not exercise Unicode expansion, many entries, oversized
-keys/names, or failure after prior registration.
-
-### Medium — timeout is not a completion bound for a non-cooperative transport
-
-`credentialHttp` aborts an internal signal on a timer, but awaits
-`transport.request` directly. A transport that ignores `AbortSignal` can leave
-the executor pending indefinitely; the timer does not force a fixed error or
-release the private callback. The `HttpTransport` interface does not state or
-enforce cancellation completion semantics.
-
-The response's `cancel()` is invoked only after the request promise resolves.
-If it throws, the code still publishes the status, despite the design
-requiring cancellation failure to terminate the call. The injected timeout
-test uses a cooperative transport and therefore does not prove either
-property.
-
-### Medium — native network security is entirely delegated
-
-The core constructs a fixed HTTPS URL and headers, but the injected transport
-owns DNS resolution, address selection, TLS peer verification, proxy use,
-redirect handling, connection reuse, header limits, parser buffering, and
-actual socket cancellation. No interface contract prevents redirects or a
-second DNS lookup, and no tests in this scope observe those behaviors. The
-integration TODOs explicitly leave address pinning/TLS/no-proxy/redirect and
-slow-body cases unimplemented.
-
-Consequently, body/header withholding is proven only against a cooperative
-injected object: the executor does not read or return `body`/`headers`, but it
-cannot prevent a production transport or endpoint-facing logger from seeing
-the secret-bearing request/response. This is acceptable only when the
-transport is separately trusted and qualified.
-
-### Medium — plugin integration is not currently typecheckable or qualified
-
-`npm run typecheck` fails at `src/opencode/v2/index.ts:55` (`makeToolExecutors`
-has a malformed return-type arrow). The native registration is therefore not
-a working integration artifact. Even after that syntax error, the available
-tests construct executors directly and do not verify V2 discovery,
-serialization, public input immutability, hook ordering, error publication,
-or unload/captured-executor behavior. The default factory also remains an
-explicit unavailable runtime per history 25.
-
-## What is actually established
-
-- Public HTTP input is restricted to own plain properties and an opaque handle;
-  policy authorization precedes the injected transport call and the store
-  proof is bound to identity, Location, generation, capability, operation and
-  resource.
-- The fixed URL/method and fixed outcome strings are constructed locally.
-- Returned response body/header fields are not copied into the result, and a
-  resolved response is asked to cancel before status projection.
-- Malformed operation input is rejected before network invocation.
-- The focused five tests pass:
-  `node --test tests/unit/tools.test.ts tests/integration/tools.test.ts`.
-
-The full unit command is not a clean tool qualification signal: it reaches the
-tool tests, but twelve unrelated Windows harness tests fail at private-run
-directory permission setup. Integration has three passing executable tests,
-one skip, and six TODOs. These results do not qualify a host or production
-transport.
-
-## Required disposition
-
-Keep this implementation limited to an injected boundary with a trusted,
-separately qualified transport and pre-admitted immutable source snapshot.
-Before plugin integration, make source-view publication atomic and bounded,
-bind catalog entries to the configured source/capability policy, validate
-UTF-8/admissibility and all representations at load time, define
-cancellation-completion semantics, and add real transport tests for DNS,
-redirects, proxies, TLS peer/address binding, header limits, and aborts.
-Fix the native integration typecheck error and execute an isolated real-host
-registration/serialization test before making any plugin-integration claim.