openvisio-agent 0.19.10 → 0.19.11

package/src/opencode-config.mjs

@@ -35,6 +35,7 @@ export function buildOpencodeConfig({ mcpUrl, mcpHeaders, canCode = true }) {
     skill: 'deny',
     question: 'deny',
     'openvisio-team_*': 'allow',
+    'openvisio-team-watcher_*': 'allow',
   }
   return {
     $schema: 'https://opencode.ai/config.json',

package/src/pr-push.mjs

@@ -1,9 +1,10 @@
 import { spawnSync } from 'node:child_process'
-import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { chmodSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { dirname, join, relative, isAbsolute, resolve } from 'node:path'
+import { writeJson } from './lib.mjs'
 
-const DEFAULT_AUTH_PATH = join(homedir(), '.openvisio', 'pr-push-authorizations.json')
+export const DEFAULT_AUTH_PATH = join(homedir(), '.openvisio', 'pr-push-authorizations.json')
 const DEFAULT_RULE_PATH = join(homedir(), '.codex', 'rules', 'openvisio-agent.rules')
 
 const gitText = (cwd, args, spawn = spawnSync) => {
@@ -32,7 +33,7 @@ export function isSafeAgentBranch(value) {
 
 export function codexPrPushRule() {
   return `# Generated by: openvisio-agent authorize-pr-push
-# The helper enforces an exact pre-authorized repository + origin and only
+# The helper enforces the configured workspace or exact repository + origin and only
 # pushes the current agent/* branch. It accepts no force, remote, or ref args.
 prefix_rule(
     pattern = ["openvisio-agent", "push-pr-branch"],
@@ -50,6 +51,41 @@ function readAuthorizations(path) {
   } catch { return [] }
 }
 
+function readPolicy(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')) } catch { return {} }
+}
+
+const within = (root, path) => {
+  if (!root || !path) return false
+  const rel = relative(root, path)
+  return rel === '' || (!isAbsolute(rel) && rel !== '..' && !rel.startsWith('..' + (process.platform === 'win32' ? '\\' : '/')))
+}
+
+function policyAllows(identity, policy) {
+  const roots = [identity.root, identity.commonDir].filter(Boolean)
+  if ((policy.revoked || []).some((entry) => roots.includes(entry))) return false
+  return (policy.authorizations || []).some((entry) => entry.remote === identity.remote &&
+    (entry.root === identity.root || (entry.commonDir && entry.commonDir === identity.commonDir))) ||
+    (policy.workspaces || []).some((entry) => roots.some((root) => within(entry.root, root)))
+}
+
+// Connecting a coding workspace grants routine PR delivery once, including
+// future clones and worktrees. The helper still controls branch and destination.
+export function configurePrPublishing({ workspace, enabled = true, authPath = DEFAULT_AUTH_PATH, rulePath = DEFAULT_RULE_PATH } = {}) {
+  if (!workspace) return null
+  mkdirSync(workspace, { recursive: true })
+  const root = realpathSync(workspace)
+  if (dirname(root) === root || root === homedir()) throw new Error('Choose a dedicated coding workspace, not the home directory or filesystem root.')
+  const policy = readPolicy(authPath)
+  const workspaces = (policy.workspaces || []).filter((entry) => entry.root !== root)
+  if (enabled) workspaces.push({ root })
+  if (JSON.stringify(workspaces) !== JSON.stringify(policy.workspaces || [])) {
+    writeJson(authPath, { ...policy, version: 2, workspaces }, true)
+  }
+  if (enabled) writePrivate(rulePath, codexPrPushRule())
+  return { root, enabled }
+}
+
 function writePrivate(path, value) {
   mkdirSync(dirname(path), { recursive: true })
   writeFileSync(path, value, { mode: 0o600 })
@@ -60,14 +96,15 @@ export function repositoryPushIdentity(cwd = process.cwd(), spawn = spawnSync) {
   const root = realpathSync(gitText(cwd, ['rev-parse', '--show-toplevel'], spawn))
   const remote = safeRemote(gitText(root, ['remote', 'get-url', '--push', 'origin'], spawn))
   const branch = gitText(root, ['branch', '--show-current'], spawn)
-  return { root, remote, branch }
+  const commonDir = realpathSync(resolve(root, gitText(root, ['rev-parse', '--git-common-dir'], spawn)))
+  return { root, commonDir, remote, branch }
 }
 
-export function validatePrPushAuthorization({ root, remote, branch, authorizations }) {
+export function validatePrPushAuthorization({ root, commonDir, remote, branch, authorizations, workspaces = [], revoked = [] }) {
   if (!isSafeAgentBranch(branch)) {
     throw new Error(`Refusing to push branch "${branch || '(detached HEAD)'}". OpenVisio PR pushes require the current branch to match agent/*.`)
   }
-  const allowed = (Array.isArray(authorizations) ? authorizations : []).some((entry) => entry?.root === root && entry?.remote === remote)
+  const allowed = policyAllows({ root, commonDir, remote }, { authorizations, workspaces, revoked })
   if (!allowed) {
     throw new Error(`OPENVISIO_PR_PUSH_AUTH_REQUIRED: This repository and its exact origin are not authorized. From ${root}, run: openvisio-agent authorize-pr-push`)
   }
@@ -76,37 +113,39 @@ export function validatePrPushAuthorization({ root, remote, branch, authorizatio
 
 export function repositoryHasPrPushAuthorization({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, spawn = spawnSync } = {}) {
   try {
-    const { root, remote } = repositoryPushIdentity(cwd, spawn)
-    return readAuthorizations(authPath).some((entry) => entry?.root === root && entry?.remote === remote)
+    return policyAllows(repositoryPushIdentity(cwd, spawn), readPolicy(authPath))
   } catch { return false }
 }
 
