openvisio-agent 0.19.9 → 0.19.11

package/src/memory.mjs

@@ -44,6 +44,10 @@ export function createByoMemoryGraph({ path, maxNodes = 1000, now = () => Date.n
       meta: { ...(previous?.meta || {}), ...meta },
       updatedAt: stamp,
     }
+    // Reconciliation frequently sees the same revision. Avoid rewriting both
+    // stores and appending identical context on every sweep.
+    if (previous && previous.kind === node.kind && previous.state === node.state && previous.summary === node.summary &&
+        JSON.stringify(previous.refs) === JSON.stringify(node.refs) && JSON.stringify(previous.meta) === JSON.stringify(node.meta)) return previous
     nodes.set(id, node); trim(); persist()
     return node
   }
@@ -80,7 +84,7 @@ export function createByoMemoryGraph({ path, maxNodes = 1000, now = () => Date.n
     return !!node && (state == null || node.state === state)
   }
 
-  return { remember, connect, recall, context, has, persist }
+  return { remember, connect, recall, context, has, persist, get: (key) => nodes.get(String(key)) }
 }
 
 const memoryThreadId = (refs = {}) => {
@@ -103,14 +107,14 @@ export function createMastraMemory({ ledgerPath, databasePath, resourceId, maxNo
   const storage = new LibSQLStore({ id: `openvisio-memory-${resourceId}`, url: `file:${databasePath}` })
   const memory = new Memory({ storage, options: { lastMessages: 12, semanticRecall: false, workingMemory: { enabled: false } } })
   const threads = new Map()
-  let pending = Promise.resolve()
+  const pending = new Map()
 
   const ensureThread = (threadId) => {
     if (!threads.has(threadId)) {
       threads.set(threadId, (async () => {
         const existing = await memory.getThreadById({ threadId, resourceId })
         return existing || memory.createThread({ threadId, resourceId, title: threadId })
-      })())
+      })().catch((error) => { threads.delete(threadId); throw error }))
     }
     return threads.get(threadId)
   }
@@ -118,7 +122,7 @@ export function createMastraMemory({ ledgerPath, databasePath, resourceId, maxNo
   const queueMessage = (entry) => {
     const threadId = memoryThreadId(entry?.refs)
     if (!threadId) return
-    pending = pending.then(async () => {
+    const write = (pending.get(threadId) || Promise.resolve()).then(async () => {
       await ensureThread(threadId)
       const text = `${entry.kind || 'event'} ${entry.state || 'observed'}: ${entry.summary || entry.key}`
       await memory.saveMessages({ messages: [{
@@ -126,18 +130,22 @@ export function createMastraMemory({ ledgerPath, databasePath, resourceId, maxNo
         content: { format: 2, parts: [{ type: 'text', text }], metadata: { openvisioKey: entry.key } },
       }] })
     }).catch(() => { /* memory is best-effort; live backend checks stay authoritative */ })
+    pending.set(threadId, write)
+    void write.finally(() => { if (pending.get(threadId) === write) pending.delete(threadId) })
   }
 
   const remember = (entry) => {
+    const previous = ledger.get(entry.key)
     const node = ledger.remember(entry)
-    if (node) queueMessage(node)
+    if (node && node !== previous) queueMessage(node)
     return node
   }
 
   const context = async (refs = {}, limit = 8) => {
     const threadId = memoryThreadId(refs)
     if (!threadId) return ''
-    await pending
+    // Writes for unrelated tickets must never delay a conversation reply.
+    await pending.get(threadId)
     try {
       const recalled = await memory.recall({ threadId, resourceId, perPage: limit })
       const items = recalled.messages.map(messageText).filter(Boolean).slice(-limit)
@@ -146,6 +154,6 @@ export function createMastraMemory({ ledgerPath, databasePath, resourceId, maxNo
     return ledger.context(refs, limit)
   }
 
