openwork-server 0.18.57 → 0.18.58

package/dist/opencode-plugins/opencode-stop-fence-client.js

@@ -0,0 +1,6 @@
+/** The installed V1 extension checks its owned session before model dispatch. */
+export async function assertSessionContinuation(post, input) {
+    if (!input.directory)
+        return;
+    await post("/experimental/session-stop-fence/check", input, AbortSignal.timeout(15_000));
+}

package/dist/opencode-plugins/openwork-cloud-skills-v2.js

@@ -0,0 +1,114 @@
+import { z } from "zod";
+const catalogSchema = z.object({
+    skills: z.array(z.object({
+        name: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).max(64),
+        title: z.string().optional(),
+        description: z.string(),
+        capability: z.string().regex(/^(?:skill:[^:]+|plugin:[^:]+:[^:]+)$/),
+        modelDiscovery: z.boolean().optional(),
+    })),
+});
+/** Only discovery metadata is registered. Never cache a Cloud skill body or
+ * authorization decision: even an old model snapshot must retrieve the body
+ * from Den, which rechecks member access on every get_skill call. */
+export function discoverySkills(value) {
+    const catalog = catalogSchema.parse(value);
+    let remaining = 24_000;
+    const result = [];
+    for (const skill of catalog.skills.filter(skill => skill.modelDiscovery === true).sort((a, b) => a.name.localeCompare(b.name))) {
+        if (result.length === 150)
+            break;
+        const name = (skill.title || skill.name).replace(/\s+/g, " ").trim().slice(0, 128);
+        const description = (skill.description || name).replace(/\s+/g, " ").trim().slice(0, 200);
+        const cost = skill.name.length + name.length + description.length;
+        if (cost > remaining)
+            break;
+        remaining -= cost;
+        result.push({
+            id: `openwork-cloud-${skill.name}`,
+            name,
+            description,
+            // Not SKILL.md: the native skill tool must not scan a fake directory.
+            // The pinned v2 beta uses location (newer upstream versions use path).
+            location: `/openwork/remote-skills/${skill.name}.md`,
+            content: [
+                "This is discovery metadata, NOT the skill's instructions or proof of access.",
+                `Retrieve the current full skill through OpenWork Connect get_skill with ${JSON.stringify({ name: skill.capability })}.`,
+                "Use get_skill directly when exposed, or through execute with its exact Code Mode catalog path. Only search inside execute if get_skill is not already listed; do not guess a tool name.",
+                "Read the returned SKILL.md before doing the task. Do not substitute these metadata for the instructions.",
+                "If the fetch is denied, unavailable, or the skill was removed, do not use it. Explain the failure; never recover its body from files or previous context.",
+            ].join("\n"),
+        });
+    }
+    return result;
+}
+/** Setup only starts background discovery, not a network dependency. Do not
+ * touch the native registry until opted-in metadata arrives: the off path must
+ * leave local skill discovery alone, including its cold initialization.
+ * No storage, configuration rewrite, watcher, or admission hook is involved. */
+export async function registerCloudSkillDiscovery(context) {
+    let skills = [];
+    let fingerprint = "[]";
+    let closed = false;
+    let refreshing = false;
+    const controller = new AbortController();
+    let registration;
+    const refresh = async () => {
+        if (closed || refreshing)
+            return;
+        refreshing = true;
+        try {
+            const response = await fetch(context.options.url, {
+                method: "POST", redirect: "error",
+                signal: AbortSignal.any([controller.signal, AbortSignal.timeout(10_000)]),
+                headers: { Authorization: `Bearer ${context.options.token}`, "Content-Type": "application/json" },
+                body: JSON.stringify({ name: "openwork_skills", input: {} }),
+            });
+            if (!response.ok)
+                return;
+            const next = discoverySkills(await response.json());
+            const key = JSON.stringify(next);
+            if (closed || key === fingerprint)
+                return;
+            skills = next;
+            if (skills.length === 0) {
+                const current = registration;
+                registration = undefined;
+                await current?.dispose();
+            }
+            else if (!registration) {
+                const current = await context.skill.transform(editor => {
+                    for (const skill of skills)
+                        if (!editor.get(skill.id))
+                            editor.add(skill);
+                });
+                if (closed) {
+                    await current.dispose();
+                    return;
+                }
+                registration = current;
+            }
+            else {
+                await context.skill.reload();
+            }
+            fingerprint = key;
+        }
+        catch {
+            // Cloud readiness is never a prerequisite to chatting. No body or access
+            // grant is cached, so keeping old discovery hints cannot bypass Den.
+        }
+        finally {
+            refreshing = false;
+        }
+    };
+    const timer = setInterval(() => void refresh(), 30_000);
+    timer.unref();
+    void refresh();
+    return async () => {
+        closed = true;
+        clearInterval(timer);
+        controller.abort();
+        skills = [];
+        await registration?.dispose();
+    };
+}

package/dist/opencode-plugins/openwork-codemode-discovery-v2.js

@@ -0,0 +1,60 @@
+import { tsPlugin } from "@sveltejs/acorn-typescript";
+import { Parser } from "acorn";
+// The engine transpiles scripts as TypeScript, so annotated scripts must parse here too.
+const ScriptParser = Parser.extend(tsPlugin());
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function bindsDiscovery(value) {
+    if (!record(value))
+        return false;
+    if (value.type === "Identifier")
+        return value.name === "tools" || value.name === "search";
+    if (value.type === "Property")
+        return bindsDiscovery(value.value);
+    if (value.type === "AssignmentPattern")
+        return bindsDiscovery(value.left);
+    return Object.values(value).some(entry => Array.isArray(entry) ? entry.some(bindsDiscovery) : bindsDiscovery(entry));
+}
+/** The pinned engine has a bare search() intrinsic, but no tools.search alias.
+ * Rewrite syntax before execution, never retry a script that may have written.
+ * Source ranges leave strings, comments, and unrelated tool paths unchanged. */
+export function nativeDiscoveryCode(code) {
+    if (!code.includes("search"))
+        return code;
+    let tree;
+    try {
+        tree = ScriptParser.parse(code, { ecmaVersion: "latest", locations: true, allowAwaitOutsideFunction: true, allowReturnOutsideFunction: true });
+    }
+    catch {
+        // Let the engine own syntax diagnostics.
+        return code;
+    }
+    const ranges = [];
+    let shadowed = false;
+    function visit(value) {
+        if (!record(value))
+            return;
+        if ((value.type === "VariableDeclarator" || value.type === "FunctionDeclaration" || value.type === "FunctionExpression" || value.type === "ClassDeclaration" || value.type === "ClassExpression") && bindsDiscovery(value.id)
+            || value.type === "CatchClause" && bindsDiscovery(value.param)
+            || Array.isArray(value.params) && value.params.some(bindsDiscovery))
+            shadowed = true;
+        if (value.type === "MemberExpression" && record(value.object) && value.object.type === "Identifier" && value.object.name === "tools"
+            && record(value.property) && (value.computed === true ? value.property.type === "Literal" && value.property.value === "search"
+            : value.property.type === "Identifier" && value.property.name === "search")
+            && typeof value.start === "number" && typeof value.end === "number")
+            ranges.push({ start: value.start, end: value.end });
+        for (const entry of Object.values(value)) {
+            if (Array.isArray(entry))
+                entry.forEach(visit);
+            else
+                visit(entry);
+        }
+    }
+    visit(tree);
+    if (shadowed)
+        return code;
+    for (const { start, end } of ranges.sort((left, right) => right.start - left.start))
+        code = code.slice(0, start) + "search" + code.slice(end);
+    return code;
+}