ostacky 0.7.3 → 0.8.0

package/assets/mcp/ostacky-controller/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ostacky-controller",
-    "version": "0.7.3",
+    "version": "0.8.0",
     "private": true,
     "type": "module",
     "dependencies": {

package/assets/mcp/ostacky-controller/security.js

@@ -0,0 +1,87 @@
+/**
+ * security.js — source-of-truth mirror of src/security.ts for controller (Node)
+ * Generado desde src/security.ts — mantener sincronizado via `bun run hash:check` y test controller-source
+ */
+
+export const SENSITIVE_DEFAULT = [
+  "**/.env*",
+  "**/.secrets/**",
+  "**/*.pem",
+  "**/*.key",
+  "**/.aws/**",
+  "**/.ssh/**",
+  "**/credentials.json",
+  "**/.npmrc",
+];
+
+export const BASH_SENSITIVE_RE =
+  /(?:^|[^a-zA-Z0-9_.-])(\.env(\b|[_.-])|\.secrets\b|\.pem\b|\.key\b|credentials\.json|\.aws\b|\.ssh\b|\.npmrc\b)/i;
+
+export function isSensitive(filePath, patterns = SENSITIVE_DEFAULT) {
+  if (!filePath) return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  const lower = normalized.toLowerCase();
+  if (
+    lower.endsWith(".env.example") ||
+    lower.endsWith(".env.template") ||
+    lower.endsWith(".env.sample")
+  )
+    return false;
+  const base = lower.split("/").pop() || "";
+  for (const pat of patterns) {
+    if (pat.includes(".env") && base.startsWith(".env")) return true;
+    if (pat.includes(".secrets") && lower.includes(".secrets")) return true;
+    if (pat.includes("*.pem") && lower.endsWith(".pem")) return true;
+    if (pat.includes("*.key") && lower.endsWith(".key")) return true;
+    if (pat.includes(".aws") && lower.includes(".aws")) return true;
+    if (pat.includes(".ssh") && lower.includes(".ssh")) return true;
+    if (pat.includes("credentials.json") && lower.endsWith("credentials.json")) return true;
+    if (pat.includes(".npmrc") && lower.endsWith(".npmrc")) return true;
+  }
+  if (/\.(pem|key)$/i.test(normalized)) return true;
+  if (base.startsWith(".env")) return true;
+  return false;
+}
+
+export function extractPathsFromBash(cmd) {
+  if (!cmd) return [];
+  const normalized = cmd.replace(/&&/g, ";").replace(/\|\|/g, ";");
+  const segments = normalized.split(/[|;><\n]+/);
+  const paths = [];
+  for (const seg of segments) {
+    const trimmed = seg.trim();
+    if (!trimmed) continue;
+    const tokens = trimmed.match(/(?:[^\s"'`\\]+|"[^"]*"|'[^']*'|`[^`]*`)+/g) || [];
+    for (let token of tokens) {
+      const stripped = token.replace(/["'`]/g, "").replace(/\\/g, "");
+      if (!stripped) continue;
+      if (["cat","grep","ls","echo","awk","sed","cut","head","tail","wc","find","xargs","bash","sh","zsh","env","printenv","node","bun","npm","npx","ls"].includes(stripped)) continue;
+      if (stripped.startsWith("-")) continue;
+      const lower = stripped.toLowerCase();
+      if (
+        stripped.includes("/") ||
+        stripped.includes(".") ||
+        lower.startsWith(".env") ||
+        lower.includes(".secrets") ||
+        lower.endsWith(".pem") ||
+        lower.endsWith(".key") ||
+        lower.includes(".aws") ||
+        lower.includes(".ssh") ||
+        lower.endsWith("credentials.json") ||
+        lower.endsWith(".npmrc")
+      ) {
+        const cleaned = stripped.replace(/[,:;)\]]+$/, "");
+        if (cleaned) paths.push(cleaned);
+      } else if (stripped === ".env") {
+        paths.push(stripped);
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
+
+export function getSensitivePatterns() {
+  const raw = process.env.OSTACKY_SENSITIVE_PATTERNS;
+  if (!raw) return SENSITIVE_DEFAULT;
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}

package/assets/plugins/engram.ts

@@ -54,86 +54,17 @@ const ENGRAM_TOOLS = new Set([
 ])
 
 // ─── Memory Instructions ─────────────────────────────────────────────────────
-// These get injected into the agent's context so it knows to call mem_save.
+// Lazy: full protocol lives in assets/docs/engram-protocol.md (on-demand via Read).
+// System injects only pointer + nudge, not full 1.2k. Source-of-truth: src/tiered.ts for isTrivial.
 