-  const settled = async () => { await pending; await memory.settled() }
+  const settled = async () => { await Promise.all(pending.values()); await memory.settled() }
   return { remember, connect: ledger.connect, recall: ledger.recall, context, has: ledger.has, persist: ledger.persist, settled, provider: 'mastra-libsql' }
 }

package/src/opencode-config.mjs

@@ -35,6 +35,7 @@ export function buildOpencodeConfig({ mcpUrl, mcpHeaders, canCode = true }) {
     skill: 'deny',
     question: 'deny',
     'openvisio-team_*': 'allow',
+    'openvisio-team-watcher_*': 'allow',
   }
   return {
     $schema: 'https://opencode.ai/config.json',

package/src/pr-push.mjs

@@ -1,9 +1,10 @@
 import { spawnSync } from 'node:child_process'
-import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { chmodSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { dirname, join, relative, isAbsolute, resolve } from 'node:path'
+import { writeJson } from './lib.mjs'
 
-const DEFAULT_AUTH_PATH = join(homedir(), '.openvisio', 'pr-push-authorizations.json')
+export const DEFAULT_AUTH_PATH = join(homedir(), '.openvisio', 'pr-push-authorizations.json')
 const DEFAULT_RULE_PATH = join(homedir(), '.codex', 'rules', 'openvisio-agent.rules')
 
 const gitText = (cwd, args, spawn = spawnSync) => {
@@ -32,7 +33,7 @@ export function isSafeAgentBranch(value) {
 
 export function codexPrPushRule() {
   return `# Generated by: openvisio-agent authorize-pr-push
-# The helper enforces an exact pre-authorized repository + origin and only
+# The helper enforces the configured workspace or exact repository + origin and only
 # pushes the current agent/* branch. It accepts no force, remote, or ref args.
 prefix_rule(
     pattern = ["openvisio-agent", "push-pr-branch"],
@@ -50,6 +51,41 @@ function readAuthorizations(path) {
   } catch { return [] }
 }
 
+function readPolicy(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')) } catch { return {} }
+}
+
+const within = (root, path) => {
+  if (!root || !path) return false
+  const rel = relative(root, path)
+  return rel === '' || (!isAbsolute(rel) && rel !== '..' && !rel.startsWith('..' + (process.platform === 'win32' ? '\\' : '/')))
+}
+
+function policyAllows(identity, policy) {
+  const roots = [identity.root, identity.commonDir].filter(Boolean)
+  if ((policy.revoked || []).some((entry) => roots.includes(entry))) return false
+  return (policy.authorizations || []).some((entry) => entry.remote === identity.remote &&
+    (entry.root === identity.root || (entry.commonDir && entry.commonDir === identity.commonDir))) ||
+    (policy.workspaces || []).some((entry) => roots.some((root) => within(entry.root, root)))
+}
+
+// Connecting a coding workspace grants routine PR delivery once, including
+// future clones and worktrees. The helper still controls branch and destination.
+export function configurePrPublishing({ workspace, enabled = true, authPath = DEFAULT_AUTH_PATH, rulePath = DEFAULT_RULE_PATH } = {}) {
+  if (!workspace) return null
+  mkdirSync(workspace, { recursive: true })
+  const root = realpathSync(workspace)
+  if (dirname(root) === root || root === homedir()) throw new Error('Choose a dedicated coding workspace, not the home directory or filesystem root.')
+  const policy = readPolicy(authPath)
+  const workspaces = (policy.workspaces || []).filter((entry) => entry.root !== root)
+  if (enabled) workspaces.push({ root })
+  if (JSON.stringify(workspaces) !== JSON.stringify(policy.workspaces || [])) {
+    writeJson(authPath, { ...policy, version: 2, workspaces }, true)
+  }
+  if (enabled) writePrivate(rulePath, codexPrPushRule())
+  return { root, enabled }
+}
+
 function writePrivate(path, value) {
   mkdirSync(dirname(path), { recursive: true })
   writeFileSync(path, value, { mode: 0o600 })
@@ -60,14 +96,15 @@ export function repositoryPushIdentity(cwd = process.cwd(), spawn = spawnSync) {
   const root = realpathSync(gitText(cwd, ['rev-parse', '--show-toplevel'], spawn))
   const remote = safeRemote(gitText(root, ['remote', 'get-url', '--push', 'origin'], spawn))
   const branch = gitText(root, ['branch', '--show-current'], spawn)
-  return { root, remote, branch }
+  const commonDir = realpathSync(resolve(root, gitText(root, ['rev-parse', '--git-common-dir'], spawn)))
+  return { root, commonDir, remote, branch }
 }
 
