opencode-self-improvement 0.2.2 → 0.2.3

package/README.md

@@ -130,7 +130,7 @@ Add a `plugins` entry to your opencode config —
 ```json
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugins": ["opencode-self-improvement@0.2.1"]
+  "plugins": ["opencode-self-improvement@0.2.2"]
 }
 ```
 
@@ -144,7 +144,7 @@ bump the version in the config and restart. On Opencode v2 you can also manage
 it with the CLI:
 
 ```sh
-opencode plugin add opencode-self-improvement@0.2.1
+opencode plugin add opencode-self-improvement@0.2.2
 opencode plugin update opencode-self-improvement
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/logfmt.ts

@@ -5,10 +5,17 @@ import { mkdir } from "node:fs/promises";
 
 export type Fields = Record<string, unknown>;
 
+// Escapes for quoted values. One record is one line, so a raw newline inside a
+// value would end the record early and the rest of the value would be read
+// back as a separate line of fields. Backslash is escaped too, so a value
+// ending in `\` cannot swallow its closing quote.
+const ESCAPE: Record<string, string> = { "\\": "\\\\", '"': '\\"', "\n": "\\n", "\r": "\\r", "\t": "\\t" };
+const UNESCAPE: Record<string, string> = { "\\": "\\", '"': '"', n: "\n", r: "\r", t: "\t" };
+
 export function quote(value: unknown): string {
   const s = String(value);
   if (s === "") return '""';
-  return /[\s"=]/.test(s) ? `"${s.replace(/"/g, '\\"')}"` : s;
+  return /[\s"=]/.test(s) ? `"${s.replace(/[\\"\n\r\t]/g, (c) => ESCAPE[c])}"` : s;
 }
 
 export function formatLine(fields: Fields): string {
@@ -20,9 +27,10 @@ export function formatLine(fields: Fields): string {
   return parts.join(" ");
 }
 
-// Unescape a quoted logfmt value and read it back.
+// Unescape a quoted logfmt value and read it back. Unknown sequences are kept
+// as written: older files stored backslashes unescaped (`C:\Program Files`).
 function unquote(s: string): string {
-  return s.replace(/\\"/g, '"');
+  return s.replace(/\\(.)/g, (seq, c: string) => UNESCAPE[c] ?? seq);
 }
 
 export function parseLine(line: string): Fields | null {

package/src/viewer/server.ts

@@ -28,6 +28,36 @@ function error(msg: string, status = 400): Response {
   return json({ error: msg }, status);
 }
 
+// Binding 127.0.0.1 keeps other machines out, but not other websites open in
+// the user's browser. Two checks close that:
+// - Host must name this viewer. A DNS-rebinding page reaches 127.0.0.1 under
+//   its own hostname, so its requests arrive with a foreign Host.
+// - Writes must be JSON from this viewer's own origin. A cross-site form or
+//   no-cors fetch can POST text/plain without a CORS preflight, and every
+//   memory edited here is injected into the agent's system prompt.
+// A viewer deliberately exposed under another name (OPENCODE_VIEWER_HOST set
+// to a LAN address, a hostname) can list it in OPENCODE_VIEWER_ALLOWED_HOSTS.
+function allowedHostnames(): Set<string> {
+  const extra = (process.env.OPENCODE_VIEWER_ALLOWED_HOSTS ?? "").split(",");
+  const names = ["127.0.0.1", "localhost", "::1", HOST, ...extra]
+    .map((n) => n.trim().toLowerCase())
+    .filter(Boolean)
+    .map((n) => (n.includes(":") && !n.startsWith("[") ? `[${n}]` : n));
+  return new Set(names);
+}
+
+function rejectRequest(req: Request, url: URL, port: number): Response | null {
+  if (!allowedHostnames().has(url.hostname) || (url.port || "80") !== String(port)) {
+    return error("unexpected Host header", 403);
+  }
+  if (req.method === "GET" || req.method === "HEAD") return null;
+  const origin = req.headers.get("origin");
+  if (origin !== null && origin !== url.origin) return error("cross-origin request refused", 403);
+  const type = (req.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+  if (type !== "application/json") return error("content-type must be application/json", 415);
+  return null;
+}
+
 interface Row {
   ts: string;
   type: string;
@@ -86,7 +116,10 @@ export async function startViewer(port: number = PORT): Promise<ViewerServer> {
     hostname: HOST,
     port,
     fetch(req, srv) {
+      // Bun builds req.url from the request's Host header.
       const url = new URL(req.url);
+      const rejected = rejectRequest(req, url, server.port ?? port);
+      if (rejected) return rejected;
       if (url.pathname === "/") {
         return new Response(page, {
           headers: { "content-type": "text/html; charset=utf-8" },