pi-opencode-cli-bridge 0.1.0 → 0.2.1

package/README.md

@@ -15,6 +15,7 @@ This fork fixes that and closes the gaps found while reviewing the code:
 - **No hung turns or orphaned processes.** Timeouts and cancellation kill the OpenCode process group, even when it ignores `SIGTERM`.
 - **Unexpected CLI output no longer crashes Pi.** Malformed events end the turn with an error.
 - **Clean shutdown.** Pi waits for temporary directories and OpenCode session records to be removed.
+- **Fewer failed turns when the model reaches for OpenCode's own tools.** A blocked native `bash`, `read`, `write`, `edit`, `grep` or `glob` call with a Pi equivalent is handed to Pi as a normal tool call. For other tools, the model is told how to ask Pi instead and can recover in the same run.
 - **Standard Pi provider hooks.** `onPayload`, `onResponse` and `onProviderStreamEvent` work as with built-in providers.
 - **Its own npm package**, with the original authors credited.
 
@@ -114,8 +115,9 @@ Without an override, discovery selects active models whose reported input and ou
 2. It replays Pi's transcript system messages to recover the current system prompt and tool declarations, including later changes.
 3. It creates a temporary OpenCode project containing a `pi-model` agent and a `tool.execute.before` plugin. Native tool declarations remain on the request. Execution is stopped twice: the plugin throws before any native tool runs, and the agent sets every permission to `ask`, which non-interactive `opencode run` rejects automatically. The second layer still holds if the plugin is missing or fails to load.
 4. It sends the prompt over standard input to `opencode run --format json`. User and tool-result images are written to temporary files and attached only when the model supports images.
-5. Text markers such as `<pi_tool_call>{"name":"read","arguments":{"path":"example.txt"}}</pi_tool_call>` become Pi tool calls. Tool names must be in the current Pi tool list; execution then follows Pi's normal validation and permission pipeline.
-6. Successful continuation turns reuse an OpenCode session and send only the new transcript. Changes to the model, prompt, tools or transcript prefix start a fresh session.
+5. If the model calls a native OpenCode tool anyway, the call is still blocked. When every native call in that step has a Pi equivalent in the current tool list (`bash`, `read`, `write`, `edit` with a single replacement, `grep`, and `glob` as `find`), the bridge stops OpenCode and returns them as Pi tool calls. Paths inside the temporary project become relative to Pi's working directory. Otherwise OpenCode continues: the model sees a correction asking it to use a Pi tool, and the turn fails only if it does not recover.
+6. Text markers such as `<pi_tool_call>{"name":"read","arguments":{"path":"example.txt"}}</pi_tool_call>` become Pi tool calls. Tool names must be in the current Pi tool list; execution then follows Pi's normal validation and permission pipeline. DeepSeek models sometimes write their native DSML tool-call blocks (`<｜DSML｜invoke name="...">`) as text instead; complete blocks are converted the same way, and an incomplete one fails the turn with a diagnostic instead of ending it silently.
+7. Successful continuation turns reuse an OpenCode session and send only the new transcript. Changes to the model, prompt, tools or transcript prefix start a fresh session.
 
 Pi's provider instrumentation hooks follow the CLI transport, not OpenCode's internal HTTP traffic:
 
@@ -134,7 +136,8 @@ Reasoning variants, image support and token limits follow CLI discovery. Token u
 - Pi and OpenCode can both retain local conversation data. Best-effort cleanup is not a guarantee of secure deletion.
 - Free-tier model availability and accepted request shapes can change. This fork makes no guarantee of continued access or compliance with a hosted provider's terms; review the applicable terms yourself.
 - Live tests with DeepSeek v4.1 Flash Free used thinking off. The first high-thinking test timed out; no default thinking setting is changed by this package.
-- Timeouts and cancellation escalate from `SIGTERM` to `SIGKILL` on the CLI's process group after 250 ms. Malformed or unexpected CLI events end the turn with an error instead of crashing Pi. Shutdown waits for session cleanup.
+- At startup Pi warns if your OpenCode version is not 1.19.0, the version the native-tool guard was verified with.
+- Timeouts and cancellation escalate from `SIGTERM` to `SIGKILL` on the CLI's process group after 250 ms; on Windows the whole process tree is ended with `taskkill /T /F` (not tested on Windows). If OpenCode quits before reading the prompt, the turn shows OpenCode's own error rather than a broken-pipe error. Malformed or unexpected CLI events end the turn with an error instead of crashing Pi. Shutdown waits for session cleanup.
 