-export function validatePrPushAuthorization({ root, remote, branch, authorizations }) {
+export function validatePrPushAuthorization({ root, commonDir, remote, branch, authorizations, workspaces = [], revoked = [] }) {
   if (!isSafeAgentBranch(branch)) {
     throw new Error(`Refusing to push branch "${branch || '(detached HEAD)'}". OpenVisio PR pushes require the current branch to match agent/*.`)
   }
-  const allowed = (Array.isArray(authorizations) ? authorizations : []).some((entry) => entry?.root === root && entry?.remote === remote)
+  const allowed = policyAllows({ root, commonDir, remote }, { authorizations, workspaces, revoked })
   if (!allowed) {
     throw new Error(`OPENVISIO_PR_PUSH_AUTH_REQUIRED: This repository and its exact origin are not authorized. From ${root}, run: openvisio-agent authorize-pr-push`)
   }
@@ -76,37 +113,39 @@ export function validatePrPushAuthorization({ root, remote, branch, authorizatio
 
 export function repositoryHasPrPushAuthorization({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, spawn = spawnSync } = {}) {
   try {
-    const { root, remote } = repositoryPushIdentity(cwd, spawn)
-    return readAuthorizations(authPath).some((entry) => entry?.root === root && entry?.remote === remote)
+    return policyAllows(repositoryPushIdentity(cwd, spawn), readPolicy(authPath))
   } catch { return false }
 }
 
 export function authorizePrPush({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, rulePath = DEFAULT_RULE_PATH, spawn = spawnSync, now = () => new Date().toISOString() } = {}) {
-  const { root, remote } = repositoryPushIdentity(cwd, spawn)
+  const { root, commonDir, remote } = repositoryPushIdentity(cwd, spawn)
+  const policy = readPolicy(authPath)
   const authorizations = readAuthorizations(authPath).filter((entry) => entry?.root !== root)
-  authorizations.push({ root, remote, authorizedAt: now() })
-  writePrivate(authPath, JSON.stringify({ version: 1, authorizations }, null, 2) + '\n')
+  authorizations.push({ root, commonDir, remote, authorizedAt: now() })
+  writeJson(authPath, { ...policy, version: 2, authorizations, revoked: (policy.revoked || []).filter((path) => path !== root && path !== commonDir) }, true)
   writePrivate(rulePath, codexPrPushRule())
   return { root, remote, authPath, rulePath }
 }
 
 export function revokePrPush({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, spawn = spawnSync } = {}) {
-  const root = realpathSync(gitText(cwd, ['rev-parse', '--show-toplevel'], spawn))
+  const { root, commonDir } = repositoryPushIdentity(cwd, spawn)
+  const policy = readPolicy(authPath)
   const before = readAuthorizations(authPath)
   const authorizations = before.filter((entry) => entry?.root !== root)
-  if (existsSync(authPath)) writePrivate(authPath, JSON.stringify({ version: 1, authorizations }, null, 2) + '\n')
-  return { root, revoked: authorizations.length !== before.length }
+  writeJson(authPath, { ...policy, version: 2, authorizations, revoked: [...new Set([...(policy.revoked || []), commonDir])] }, true)
+  return { root, revoked: true }
 }
 