-const MEMORY_INSTRUCTIONS = `## Engram Persistent Memory — Protocol
+const MEMORY_POINTER = "Engram disponible — para formato mem_save/mem_search lee assets/docs/engram-protocol.md (on-demand). Usa mem_search proactivamente si el tema pudo verse antes."
+const MEMORY_INSTRUCTIONS_LAZY = `## Engram — pointer (lazy)
 
-You have access to Engram, a persistent memory system that survives across sessions and compactions.
+${MEMORY_POINTER}
 
-### WHEN TO SAVE (mandatory — not optional)
-
-Call \`mem_save\` IMMEDIATELY after any of these:
-- Bug fix completed
-- Architecture or design decision made
-- Non-obvious discovery about the codebase
-- Configuration change or environment setup
-- Pattern established (naming, structure, convention)
-- User preference or constraint learned
-
-Format for \`mem_save\`:
-- **title**: Verb + what — short, searchable (e.g. "Fixed N+1 query in UserList", "Chose Zustand over Redux")
-- **type**: bugfix | decision | architecture | discovery | pattern | config | preference
-- **scope**: \`project\` (default) | \`personal\`
-- **topic_key** (optional, recommended for evolving decisions): stable key like \`architecture/auth-model\`
-- **content**:
-  **What**: One sentence — what was done
-  **Why**: What motivated it (user request, bug, performance, etc.)
-  **Where**: Files or paths affected
-  **Learned**: Gotchas, edge cases, things that surprised you (omit if none)
-
-Topic rules:
-- Different topics must not overwrite each other (e.g. architecture vs bugfix)
-- Reuse the same \`topic_key\` to update an evolving topic instead of creating new observations
-- If unsure about the key, call \`mem_suggest_topic_key\` first and then reuse it
-- Use \`mem_update\` when you have an exact observation ID to correct
-
-### WHEN TO SEARCH MEMORY
-
-When the user asks to recall something — any variation of "remember", "recall", "what did we do",
-"how did we solve", or the equivalent in the user's language, or references to past work:
-1. First call \`mem_context\` — checks recent session history (fast, cheap)
-2. If not found, call \`mem_search\` with relevant keywords (FTS5 full-text search)
-3. If you find a match, use \`mem_get_observation\` for full untruncated content
-
-Also search memory PROACTIVELY when:
-- Starting work on something that might have been done before
-- The user mentions a topic you have no context on — check if past sessions covered it
-- The user's FIRST message references the project, a feature, or a problem — call \`mem_search\` with keywords from their message to check for prior work before responding
-
-### SESSION CLOSE PROTOCOL (mandatory)
-
-Before ending a session or saying "done" / "that's it", you MUST:
-1. Call \`mem_session_summary\` with this structure:
-
-## Goal
-[What we were working on this session]
-
-## Instructions
-[User preferences or constraints discovered — skip if none]
-
-## Discoveries
-- [Technical findings, gotchas, non-obvious learnings]
-
-## Accomplished
-- [Completed items with key details]
-
-## Next Steps
-- [What remains to be done — for the next session]
-
-## Relevant Files
-- path/to/file — [what it does or what changed]
-
-This is NOT optional. If you skip this, the next session starts blind.
-
-### AFTER COMPACTION
-
-If you see a message about compaction or context reset, or if you see "FIRST ACTION REQUIRED" in your context:
-1. IMMEDIATELY call \`mem_session_summary\` with the compacted summary content — this persists what was done before compaction
-2. Then call \`mem_context\` to recover any additional context from previous sessions
-3. Only THEN continue working
-
-Do not skip step 1. Without it, everything done before compaction is lost from memory.
-`
+Cuando necesites guardar/buscar, lee el protocolo completo con Read. No alucines formato.`
+// Compat: keep full for fallback if file missing — but never inject full in system.transform
+const MEMORY_INSTRUCTIONS = MEMORY_INSTRUCTIONS_LAZY
 
 // ─── HTTP Client ─────────────────────────────────────────────────────────────
 
@@ -270,6 +201,26 @@ export const Engram: Plugin = async (ctx) => {
   // inflation (e.g. 170 sessions for 1 real conversation, issue #116).
   const subAgentSessions = new Set<string>()
 