 See [SECURITY.md](SECURITY.md) for the trust boundaries and [docs/code-review.md](https://github.com/Gybra/pi-opencode-cli-bridge/blob/main/docs/code-review.md) for what was fixed and what remains. This is an experimental, unaudited fork.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-opencode-cli-bridge",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Bridge the OpenCode CLI into Pi Coding Agent",
   "type": "module",
   "main": "./src/index.ts",
@@ -34,9 +34,18 @@
   ],
   "author": "pi-extensions contributors",
   "contributors": [
-    { "name": "luongnv89", "url": "https://github.com/luongnv89" },
-    { "name": "Rodrigo Manuel Jager Pinheiro", "url": "https://github.com/rodrigojager" },
-    { "name": "Gybra", "url": "https://github.com/Gybra" }
+    {
+      "name": "luongnv89",
+      "url": "https://github.com/luongnv89"
+    },
+    {
+      "name": "Rodrigo Manuel Jager Pinheiro",
+      "url": "https://github.com/rodrigojager"
+    },
+    {
+      "name": "Gybra",
+      "url": "https://github.com/Gybra"
+    }
   ],
   "license": "MIT",
   "engines": {

package/src/index.ts

@@ -1,8 +1,8 @@
 import { runOpenCodeProcess } from "./process.js";
 import { existsSync } from "node:fs";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, posix, win32 } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { registerApiProvider } from "@earendil-works/pi-ai/compat";
 import {
@@ -29,6 +29,8 @@ import {
 const PROVIDER_ID = "opencode-cli";
 const API_ID = "opencode-cli-runner";
 const AGENT_ID = "pi-model";
+// The native-tool guard is verified against this CLI release by the integration test.
+const VERIFIED_OPENCODE_VERSION = "1.19.0";
 const DEFAULT_CONTEXT_WINDOW = 128_000;
 const DEFAULT_MAX_TOKENS = 16_384;
 const DISCOVERY_TIMEOUT_MS = 8_000;
@@ -98,6 +100,7 @@ export type ToolCallParseResult =
       rejection:
         | { reason: "malformed_markers" }
         | { reason: "invalid_payload" }
+        | { reason: "incomplete_dsml" }
         | { reason: "unavailable_tool"; toolName: string };
     };
 
@@ -608,6 +611,78 @@ function objectRecord(value: unknown): Record<string, unknown> | undefined {
     : undefined;
 }
 
