ostacky 0.7.4 → 0.8.0

package/assets/plugins/engram.ts

@@ -54,86 +54,17 @@ const ENGRAM_TOOLS = new Set([
 ])
 
 // ─── Memory Instructions ─────────────────────────────────────────────────────
-// These get injected into the agent's context so it knows to call mem_save.
+// Lazy: full protocol lives in assets/docs/engram-protocol.md (on-demand via Read).
+// System injects only pointer + nudge, not full 1.2k. Source-of-truth: src/tiered.ts for isTrivial.
 
-const MEMORY_INSTRUCTIONS = `## Engram Persistent Memory — Protocol
+const MEMORY_POINTER = "Engram disponible — para formato mem_save/mem_search lee assets/docs/engram-protocol.md (on-demand). Usa mem_search proactivamente si el tema pudo verse antes."
+const MEMORY_INSTRUCTIONS_LAZY = `## Engram — pointer (lazy)
 
-You have access to Engram, a persistent memory system that survives across sessions and compactions.
+${MEMORY_POINTER}
 
-### WHEN TO SAVE (mandatory — not optional)
-
-Call \`mem_save\` IMMEDIATELY after any of these:
-- Bug fix completed
-- Architecture or design decision made
-- Non-obvious discovery about the codebase
-- Configuration change or environment setup
-- Pattern established (naming, structure, convention)
-- User preference or constraint learned
-
-Format for \`mem_save\`:
-- **title**: Verb + what — short, searchable (e.g. "Fixed N+1 query in UserList", "Chose Zustand over Redux")
-- **type**: bugfix | decision | architecture | discovery | pattern | config | preference
-- **scope**: \`project\` (default) | \`personal\`
-- **topic_key** (optional, recommended for evolving decisions): stable key like \`architecture/auth-model\`
-- **content**:
-  **What**: One sentence — what was done
-  **Why**: What motivated it (user request, bug, performance, etc.)
-  **Where**: Files or paths affected
-  **Learned**: Gotchas, edge cases, things that surprised you (omit if none)
-
-Topic rules:
-- Different topics must not overwrite each other (e.g. architecture vs bugfix)
-- Reuse the same \`topic_key\` to update an evolving topic instead of creating new observations
-- If unsure about the key, call \`mem_suggest_topic_key\` first and then reuse it
-- Use \`mem_update\` when you have an exact observation ID to correct
-
-### WHEN TO SEARCH MEMORY
-
-When the user asks to recall something — any variation of "remember", "recall", "what did we do",
-"how did we solve", or the equivalent in the user's language, or references to past work:
-1. First call \`mem_context\` — checks recent session history (fast, cheap)
-2. If not found, call \`mem_search\` with relevant keywords (FTS5 full-text search)
-3. If you find a match, use \`mem_get_observation\` for full untruncated content
-
-Also search memory PROACTIVELY when:
-- Starting work on something that might have been done before
-- The user mentions a topic you have no context on — check if past sessions covered it
-- The user's FIRST message references the project, a feature, or a problem — call \`mem_search\` with keywords from their message to check for prior work before responding
-
-### SESSION CLOSE PROTOCOL (mandatory)
-
-Before ending a session or saying "done" / "that's it", you MUST:
-1. Call \`mem_session_summary\` with this structure:
-
-## Goal
-[What we were working on this session]
-
-## Instructions
-[User preferences or constraints discovered — skip if none]
-
-## Discoveries
-- [Technical findings, gotchas, non-obvious learnings]
-
-## Accomplished
-- [Completed items with key details]
-
-## Next Steps
-- [What remains to be done — for the next session]
-
-## Relevant Files
-- path/to/file — [what it does or what changed]
-
-This is NOT optional. If you skip this, the next session starts blind.
-
-### AFTER COMPACTION
-
-If you see a message about compaction or context reset, or if you see "FIRST ACTION REQUIRED" in your context:
-1. IMMEDIATELY call \`mem_session_summary\` with the compacted summary content — this persists what was done before compaction
-2. Then call \`mem_context\` to recover any additional context from previous sessions
-3. Only THEN continue working
-
-Do not skip step 1. Without it, everything done before compaction is lost from memory.
-`
+Cuando necesites guardar/buscar, lee el protocolo completo con Read. No alucines formato.`
+// Compat: keep full for fallback if file missing — but never inject full in system.transform
+const MEMORY_INSTRUCTIONS = MEMORY_INSTRUCTIONS_LAZY
 
