opencode-telos 1.0.0 → 1.0.2

package/src/opencode/hooks.ts

@@ -171,18 +171,18 @@ export function detectShellFileWrites(command: string): string[] {
   return [...new Set(files)]
 }
 
-export function createSddHooks(): Hooks {
+export function createSddHooks(projectDir: string): Hooks {
   let systemInjected = false
 
   return {
     "experimental.chat.system.transform": async (_input, output) => {
       if (systemInjected) return
-      if (!isSddEnabled(process.cwd())) return
+      if (!isSddEnabled(projectDir)) return
 
       // Run pending migrations on first load
-      if (hasPendingMigrations(process.cwd())) {
+      if (hasPendingMigrations(projectDir)) {
         try {
-          const migrationResults = runMigrations(process.cwd())
+          const migrationResults = runMigrations(projectDir)
           const successful = migrationResults.filter(r => r.success)
           if (successful.length > 0) {
             output.system.push(`## 🔄 opencode-telos Migrations: ${successful.length} fix(es) applied`)  
@@ -193,10 +193,10 @@ export function createSddHooks(): Hooks {
         }
       }
 
-      const repo = createRepository(process.cwd())
+      const repo = createRepository(projectDir)
       if (repo.isInitialized()) {
         // Restore persistent cache from disk (cross-session)
-        const cacheMgr = getCacheManager(process.cwd())
+        const cacheMgr = getCacheManager(projectDir)
         cacheMgr.restoreFromPersistentCache()
 
         output.system.push(SDD_CORE_SYSTEM_PROMPT)
@@ -204,7 +204,7 @@ export function createSddHooks(): Hooks {
         // Tool Registry: injeta tools relevantes para o estado atual do grafo
         try {
           const { getGraphSnapshot } = await import("./router/graph-state-snapshot.js")
-          const snapshot = getGraphSnapshot(process.cwd())
+          const snapshot = getGraphSnapshot(projectDir)
           const { formatGraphState } = await import("./router/graph-state-snapshot.js")
           output.system.push(formatGraphState(snapshot))
         } catch {}
@@ -233,17 +233,12 @@ export function createSddHooks(): Hooks {
             output.system.push(`## Pending Changes: ${pending.length} change(s) awaiting action`)
           }
 
-          // G: Save graph snapshot to disk for fast cross-session restore
-          try {
-            const cacheMgrForSnapshot = getCacheManager(process.cwd())
-            cacheMgrForSnapshot.saveGraphSnapshot(graph)
-          } catch {}
         } catch {
           // Handoff is optional, don't fail if it can't be generated
         }
         // Persist cache to disk for cross-session reuse
         try {
-          const cacheMgr = getCacheManager(process.cwd())
+          const cacheMgr = getCacheManager(projectDir)
           cacheMgr.persistToDisk()
         } catch {}
         systemInjected = true
@@ -260,14 +255,14 @@ export function createSddHooks(): Hooks {
 
         // Detect /sdd commands
         if (text === "/sdd on") {
-          const state = setToggleState(process.cwd(), true)
+          const state = setToggleState(projectDir, true)
           systemInjected = false
           part.text = `✅ SDD enforcement **enabled** at ${state.changed_at}.\n\nSpec-Driven Development is now active. All code changes will go through the SDD workflow.`
           return
         }
 
         if (text === "/sdd off") {
-          const state = setToggleState(process.cwd(), false)
+          const state = setToggleState(projectDir, false)
           systemInjected = false
           resetWorkflowState()
           part.text = `⏸️ SDD enforcement **disabled** at ${state.changed_at}.\n\nYou can now make code changes freely without SDD workflow. Use \`/sdd on\` to re-enable.`
@@ -275,7 +270,7 @@ export function createSddHooks(): Hooks {
         }
 
         if (text === "/sdd status") {
-          const state = getToggleState(process.cwd())
+          const state = getToggleState(projectDir)
           const status = state.enabled ? "🟢 ON" : "🔴 OFF"
           part.text = `SDD Status: ${status}\nLast changed: ${state.changed_at}\n\nCommands: \`/sdd on\`, \`/sdd off\`, \`/sdd status\`, \`/sdd cache reset\``
           return
@@ -283,7 +278,7 @@ export function createSddHooks(): Hooks {
 