 export function authorizePrPush({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, rulePath = DEFAULT_RULE_PATH, spawn = spawnSync, now = () => new Date().toISOString() } = {}) {
-  const { root, remote } = repositoryPushIdentity(cwd, spawn)
+  const { root, commonDir, remote } = repositoryPushIdentity(cwd, spawn)
+  const policy = readPolicy(authPath)
   const authorizations = readAuthorizations(authPath).filter((entry) => entry?.root !== root)
-  authorizations.push({ root, remote, authorizedAt: now() })
-  writePrivate(authPath, JSON.stringify({ version: 1, authorizations }, null, 2) + '\n')
+  authorizations.push({ root, commonDir, remote, authorizedAt: now() })
+  writeJson(authPath, { ...policy, version: 2, authorizations, revoked: (policy.revoked || []).filter((path) => path !== root && path !== commonDir) }, true)
   writePrivate(rulePath, codexPrPushRule())
   return { root, remote, authPath, rulePath }
 }
 
 export function revokePrPush({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, spawn = spawnSync } = {}) {
-  const root = realpathSync(gitText(cwd, ['rev-parse', '--show-toplevel'], spawn))
+  const { root, commonDir } = repositoryPushIdentity(cwd, spawn)
+  const policy = readPolicy(authPath)
   const before = readAuthorizations(authPath)
   const authorizations = before.filter((entry) => entry?.root !== root)
-  if (existsSync(authPath)) writePrivate(authPath, JSON.stringify({ version: 1, authorizations }, null, 2) + '\n')
-  return { root, revoked: authorizations.length !== before.length }
+  writeJson(authPath, { ...policy, version: 2, authorizations, revoked: [...new Set([...(policy.revoked || []), commonDir])] }, true)
+  return { root, revoked: true }
 }
 
 export function pushPrBranch({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, spawn = spawnSync } = {}) {
   const identity = repositoryPushIdentity(cwd, spawn)
-  validatePrPushAuthorization({ ...identity, authorizations: readAuthorizations(authPath) })
+  validatePrPushAuthorization({ ...identity, ...readPolicy(authPath) })
   const destination = `HEAD:refs/heads/${identity.branch}`
   // The helper runs outside Codex's workspace sandbox after the user authorizes
   // it. Disable repository hooks so an edited pre-push hook cannot widen this
   // one operation into arbitrary host execution.
   const nullHooks = process.platform === 'win32' ? 'NUL' : '/dev/null'
-  const result = spawn('git', ['-c', `core.hooksPath=${nullHooks}`, 'push', '-u', 'origin', destination], { cwd: identity.root, stdio: 'inherit' })
+  // Pin the verified URL: `git push origin` may fan out to multiple pushurls.
+  const result = spawn('git', ['-c', `core.hooksPath=${nullHooks}`, 'push', '-u', identity.remote, destination], { cwd: identity.root, stdio: 'inherit' })
   if (result.status !== 0) throw new Error(`git push failed with exit code ${result.status ?? 'unknown'}`)
   return identity
 }

package/src/runner-pool.mjs

@@ -0,0 +1,38 @@
+// Bounded LRU of warm sessions, pinned while in use. Never evict an active
+// session, and never share history between tickets or conversation threads.
+export function createRunnerPool({ create, capacity = 8, idleMs = 300_000, now = Date.now }) {
+  const entries = new Map()
+  function prune() {
+    for (const [key, entry] of entries) {
+      if (!entry.busy && (now() - entry.usedAt >= idleMs || entries.size > capacity)) {
+        entry.runner.close?.()
+        entries.delete(key)
+      }
+    }
+  }
+  const timer = setInterval(prune, Math.min(idleMs, 30_000))
+  timer.unref?.()
+  return {
+    acquire(key, options) {
+      prune()
+      let entry = entries.get(key)
+      if (entry?.busy) throw new Error('Session already has an active cycle')
+      if (!entry) entry = { runner: create(options), usedAt: now(), busy: false }
+      entries.delete(key)
+      entry.busy = true
+      entries.set(key, entry)
+      prune()
+      return entry.runner
+    },
+    release(key) {
+      const entry = entries.get(key)
+      if (entry) { entry.busy = false; entry.usedAt = now() }
+      prune()
+    },
+    close() {
+      clearInterval(timer)
+      for (const entry of entries.values()) entry.runner.close?.()
+      entries.clear()
+    },
+  }
+}

package/src/task-types.mjs

@@ -0,0 +1,24 @@
+export function createTaskTypeLookup({ load, now = Date.now, ttlMs = 60_000 }) {
+  const cache = new Map(), pending = new Map()
+  return async (projectId) => {
+    const key = String(projectId)
+    const hit = cache.get(key)
+    if (hit && hit.expiresAt > now()) return hit.value
+    if (pending.has(key)) return pending.get(key)
+    const request = Promise.resolve().then(() => load(projectId)).then((data) => {
+      const types = data.types ?? data.task_types ?? data.taskTypes
+      if (!Array.isArray(types)) throw new Error('Cannot verify task columns')
+      const matching = (pattern) => new Set(types.filter((type) => pattern.test(String(type.name || ''))).map((type) => Number(type.id)))
+      const value = {
+        done: matching(/\b(?:done|complete|completed|closed|cancelled|canceled|archived|resolved)\b/i),
+        review: matching(/\b(?:review|test|testing|qa|quality\s+assurance|verification|approval)\b/i),
+      }
+      cache.delete(key)
+      cache.set(key, { value, expiresAt: now() + ttlMs })
+      while (cache.size > 100) cache.delete(cache.keys().next().value)
+      return value
+    }).finally(() => pending.delete(key))
+    pending.set(key, request)
+    return request
+  }
+}