 // ─── HTTP Client ─────────────────────────────────────────────────────────────
 
@@ -270,6 +201,26 @@ export const Engram: Plugin = async (ctx) => {
   // inflation (e.g. 170 sessions for 1 real conversation, issue #116).
   const subAgentSessions = new Set<string>()
 
+  // Tiered cache-friendly: single source of truth via src/tiered.ts
+  const trivialBySession = new Map<string, boolean>()
+  // isTrivial y getControllerState importados lógicamente desde src/tiered.ts
+  // Inlined para evitar import dinámico en plugin bundle — mantener regex idéntico a src/tiered.ts
+  function isTrivialMessage(msg: string, state: string): boolean {
+    if (!msg || state !== "DONE") return false
+    if (msg.trim().length >= 30) return false
+    if (!/^(hola|hey|gracias|buenas|hi|hello)\b/i.test(msg.trim())) return false
+    if (/(necesito|quiero|agregá|fix|bug|feature|auth|spec|implementar)/i.test(msg)) return false
+    return true
+  }
+  function getControllerState(directory: string): string {
+    try {
+      const statePath = process.env.OSTACKY_STATE_PATH || join(directory, ".opencode", "ostacky-state.json")
+      const raw = readFileSync(statePath, "utf-8")
+      const j = JSON.parse(raw)
+      return j.state ?? "DONE"
+    } catch { return "DONE" }
+  }
+
   /**
    * Ensure a session exists in engram. Idempotent — calls POST /sessions
    * which uses INSERT OR IGNORE. Safe to call multiple times.
@@ -407,6 +358,12 @@ export const Engram: Plugin = async (ctx) => {
 
       const finalContent = content || fallback
 
+      // Tiered: set trivial flag for system.transform lazy
+      try {
+        const state = getControllerState(ctx.directory)
+        trivialBySession.set(sessionId, isTrivialMessage(finalContent, state))
+      } catch {}
+
       // Only capture non-trivial prompts (>10 chars)
       if (finalContent.length > 10) {
         await ensureSession(sessionId)
@@ -465,13 +422,24 @@ export const Engram: Plugin = async (ctx) => {
     // messages that would break these models. See: GitHub issue #23.
 
     "experimental.chat.system.transform": async (input, output) => {
+      // Tiered lazy: SIEMPRE pointer (cache-friendly, ~1 línea). Full vive en assets/docs/engram-protocol.md on-demand.
+      const sessionId: string = (input as any).sessionID ?? ""
+      const isTrivial = trivialBySession.get(sessionId) ?? false
+      const state = getControllerState(ctx.directory)
+      const shouldBeTrivial = isTrivial && state === "DONE"
+      const pointer = shouldBeTrivial
+        ? "Engram disponible — detalles a demanda (usa mem_search si necesitas recordar)."
+        : MEMORY_POINTER
       if (output.system.length > 0) {
-        output.system[output.system.length - 1] += "\n\n" + MEMORY_INSTRUCTIONS
+        output.system[output.system.length - 1] += "\n\n" + pointer
       } else {
-        output.system.push(MEMORY_INSTRUCTIONS)
+        output.system.push(pointer)
       }
+      // No inyectar MEMORY_INSTRUCTIONS completo nunca — se lee on-demand via Read
 
       // ── Save nudge ──────────────────────────────────────────────────────────
+      // Skip nudge for trivial greeting (cache-friendly, no extra injection)
+      if (shouldBeTrivial) return
       // If it has been a long time since the last mem_save, append a reminder
       // to the system prompt so the agent notices. All fetches are fire-and-
       // forget with short timeouts — any failure silently skips the nudge.