         // H: /sdd cache reset — full cache reset without killing the process
         if (text === "/sdd cache reset") {
-          const cacheMgr = getCacheManager(process.cwd())
+          const cacheMgr = getCacheManager(projectDir)
           const result = cacheMgr.fullReset()
           const lines = ["## 🧹 Cache Reset Complete"]
           lines.push(`- Memory cache: ${result.cleared.memory ? "✅ cleared" : "⏭️ skipped"}`)
@@ -297,7 +292,7 @@ export function createSddHooks(): Hooks {
         }
 
         // Semantic nudge — replaces regex-based pattern detection
-        if (isSddEnabled(process.cwd())) {
+        if (isSddEnabled(projectDir)) {
           const nudge = formatNudgeInput(text)
           if (nudge) {
             part.text += `\n\n${nudge}`
@@ -308,14 +303,14 @@ export function createSddHooks(): Hooks {
 
     "tool.execute.before": async (input, output) => {
       // Skip enforcement if SDD is disabled
-      if (!isSddEnabled(process.cwd())) return
+      if (!isSddEnabled(projectDir)) return
 
       // Enforce workflow context for SDD graph mutation tools
       if (input.tool.startsWith("sdd.")) {
         const access = checkToolAccess(input.tool)
         if (!access.allowed) {
           addAuditEntry(
-            process.cwd(),
+            projectDir,
             process.env.USER || "current",
             input.tool,
             "graph",
@@ -333,7 +328,7 @@ export function createSddHooks(): Hooks {
           // ENFORCEMENT: Block shell writes to .sdd/ directory
           if (command.includes(".sdd/") && (/[>]|writeFile|open\(['"].*['"],\s*['"]w/.test(command))) {
             addAuditEntry(
-              process.cwd(),
+              projectDir,
               process.env.USER || "current",
               "shell_command",
               ".sdd/",
@@ -353,7 +348,7 @@ export function createSddHooks(): Hooks {
 
           const detectedFiles = detectShellFileWrites(command)
           if (detectedFiles.length > 0) {
-            const repo = createRepository(process.cwd())
+            const repo = createRepository(projectDir)
             if (!repo.isInitialized()) return
 
             const graph = repo.loadGraph()
@@ -364,7 +359,7 @@ export function createSddHooks(): Hooks {
 
             if (!hasSpecNodes && graph.nodes.length > 0) {
               addAuditEntry(
-                process.cwd(),
+                projectDir,
                 process.env.USER || "current",
                 "shell_command",
                 detectedFiles.join(", "),
@@ -399,7 +394,7 @@ export function createSddHooks(): Hooks {
 
             if (approvedChanges.length === 0) {
               addAuditEntry(
-                process.cwd(),
+                projectDir,
                 process.env.USER || "current",
                 "shell_command",
                 detectedFiles.join(", "),
@@ -429,7 +424,7 @@ export function createSddHooks(): Hooks {
             const shellWorkflow = getWorkflowState()
             if (shellWorkflow.enforced && !shellWorkflow.specUpdated) {
               addAuditEntry(
-                process.cwd(),
+                projectDir,
                 process.env.USER || "current",
                 "shell_command",
                 detectedFiles.join(", "),
@@ -456,10 +451,10 @@ export function createSddHooks(): Hooks {
 
             // Approved — create snapshots
             for (const change of approvedChanges) {
-              createSnapshot(graph, change.id, process.cwd())
+              createSnapshot(graph, change.id, projectDir)
             }
             addAuditEntry(
-              process.cwd(),
+              projectDir,
               process.env.USER || "current",
               "shell_command",
               detectedFiles.join(", "),
@@ -479,7 +474,7 @@ export function createSddHooks(): Hooks {
         // The SDD graph can ONLY be modified through sdd.* tools
         if (filePath.includes(".sdd/")) {
           addAuditEntry(
-            process.cwd(),
+            projectDir,
             process.env.USER || "current",
             input.tool,
             filePath,
@@ -508,7 +503,7 @@ export function createSddHooks(): Hooks {
         if (!isSourceFile) return
 