+/**
+ * Map a blocked native OpenCode call onto the equivalent Pi tool, so Pi runs
+ * it under its own permissions. Calls whose semantics differ stay untranslated.
+ */
+export function translateNativeToolCall(
+  tool: string,
+  input: unknown,
+  allowedToolNames: Set<string>,
+  projectDirs: string[],
+  paths: typeof posix = process.platform === "win32" ? win32 : posix,
+): ParsedToolCall | undefined {
+  const args = objectRecord(input);
+  if (!args) return undefined;
+  const text = (key: string) => typeof args[key] === "string" ? args[key] as string : undefined;
+  const count = (key: string) =>
+    typeof args[key] === "number" && args[key] > 0 ? args[key] as number : undefined;
+  // OpenCode resolves paths in its temporary project; Pi resolves them in the real one.
+  // Platform path rules also cover Windows slash and drive-letter case differences.
+  const path = (key: string) => {
+    const value = text(key);
+    if (value === undefined || !paths.isAbsolute(value)) return value;
+    for (const dir of projectDirs) {
+      const rel = paths.relative(dir, value);
+      if (rel !== ".." && !rel.startsWith(".." + paths.sep) && !paths.isAbsolute(rel)) return rel || ".";
+    }
+    return value;
+  };
+  const call = (name: string, entries: Record<string, unknown>): ParsedToolCall => ({
+    name,
+    arguments: Object.fromEntries(Object.entries(entries).filter(([, v]) => v !== undefined)),
+  });
+  let result: ParsedToolCall | undefined;
+  switch (tool) {
+    case "bash": {
+      // shortcut: absolute temp-project paths inside the command are not rewritten; parse them if models rely on it.
+      const timeout = count("timeout");
+      if (text("command") === undefined || (args.workdir !== undefined && path("workdir") !== ".")) break;
+      result = call("bash", { command: text("command"), timeout: timeout && Math.ceil(timeout / 1000) });
+      break;
+    }
+    case "read":
+      if (text("filePath") !== undefined) {
+        result = call("read", { path: path("filePath"), offset: count("offset"), limit: count("limit") });
+      }
+      break;
+    case "write":
+      if (text("filePath") !== undefined && text("content") !== undefined) {
+        result = call("write", { path: path("filePath"), content: text("content") });
+      }
+      break;
+    case "edit":
+      // Pi edits need one unique, non-empty match: no replaceAll or create-by-edit.
+      if (text("filePath") !== undefined && text("oldString") && text("newString") !== undefined &&
+          args.replaceAll !== true) {
+        result = call("edit", {
+          path: path("filePath"),
+          edits: [{ oldText: text("oldString"), newText: text("newString") }],
+        });
+      }
+      break;
+    case "grep":
+      if (text("pattern") !== undefined) {
+        result = call("grep", { pattern: text("pattern"), path: path("path"), glob: text("include") });
+      }
+      break;
+    case "glob":
+      if (text("pattern") !== undefined) result = call("find", { pattern: text("pattern"), path: path("path") });
+      break;
+  }
+  return result && allowedToolNames.has(result.name) ? result : undefined;
+}
+
 function safeJson(value: unknown): string {
   try {
     return JSON.stringify(value, null, 2);
@@ -874,11 +949,70 @@ function stripMarkerSpans(text: string, spans: MarkerSpan[]): string {
   return cleaned;
 }
 
+// DeepSeek sometimes ignores the markers and writes its native DSML tool-call
+// syntax as plain text. Each complete block is rewritten in place as markers,
+// so call order and the tool-list check stay those of the marker parser.
+const DSML = String.raw`[｜|]+\s*DSML\s*[｜|]+`;
+const DSML_TAG = new RegExp(String.raw`<\/?${DSML}`);
+const DSML_BLOCK = new RegExp(String.raw`^<${DSML}(?:tool|function)_calls>([\s\S]*?)<\/${DSML}(?:tool|function)_calls>`);
+const DSML_INVOKE = new RegExp(String.raw`<${DSML}invoke\s+name="([^"]+)"\s*>([\s\S]*?)<\/${DSML}invoke>`, "g");
+const DSML_PARAMETER = new RegExp(String.raw`<${DSML}parameter\s+name="([^"]+)"(?:\s+string="(true|false)")?\s*>([\s\S]*?)<\/${DSML}parameter>`, "g");
+
+function dsmlBlockToMarkers(body: string): string {
+  let markers = "";
+  for (const [, name, params] of body.matchAll(DSML_INVOKE)) {
+    const args: Record<string, unknown> = {};
+    for (const [, key, isString, raw] of params.matchAll(DSML_PARAMETER)) {
+      if (isString === "true") {
+        args[key] = raw;
+        continue;
+      }
+      try {
+        args[key] = JSON.parse(raw);
+      } catch {
+        args[key] = raw;
+      }
+    }
+    markers += `${MARKER_OPEN}${JSON.stringify({ name, arguments: args })}</pi_tool_call>`;
+  }
+  return markers;
+}
+
+// Scans left to right and consumes whichever starts first, a marker or a DSML
+// block, so each keeps the other's syntax intact inside its own arguments.
+// Returns undefined for a truncated DSML block, which would otherwise end the
+// turn silently or let Pi run only the calls before it.
+function dsmlToMarkers(text: string): string | undefined {
+  let result = "";
+  let rest = text;
+  for (;;) {
+    const dsmlAt = rest.search(DSML_TAG);
+    const markerAt = rest.indexOf(MARKER_OPEN);
+    if (dsmlAt < 0) return result + rest;
+    if (markerAt >= 0 && markerAt < dsmlAt) {
+      // The slice starts at the marker, so trimming cannot shift its span.
+      const extraction = toolCallMarkers(rest.slice(markerAt));
+      const span = [...(extraction?.markers ?? []), ...(extraction?.invalidSpans ?? [])].find((s) => s.start === 0);
+      const end = markerAt + (span?.end ?? MARKER_OPEN.length);
+      result += rest.slice(0, end);
+      rest = rest.slice(end);
+      continue;
+    }
+    const block = DSML_BLOCK.exec(rest.slice(dsmlAt));
+    if (!block) return undefined;
+    result += rest.slice(0, dsmlAt) + dsmlBlockToMarkers(block[1]);
+    rest = rest.slice(dsmlAt + block[0].length);
+  }
+}
+
 export function parseToolCallResponse(
   text: string,
   allowedToolNames?: ReadonlySet<string>,
 ): ToolCallParseResult {
-  const normalizedText = normalizeQuotedToolCallResponse(text);
+  const normalizedText = dsmlToMarkers(normalizeQuotedToolCallResponse(text));
+  if (normalizedText === undefined) {
+    return { ok: false, rejection: { reason: "incomplete_dsml" } };
+  }
   if (!isToolCallMarkerResponse(normalizedText)) return { ok: true, calls: [] };
 