package/assets/plugins/ostacky-guard.ts

@@ -1,212 +1,18 @@
 /**
- * Ostacky Guard — plugin hermano de Engram
- *
- * Bloquea lecturas sensibles sin autorización previa y bloquea cualquier tool
- * cuando el controller está en estado PENDING.
- *
- * Hard gate incluso en degraded: nunca uses bash para .env sin check_file_access → consume ALLOW con razón auditada.
- *
- * Se registra en `tool.execute.before` y lanza Error si la operación no está
- * permitida. OpenCode aborta el tool antes de tocar disco.
+ * @deprecated Fusionado en ostacky-plugin.ts — re-export legacy.
+ * Single source: importa desde src/security.ts vía controller.
+ * Fresh install solo escribe ostacky-plugin.ts + engram.ts.
+ * Este archivo no debe ser instalado por ostacky install (deprecado).
  */
 
 import type { Plugin } from "@opencode-ai/plugin"
-import { readFileSync, existsSync } from "node:fs"
-import { join, dirname, basename, resolve, relative } from "node:path"
 
-const SENSITIVE_DEFAULT = [
-  "**/.env*",
-  "**/.secrets/**",
-  "**/*.pem",
-  "**/*.key",
-  "**/.aws/**",
-  "**/.ssh/**",
-  "**/credentials.json",
-  "**/.npmrc",
-]
+// Re-export controller como guard por compatibilidad — no duplica isSensitive/BASH_SENSITIVE_RE
+export { OstackyController as OstackyGuard } from "./ostacky-plugin.ts"
 
-const BASH_SENSITIVE_RE =
-  /(?:^|[^a-zA-Z0-9_.-])(\.env(\b|[_.-])|\.secrets\b|\.pem\b|\.key\b|credentials\.json|\.aws\b|\.ssh\b|\.npmrc\b)/i
+// También export default por compatibilidad con loaders que esperan default
+import { OstackyController } from "./ostacky-plugin.ts"
+export default OstackyController
 