         // Check if SDD is initialized
-        const repo = createRepository(process.cwd())
+        const repo = createRepository(projectDir)
         if (!repo.isInitialized()) return
 
         const graph = repo.loadGraph()
@@ -519,7 +514,7 @@ export function createSddHooks(): Hooks {
         
         if (!hasSpecNodes && graph.nodes.length > 0) {
           addAuditEntry(
-            process.cwd(),
+            projectDir,
             process.env.USER || "current",
             "write_file",
             filePath,
@@ -543,12 +538,12 @@ export function createSddHooks(): Hooks {
         }
 
         // Check permissions before allowing changes
-        const userRole = getUserRoleWithAuth(process.cwd(), process.env.USER || "current")
-        const hasPermission = checkPermission(userRole, "create_change", process.cwd())
+        const userRole = getUserRoleWithAuth(projectDir, process.env.USER || "current")
+        const hasPermission = checkPermission(userRole, "create_change", projectDir)
 
         if (!hasPermission) {
           addAuditEntry(
-            process.cwd(),
+            projectDir,
             process.env.USER || "current",
             "write_file",
             filePath,
@@ -577,7 +572,7 @@ export function createSddHooks(): Hooks {
           const workflow = getWorkflowState()
           if (workflow.enforced && !workflow.specUpdated) {
             addAuditEntry(
-              process.cwd(),
+              projectDir,
               process.env.USER || "current",
               "write_file",
               filePath,
@@ -604,10 +599,10 @@ export function createSddHooks(): Hooks {
 
           // Create snapshot before approving change
           for (const change of approvedChanges) {
-            createSnapshot(graph, change.id, process.cwd())
+            createSnapshot(graph, change.id, projectDir)
           }
           addAuditEntry(
-            process.cwd(),
+            projectDir,
             process.env.USER || "current",
             "write_file",
             filePath,
@@ -619,7 +614,7 @@ export function createSddHooks(): Hooks {
 
         // File not covered by any approved Change → BLOCK the write
         addAuditEntry(
-          process.cwd(),
+          projectDir,
           process.env.USER || "current",
           "write_file",
           filePath,
@@ -689,7 +684,7 @@ export function createSddHooks(): Hooks {
     },
 
     "tool.definition": async (input, output) => {
-      if (!isSddEnabled(process.cwd())) return
+      if (!isSddEnabled(projectDir)) return
 
       // Inject SDD enforcement warning into run_terminal_command description
       if (input.toolID === "run_terminal_command") {
@@ -719,7 +714,7 @@ export function createSddHooks(): Hooks {
     dispose: async () => {
       // E: Persist cache and release resources on session end
       try {
-        const cacheMgr = getCacheManager(process.cwd())
+        const cacheMgr = getCacheManager(projectDir)
         cacheMgr.persistToDisk()
         cacheMgr.releaseWriteLock()
       } catch {}

package/src/opencode/tools.ts

@@ -71,6 +71,7 @@ import {
   createDriftWhitelistTool,
 } from "./router/tools-composite.js"
 import { createWorkflowTools } from "./workflows/tools-workflow.js"
+import { graphFingerprint } from "../sdd/cache/fingerprint.js"
 
 // ── Validation Coverage Index (singleton per session) ──────────────
 const validationIndex = new ValidationIndex()
@@ -95,7 +96,7 @@ function getCachedToolResponse(directory: string, toolName: string, args: Record
     const repo = getRepo(directory)
     if (!repo.isInitialized()) return null
     const graph = repo.loadGraph()
-    return cacheMgr.getToolResponse(toolName, args, graph.metadata.updated_at)
+    return cacheMgr.getToolResponse(toolName, args, graphFingerprint(graph))
   } catch {
     return null
   }
@@ -110,7 +111,7 @@ function setCachedToolResponse(directory: string, toolName: string, args: Record
     const repo = getRepo(directory)
     if (!repo.isInitialized()) return
     const graph = repo.loadGraph()
-    cacheMgr.setToolResponse(toolName, args, response, graph.metadata.updated_at)
+    cacheMgr.setToolResponse(toolName, args, response, graphFingerprint(graph))
   } catch {}
 }
 