 export function pushPrBranch({ cwd = process.cwd(), authPath = DEFAULT_AUTH_PATH, spawn = spawnSync } = {}) {
   const identity = repositoryPushIdentity(cwd, spawn)
-  validatePrPushAuthorization({ ...identity, authorizations: readAuthorizations(authPath) })
+  validatePrPushAuthorization({ ...identity, ...readPolicy(authPath) })
   const destination = `HEAD:refs/heads/${identity.branch}`
   // The helper runs outside Codex's workspace sandbox after the user authorizes
   // it. Disable repository hooks so an edited pre-push hook cannot widen this
   // one operation into arbitrary host execution.
   const nullHooks = process.platform === 'win32' ? 'NUL' : '/dev/null'
-  const result = spawn('git', ['-c', `core.hooksPath=${nullHooks}`, 'push', '-u', 'origin', destination], { cwd: identity.root, stdio: 'inherit' })
+  // Pin the verified URL: `git push origin` may fan out to multiple pushurls.
+  const result = spawn('git', ['-c', `core.hooksPath=${nullHooks}`, 'push', '-u', identity.remote, destination], { cwd: identity.root, stdio: 'inherit' })
   if (result.status !== 0) throw new Error(`git push failed with exit code ${result.status ?? 'unknown'}`)
   return identity
 }

package/src/runner-pool.mjs

@@ -0,0 +1,38 @@
+// Bounded LRU of warm sessions, pinned while in use. Never evict an active
+// session, and never share history between tickets or conversation threads.
+export function createRunnerPool({ create, capacity = 8, idleMs = 300_000, now = Date.now }) {
+  const entries = new Map()
+  function prune() {
+    for (const [key, entry] of entries) {
+      if (!entry.busy && (now() - entry.usedAt >= idleMs || entries.size > capacity)) {
+        entry.runner.close?.()
+        entries.delete(key)
+      }
+    }
+  }
+  const timer = setInterval(prune, Math.min(idleMs, 30_000))
+  timer.unref?.()
+  return {
+    acquire(key, options) {
+      prune()
+      let entry = entries.get(key)
+      if (entry?.busy) throw new Error('Session already has an active cycle')
+      if (!entry) entry = { runner: create(options), usedAt: now(), busy: false }
+      entries.delete(key)
+      entry.busy = true
+      entries.set(key, entry)
+      prune()
+      return entry.runner
+    },
+    release(key) {
+      const entry = entries.get(key)
+      if (entry) { entry.busy = false; entry.usedAt = now() }
+      prune()
+    },
+    close() {
+      clearInterval(timer)
+      for (const entry of entries.values()) entry.runner.close?.()
+      entries.clear()
+    },
+  }
+}

package/src/task-types.mjs

@@ -0,0 +1,24 @@
+export function createTaskTypeLookup({ load, now = Date.now, ttlMs = 60_000 }) {
+  const cache = new Map(), pending = new Map()
+  return async (projectId) => {
+    const key = String(projectId)
+    const hit = cache.get(key)
+    if (hit && hit.expiresAt > now()) return hit.value
+    if (pending.has(key)) return pending.get(key)
+    const request = Promise.resolve().then(() => load(projectId)).then((data) => {
+      const types = data.types ?? data.task_types ?? data.taskTypes
+      if (!Array.isArray(types)) throw new Error('Cannot verify task columns')
+      const matching = (pattern) => new Set(types.filter((type) => pattern.test(String(type.name || ''))).map((type) => Number(type.id)))
+      const value = {
+        done: matching(/\b(?:done|complete|completed|closed|cancelled|canceled|archived|resolved)\b/i),
+        review: matching(/\b(?:review|test|testing|qa|quality\s+assurance|verification|approval)\b/i),
+      }
+      cache.delete(key)
+      cache.set(key, { value, expiresAt: now() + ttlMs })
+      while (cache.size > 100) cache.delete(cache.keys().next().value)
+      return value
+    }).finally(() => pending.delete(key))
+    pending.set(key, request)
+    return request
+  }
+}