-function getEnvPatterns(): string[] {
-  const raw = process.env.OSTACKY_SENSITIVE_PATTERNS
-  if (!raw) return SENSITIVE_DEFAULT
-  return raw.split(",").map((s) => s.trim()).filter(Boolean)
-}
-
-function isSensitive(filePath: string, patterns: string[]): boolean {
-  if (!filePath) return false
-  const normalized = filePath.replace(/\\/g, "/")
-  const lower = normalized.toLowerCase()
-  if (lower.endsWith(".env.example") || lower.endsWith(".env.template") || lower.endsWith(".env.sample")) return false
-  const base = lower.split("/").pop() || ""
-  for (const pat of patterns) {
-    if (pat.includes(".env") && base.startsWith(".env")) return true
-    if (pat.includes(".secrets") && lower.includes(".secrets")) return true
-    if (pat.includes("*.pem") && lower.endsWith(".pem")) return true
-    if (pat.includes("*.key") && lower.endsWith(".key")) return true
-    if (pat.includes(".aws") && lower.includes(".aws")) return true
-    if (pat.includes(".ssh") && lower.includes(".ssh")) return true
-    if (pat.includes("credentials.json") && lower.endsWith("credentials.json")) return true
-    if (pat.includes(".npmrc") && lower.endsWith(".npmrc")) return true
-  }
-  if (/\.(pem|key)$/i.test(normalized)) return true
-  if (base.startsWith(".env")) return true
-  return false
-}
-
-function extractPathsFromBash(cmd: string): string[] {
-  if (!cmd) return []
-  const normalized = cmd.replace(/&&/g, ";").replace(/\|\|/g, ";")
-  const segments = normalized.split(/[|;><\n]+/)
-  const paths: string[] = []
-  for (const seg of segments) {
-    const trimmed = seg.trim()
-    if (!trimmed) continue
-    const tokens = trimmed.match(/(?:[^\s"'`\u0060\\]+|"[^"]*"|'[^']*'|`[^`]*`)+/g) || []
-    for (let token of tokens) {
-      const stripped = token.replace(/["'`]/g, "").replace(/\\/g, "")
-      if (!stripped) continue
-      if (["cat","grep","ls","echo","awk","sed","cut","head","tail","wc","find","xargs","bash","sh","zsh","env","printenv","node","bun","npm","npx","ls","cat"].includes(stripped)) continue
-      if (stripped.startsWith("-")) continue
-      const lower = stripped.toLowerCase()
-      if (
-        stripped.includes("/") ||
-        stripped.includes(".") ||
-        lower.startsWith(".env") ||
-        lower.includes(".secrets") ||
-        lower.endsWith(".pem") ||
-        lower.endsWith(".key") ||
-        lower.includes(".aws") ||
-        lower.includes(".ssh") ||
-        lower.endsWith("credentials.json") ||
-        lower.endsWith(".npmrc")
-      ) {
-        const cleaned = stripped.replace(/[,:;)\]]+$/, "")
-        if (cleaned) paths.push(cleaned)
-      } else if (stripped === ".env") {
-        paths.push(stripped)
-      }
-    }
-  }
-  return [...new Set(paths)]
-}
-
-function getStatePath(directory: string): string {
-  if (process.env.OSTACKY_STATE_PATH) return process.env.OSTACKY_STATE_PATH
-  const candidates = [join(directory, "opencode.json"), join(directory, "opencode.jsonc")]
-  for (const cand of candidates) {
-    try {
-      const raw = readFileSync(cand, "utf-8")
-      const json = JSON.parse(raw.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, ""))
-      const envPath = (json as any)?.mcp?.["ostacky-controller"]?.environment?.OSTACKY_STATE_PATH
-      if (typeof envPath === "string" && envPath) return envPath
-    } catch {}
-  }
-  return join(directory, ".opencode", "ostacky-state.json")
-}
-
-function readState(directory: string): any | null {
-  const p = getStatePath(directory)
-  try {
-    const raw = readFileSync(p, "utf-8")
-    return JSON.parse(raw)
-  } catch {
-    return null
-  }
-}
-
-export const OstackyGuard: Plugin = async (ctx) => {
-  const patterns = getEnvPatterns()
-
-  return {
-    "tool.execute.before": async (input, output) => {
-      const tool = (input as any).tool as string
-      const args = (input as any).args as any
-
-      // 10.2: Guard genérico de PENDING — bloquear cualquier tool no-controller cuando estado es PENDING
-      const state = readState(ctx.directory)
-      const pendingStates = ["ROUTE_DECISION_PENDING", "EXECUTION_DECISION_PENDING", "CLARIFICATION_PENDING"]
-      if (state && pendingStates.includes(state.state)) {
-        const allowedTools = ["consume_route_decision", "consume_execution_decision", "record_clarification", "abandon", "check_file_access", "consume_file_access_decision", "record_user_confirmation"]
-        const isControllerTool = tool.startsWith("ostacky-controller_") || allowedTools.some((t) => tool.includes(t))
-        if (!isControllerTool) {