@@ -698,7 +699,7 @@ export function createSddTools(): Record<string, ToolDefinition> {
 
         // Check analysis cache
         const cacheMgr = getCacheManager(ctx.directory)
-        const cached = cacheMgr.getAnalysisResult("validate", graph.metadata.updated_at ? new Date(graph.metadata.updated_at).getTime() : 0, graph.nodes.length)
+          const cached = cacheMgr.getAnalysisResult("validate", graphFingerprint(graph))
         if (cached) {
           recordTelemetry(ctx.directory, {
             name: "graph_validation",
@@ -727,7 +728,7 @@ export function createSddTools(): Record<string, ToolDefinition> {
         }
 
         // Cache the result
-        cacheMgr.setAnalysisResult("validate", formatted, graph.metadata.updated_at ? new Date(graph.metadata.updated_at).getTime() : 0, graph.nodes.length)
+          cacheMgr.setAnalysisResult("validate", formatted, graphFingerprint(graph))
         recordTelemetry(ctx.directory, {
           name: "graph_validation",
           duration_ms: Date.now() - startedAt,
@@ -751,14 +752,14 @@ export function createSddTools(): Record<string, ToolDefinition> {
 
         // Check analysis cache
         const cacheMgr = getCacheManager(ctx.directory)
-        const cached = cacheMgr.getAnalysisResult("drift", graph.metadata.updated_at ? new Date(graph.metadata.updated_at).getTime() : 0, graph.nodes.length)
+          const cached = cacheMgr.getAnalysisResult("drift", graphFingerprint(graph))
         if (cached) return cached as string
 
         const result = detectDrift(graph, ctx.directory)
         const formatted = formatDriftReport(result)
 
         // Cache the result
-        cacheMgr.setAnalysisResult("drift", formatted, graph.metadata.updated_at ? new Date(graph.metadata.updated_at).getTime() : 0, graph.nodes.length)
+          cacheMgr.setAnalysisResult("drift", formatted, graphFingerprint(graph))
 
         return formatted
       },
@@ -1867,14 +1868,14 @@ export function createSddTools(): Record<string, ToolDefinition> {
 
         // Check analysis cache
         const cacheMgr = getCacheManager(ctx.directory)
-        const cached = cacheMgr.getAnalysisResult("quality", graph.metadata.updated_at ? new Date(graph.metadata.updated_at).getTime() : 0, graph.nodes.length)
+          const cached = cacheMgr.getAnalysisResult("quality", graphFingerprint(graph))
         if (cached) return cached as string
 
         const report = calculateQualityScore(graph, ctx.directory)
         const formatted = formatQualityReport(report)
 
         // Cache the result
-        cacheMgr.setAnalysisResult("quality", formatted, graph.metadata.updated_at ? new Date(graph.metadata.updated_at).getTime() : 0, graph.nodes.length)
+          cacheMgr.setAnalysisResult("quality", formatted, graphFingerprint(graph))
 
         return formatted
       },

package/src/sdd/cache/atomic.ts

@@ -0,0 +1,30 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, renameSync, writeFileSync } from "fs"
+import { dirname } from "path"
+
+/** Write a cache artifact so readers see either the old complete file or the new complete file. */
+export function atomicWriteFile(filePath: string, content: string): void {
+  const directory = dirname(filePath)
+  if (!existsSync(directory)) mkdirSync(directory, { recursive: true })
+
+  const temporaryPath = `${filePath}.tmp-${process.pid}-${Date.now()}`
+  let descriptor: number | undefined
+  try {
+    descriptor = openSync(temporaryPath, "w", 0o600)
+    writeFileSync(descriptor, content, "utf-8")
+    fsyncSync(descriptor)
+    closeSync(descriptor)
+    descriptor = undefined
+    renameSync(temporaryPath, filePath)
+  } finally {
+    if (descriptor !== undefined) {
+      try { closeSync(descriptor) } catch {}
+    }
+    try {
+      // A failed rename must not leave a misleading cache artifact behind.
+      if (existsSync(temporaryPath)) {
+        const { unlinkSync } = require("fs")
+        unlinkSync(temporaryPath)
+      }
+    } catch {}
+  }
+}