+  // Tiered cache-friendly: single source of truth via src/tiered.ts
+  const trivialBySession = new Map<string, boolean>()
+  // isTrivial y getControllerState importados lógicamente desde src/tiered.ts
+  // Inlined para evitar import dinámico en plugin bundle — mantener regex idéntico a src/tiered.ts
+  function isTrivialMessage(msg: string, state: string): boolean {
+    if (!msg || state !== "DONE") return false
+    if (msg.trim().length >= 30) return false
+    if (!/^(hola|hey|gracias|buenas|hi|hello)\b/i.test(msg.trim())) return false
+    if (/(necesito|quiero|agregá|fix|bug|feature|auth|spec|implementar)/i.test(msg)) return false
+    return true
+  }
+  function getControllerState(directory: string): string {
+    try {
+      const statePath = process.env.OSTACKY_STATE_PATH || join(directory, ".opencode", "ostacky-state.json")
+      const raw = readFileSync(statePath, "utf-8")
+      const j = JSON.parse(raw)
+      return j.state ?? "DONE"
+    } catch { return "DONE" }
+  }
+
   /**
    * Ensure a session exists in engram. Idempotent — calls POST /sessions
    * which uses INSERT OR IGNORE. Safe to call multiple times.
@@ -407,6 +358,12 @@ export const Engram: Plugin = async (ctx) => {
 
       const finalContent = content || fallback
 
+      // Tiered: set trivial flag for system.transform lazy
+      try {
+        const state = getControllerState(ctx.directory)
+        trivialBySession.set(sessionId, isTrivialMessage(finalContent, state))
+      } catch {}
+
       // Only capture non-trivial prompts (>10 chars)
       if (finalContent.length > 10) {
         await ensureSession(sessionId)
@@ -465,13 +422,24 @@ export const Engram: Plugin = async (ctx) => {
     // messages that would break these models. See: GitHub issue #23.
 
     "experimental.chat.system.transform": async (input, output) => {
+      // Tiered lazy: SIEMPRE pointer (cache-friendly, ~1 línea). Full vive en assets/docs/engram-protocol.md on-demand.
+      const sessionId: string = (input as any).sessionID ?? ""
+      const isTrivial = trivialBySession.get(sessionId) ?? false
+      const state = getControllerState(ctx.directory)
+      const shouldBeTrivial = isTrivial && state === "DONE"
+      const pointer = shouldBeTrivial
+        ? "Engram disponible — detalles a demanda (usa mem_search si necesitas recordar)."
+        : MEMORY_POINTER
       if (output.system.length > 0) {
-        output.system[output.system.length - 1] += "\n\n" + MEMORY_INSTRUCTIONS
+        output.system[output.system.length - 1] += "\n\n" + pointer
       } else {
-        output.system.push(MEMORY_INSTRUCTIONS)
+        output.system.push(pointer)
       }
+      // No inyectar MEMORY_INSTRUCTIONS completo nunca — se lee on-demand via Read
 
       // ── Save nudge ──────────────────────────────────────────────────────────
+      // Skip nudge for trivial greeting (cache-friendly, no extra injection)
+      if (shouldBeTrivial) return
       // If it has been a long time since the last mem_save, append a reminder
       // to the system prompt so the agent notices. All fetches are fire-and-
       // forget with short timeouts — any failure silently skips the nudge.

package/assets/plugins/ostacky-guard.ts

@@ -1,131 +1,18 @@
 /**
- * Ostacky Guard — plugin hermano de Engram
- *
- * Bloquea lecturas sensibles sin autorización previa y bloquea cualquier tool
- * cuando el controller está en estado PENDING.
- *
- * Se registra en `tool.execute.before` y lanza Error si la operación no está
- * permitida. OpenCode aborta el tool antes de tocar disco.
+ * @deprecated Fusionado en ostacky-plugin.ts — re-export legacy.
+ * Single source: importa desde src/security.ts vía controller.
+ * Fresh install solo escribe ostacky-plugin.ts + engram.ts.
+ * Este archivo no debe ser instalado por ostacky install (deprecado).
  */
 
 import type { Plugin } from "@opencode-ai/plugin"
-import { readFileSync, existsSync } from "node:fs"
-import { join, dirname, basename, resolve, relative } from "node:path"
 
-const SENSITIVE_DEFAULT = [
-  "**/.env*",
-  "**/.secrets/**",
-  "**/*.pem",
-  "**/*.key",
-  "**/.aws/**",
-  "**/.ssh/**",
-  "**/credentials.json",
-  "**/.npmrc",
-]
+// Re-export controller como guard por compatibilidad — no duplica isSensitive/BASH_SENSITIVE_RE
+export { OstackyController as OstackyGuard } from "./ostacky-plugin.ts"
 
-function getEnvPatterns(): string[] {
-  const raw = process.env.OSTACKY_SENSITIVE_PATTERNS
-  if (!raw) return SENSITIVE_DEFAULT
-  return raw.split(",").map((s) => s.trim()).filter(Boolean)
-}
+// También export default por compatibilidad con loaders que esperan default
+import { OstackyController } from "./ostacky-plugin.ts"
+export default OstackyController
 