-          throw new Error(`BLOCKED: call consume_* first — controller is in ${state.state}. Use consume_route_decision / consume_execution_decision / record_clarification to proceed.`)
-        }
-      }
-
-      // ── Guard hard para bash/write/edit (hardening-v2 P0) ──
-      // Hard gate incluso en degraded, nunca uses bash para .env sin check_file_access → consume ALLOW con razón auditada
-      if (tool === "bash") {
-        const cmd: string = args?.command || args?.cmd || ""
-        if (typeof cmd === "string" && cmd) {
-          const normalized = cmd.replace(/["'`]/g, "").replace(/\\/g, "")
-          const hasSensitivePattern = BASH_SENSITIVE_RE.test(normalized)
-          const paths = extractPathsFromBash(cmd)
-          const sensitivePaths = paths.filter((p) => isSensitive(p, patterns))
-          // Si hay match de regex o paths sensibles, validar ALLOW
-          if (hasSensitivePattern || sensitivePaths.length > 0) {
-            // Si extrajimos paths sensibles, validar cada uno
-            if (sensitivePaths.length > 0) {
-              for (const p of sensitivePaths) {
-                const s = readState(ctx.directory)
-                // Normalizar p para lookup: probar p tal cual, y resolved, y basename para casos relativos
-                const candidates = [p, resolve(ctx.directory, p), join(ctx.directory, p)]
-                const allowed = candidates.some((c) => s?.allowedFiles?.[c] || s?.allowedFiles?.[p])
-                // También chequear por basename si es .env (ej: .env vs /abs/.env)
-                const baseAllowed = s?.allowedFiles?.[p] || s?.allowedFiles?.[basename(p)] || s?.allowedFiles?.[resolve(ctx.directory, p)]
-                if (!allowed && !baseAllowed) {
-                  const denied = s?.deniedFiles?.[p] || s?.deniedFiles?.[basename(p)]
-                  if (denied) {
-                    throw new Error(`BLOCKED: bash contiene acceso sensible (${p}) (previously denied) — Llamá check_file_access con reason antes.`)
-                  }
-                  throw new Error(`BLOCKED: bash contiene acceso sensible (${p}). Llamá check_file_access con reason antes.`)
-                }
-              }
-            } else if (hasSensitivePattern) {
-              // Fallback genérico cuando regex matchea pero no extrajimos path (ej: cat .env con espacios raros)
-              const s = readState(ctx.directory)
-              // Buscar si hay algún allowed que cubra .env* genérico
-              const hasAllowed = Object.keys(s?.allowedFiles || {}).some((k) => isSensitive(k, patterns))
-              if (!hasAllowed) {
-                throw new Error(`BLOCKED: bash contiene acceso sensible (.env). Llamá check_file_access con reason antes.`)
-              }
-            }
-          }
-          // Caso especial: obfuscación .e""nv → normalized ya quitó quotes, pero paths extraído ya lo cubre
-          // Si normalized contiene .env después de strip, y no hay allowed, ya bloqueamos arriba
-        }
-      }
-
-      // Extraer filePath para read/write/edit/grep/glob/read_mcp_resource
-      let filePath: string | undefined
-      if (tool === "read" || tool === "read_mcp_resource" || tool === "grep" || tool === "glob" || tool === "write" || tool === "edit") {
-        filePath = args?.filePath || args?.path || args?.pattern || args?.uri || ""
-        if (tool === "grep" && args?.include) filePath = args.include
-        if (tool === "write" || tool === "edit") {
-          filePath = args?.filePath || args?.path || ""
-        }
-        if (tool === "read_mcp_resource" && typeof args?.uri === "string") {
-          try {
-            const u = args.uri as string
-            if (u.startsWith("file://")) filePath = u.slice(7)
-            else if (u.includes("/")) filePath = u
-          } catch {}
-        }
-      }
-
-      // 9.1: Guard de credenciales (hard gate incluso en degraded)
-      if (filePath && isSensitive(filePath, patterns)) {
-        const s = readState(ctx.directory)
-        const allowed = s?.allowedFiles?.[filePath] || s?.allowedFiles?.[resolve(ctx.directory, filePath)] || s?.allowedFiles?.[basename(filePath)]
-        if (!allowed) {
-          const denied = s?.deniedFiles?.[filePath] || s?.deniedFiles?.[basename(filePath)]
-          if (denied) {
-            throw new Error(`BLOCKED: File ${filePath} requires check_file_access (previously denied)`)
-          }
-          throw new Error(`BLOCKED: File ${filePath} requires check_file_access`)
-        }
-      }
-    },
-  }
-}
+// Nota: isSensitive, BASH_SENSITIVE_RE, extractPathsFromBash vienen de src/security.ts
+// a través de ostacky-plugin.ts, no se copian aquí (verificación check:security).