package/src/sdd/cache/fingerprint.ts

@@ -0,0 +1,98 @@
+import { createHash } from "crypto"
+import { existsSync, readFileSync, readdirSync, statSync } from "fs"
+import { join, relative } from "path"
+import type { KnowledgeGraph } from "../domain/types.js"
+
+const SOURCE_EXTENSIONS = new Set([
+  ".c", ".cc", ".cpp", ".cs", ".go", ".h", ".hpp", ".java", ".js", ".jsx",
+  ".json", ".kt", ".mjs", ".mts", ".py", ".rb", ".rs", ".svelte", ".swift",
+  ".ts", ".tsx", ".vue", ".yaml", ".yml",
+])
+
+const IGNORED_DIRECTORIES = new Set([
+  ".git", ".sdd", ".opencode", "node_modules", "dist", "build", "coverage",
+  ".cache", ".next", ".turbo", "target", "vendor",
+])
+
+export function stableSerialize(value: unknown): string {
+  if (value === null) return "null"
+  if (value === undefined) return "undefined"
+  if (typeof value !== "object") return JSON.stringify(value)
+  if (Array.isArray(value)) return `[${value.map(stableSerialize).join(",")}]`
+
+  const record = value as Record<string, unknown>
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableSerialize(record[key])}`).join(",")}}`
+}
+
+export function sha256(value: string | Uint8Array): string {
+  return createHash("sha256").update(value).digest("hex")
+}
+
+/** Deterministic content fingerprint for the complete graph, independent of YAML/SQLite formatting. */
+export function graphFingerprint(graph: KnowledgeGraph): string {
+  return sha256(stableSerialize({
+    version: graph.version,
+    project_id: graph.project_id,
+    metadata: graph.metadata,
+    nodes: [...graph.nodes].sort((a, b) => a.id.localeCompare(b.id)),
+    relationships: [...graph.relationships].sort((a, b) => a.id.localeCompare(b.id)),
+  }))
+}
+
+export function fileContentFingerprint(filePath: string): string {
+  try {
+    return sha256(readFileSync(filePath))
+  } catch {
+    return sha256(`missing:${filePath}`)
+  }
+}
+
+/** Fast identity for external-file detection; includes all files when several files are supplied. */
+export function fileSignature(filePaths: string[]): string {
+  const parts = filePaths.map((filePath) => {
+    try {
+      const stat = statSync(filePath)
+      return `${filePath}:${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`
+    } catch {
+      return `${filePath}:missing`
+    }
+  })
+  return sha256(parts.sort().join("\n"))
+}
+
+export function configFingerprint(projectDir: string): string {
+  const path = join(projectDir, ".sdd", "config.json")
+  return existsSync(path) ? fileContentFingerprint(path) : sha256("missing-config")
+}
+
+function sourceFiles(projectDir: string): string[] {
+  const files: string[] = []
+  const visit = (directory: string): void => {
+    let entries
+    try { entries = readdirSync(directory, { withFileTypes: true }) } catch { return }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) continue
+      const path = join(directory, entry.name)
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRECTORIES.has(entry.name)) visit(path)
+        continue
+      }
+      const extension = entry.name.slice(entry.name.lastIndexOf(".")).toLowerCase()
+      if (SOURCE_EXTENSIONS.has(extension)) files.push(path)
+    }
+  }
+  visit(projectDir)
+  return files.sort()
+}
+
+/** Content fingerprint for code-dependent analyses. The caller can cache this by fileSignature. */
+export function sourceFingerprint(
+  projectDir: string,
+  previous?: { fingerprint: string; signature: string } | null,
+): { fingerprint: string; signature: string } {
+  const files = sourceFiles(projectDir)
+  const signature = fileSignature(files)
+  if (previous?.signature === signature) return previous
+  const content = files.map((path) => `${relative(projectDir, path)}:${fileContentFingerprint(path)}`).join("\n")
+  return { fingerprint: sha256(content), signature }
+}