-function isSensitive(filePath: string, patterns: string[]): boolean {
-  if (!filePath) return false
-  const lower = filePath.toLowerCase()
-  if (lower.endsWith(".env.example") || lower.endsWith(".env.template") || lower.endsWith(".env.sample")) return false
-  for (const pat of patterns) {
-    if (pat.includes(".env") && lower.split("/").pop()!.startsWith(".env")) return true
-    if (pat.includes(".secrets") && lower.includes(".secrets")) return true
-    if (pat.includes("*.pem") && lower.endsWith(".pem")) return true
-    if (pat.includes("*.key") && lower.endsWith(".key")) return true
-    if (pat.includes(".aws") && lower.includes(".aws")) return true
-    if (pat.includes(".ssh") && lower.includes(".ssh")) return true
-    if (pat.includes("credentials.json") && lower.endsWith("credentials.json")) return true
-    if (pat.includes(".npmrc") && lower.endsWith(".npmrc")) return true
-  }
-  if (/\.(pem|key)$/i.test(filePath)) return true
-  if (filePath.includes(".env")) {
-    const base = filePath.split("/").pop() || ""
-    if (base.startsWith(".env")) return true
-  }
-  return false
-}
-
-function getStatePath(directory: string): string {
-  if (process.env.OSTACKY_STATE_PATH) return process.env.OSTACKY_STATE_PATH
-  // try opencode.json
-  const candidates = [join(directory, "opencode.json"), join(directory, "opencode.jsonc")]
-  for (const cand of candidates) {
-    try {
-      const raw = readFileSync(cand, "utf-8")
-      // naive parse, ignore comments
-      const json = JSON.parse(raw.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, ""))
-      const envPath = (json as any)?.mcp?.["ostacky-controller"]?.environment?.OSTACKY_STATE_PATH
-      if (typeof envPath === "string" && envPath) return envPath
-    } catch {}
-  }
-  return join(directory, ".opencode", "ostacky-state.json")
-}
-
-function readState(directory: string): any | null {
-  const p = getStatePath(directory)
-  try {
-    const raw = readFileSync(p, "utf-8")
-    return JSON.parse(raw)
-  } catch {
-    return null
-  }
-}
-
-export const OstackyGuard: Plugin = async (ctx) => {
-  const patterns = getEnvPatterns()
-
-  return {
-    "tool.execute.before": async (input, output) => {
-      const tool = (input as any).tool as string
-      const args = (input as any).args as any
-
-      // Extraer filePath de args según tool
-      let filePath: string | undefined
-      if (tool === "read" || tool === "read_mcp_resource" || tool === "grep" || tool === "glob") {
-        filePath = args?.filePath || args?.path || args?.pattern || args?.uri || ""
-        // Para grep, el pattern puede ser contenido, no file; intentar detectar file
-        if (tool === "grep" && args?.include) filePath = args.include
-        if (tool === "read_mcp_resource" && typeof args?.uri === "string") {
-          // uri puede ser file:// o path
-          try {
-            const u = args.uri as string
-            if (u.startsWith("file://")) filePath = u.slice(7)
-            else if (u.includes("/") ) filePath = u
-          } catch {}
-        }
-      }
-
-      // 10.2: Guard genérico de PENDING — bloquear cualquier tool no-controller cuando estado es PENDING
-      const state = readState(ctx.directory)
-      const pendingStates = ["ROUTE_DECISION_PENDING", "EXECUTION_DECISION_PENDING", "CLARIFICATION_PENDING"]
-      if (state && pendingStates.includes(state.state)) {
-        // Permitir solo tools del controller que desbloquean
-        const allowedTools = ["consume_route_decision", "consume_execution_decision", "record_clarification", "abandon", "check_file_access", "consume_file_access_decision", "record_user_confirmation"]
-        const isControllerTool = tool.startsWith("ostacky-controller_") || allowedTools.some((t) => tool.includes(t))
-        if (!isControllerTool) {
-          // Bloquear cualquier tool no-controller (Read/Grep/Glob/Bash/Edit/Write) cuando está en PENDING — hard gate genérico
-          throw new Error(`BLOCKED: call consume_* first — controller is in ${state.state}. Use consume_route_decision / consume_execution_decision / record_clarification to proceed.`)
-        }
-      }
-
-      // 9.1: Guard de credenciales
-      if (filePath && isSensitive(filePath, patterns)) {
-        const s = readState(ctx.directory)
-        const allowed = s?.allowedFiles?.[filePath]
-        if (!allowed) {
-          const denied = s?.deniedFiles?.[filePath]
-          if (denied) {
-            throw new Error(`BLOCKED: File ${filePath} requires check_file_access (previously denied)`)
-          }
-          throw new Error(`BLOCKED: File ${filePath} requires check_file_access`)
-        }
-      }
-    },
-  }
-}
+// Nota: isSensitive, BASH_SENSITIVE_RE, extractPathsFromBash vienen de src/security.ts
+// a través de ostacky-plugin.ts, no se copian aquí (verificación check:security).