   const extraction = toolCallMarkers(normalizedText);
@@ -958,6 +1092,8 @@ function toolCallRejectionMessage(
       return "OpenCode returned malformed Pi tool-call markers. Ensure each marker contains valid JSON with a string \"name\" and object \"arguments\".";
     case "invalid_payload":
       return 'OpenCode returned an invalid Pi tool-call payload. Each marker must contain valid JSON with a non-empty string "name" and object "arguments".';
+    case "incomplete_dsml":
+      return 'OpenCode returned an incomplete DeepSeek DSML tool call. Pi tools must be requested with <pi_tool_call>{"name":"...","arguments":{}}</pi_tool_call> markers.';
     case "unavailable_tool": {
       const available = [...allowedToolNames].map((name) =>
         JSON.stringify(name),
@@ -1296,7 +1432,7 @@ You are the OpenCode side of a Pi Coding Agent bridge. Do not use OpenCode nativ
     join(pluginsDir, "pi-native-tool-blocker.js"),
     `export const PiNativeToolBlocker = async () => ({
   "tool.execute.before": async (input) => {
-    throw new Error("Native OpenCode tool blocked by opencode-pi: " + input.tool)
+    throw new Error("Native OpenCode tool " + input.tool + " is disabled in the Pi bridge. Request the equivalent Pi tool instead: reply with <pi_tool_call>{\\"name\\":\\"tool_name\\",\\"arguments\\":{}}</pi_tool_call> using a tool from the Pi tool list.")
   },
 })
 `,
@@ -1331,6 +1467,12 @@ export function streamOpenCode(
     let stdoutRemainder = "";
     let capturedSessionId: string | undefined;
     let opencodeToolUse: string | undefined;
+    // Text after the last blocked native call shows whether the model recovered in-run.
+    let nativeTextMark = 0;
+    let stepNativeCalls: (ParsedToolCall | undefined)[] = [];
+    let nativeCalls: ParsedToolCall[] | undefined;
+    // Thrown from the event handler so the process runner stops OpenCode.
+    const nativeStepEnd = new Error("OpenCode stopped after a translated native step");
     let opencodeError: string | undefined;
     let finishReason: "stop" | "length" = "stop";
     // Per-Pi-session reuse key supplied by Pi core (stable for the life of
@@ -1351,6 +1493,9 @@ export function streamOpenCode(
         tools: getCurrentTools(messages),
       };
       const transcriptParts = serializedTranscriptParts(context.messages);
+      const allowedToolNames = new Set(
+        context.tools?.map((tool) => tool.name) ?? [],
+      );
       stream.push({ type: "start", partial: output });
       if (options?.signal?.aborted) throw new Error("Request was aborted");
 
@@ -1381,6 +1526,7 @@ export function streamOpenCode(
             return dir;
           });
       if (options?.signal?.aborted) throw new Error("Request was aborted");
+      const projectDirs = [sessionDir, await realpath(sessionDir).catch(() => sessionDir)];
       const images = imageContentsForModel(
         sentMessages,
         model.input.includes("image"),
@@ -1410,7 +1556,8 @@ export function streamOpenCode(
       for (const path of imagePaths) args.push("--file", path);
 
       const handleLine = async (line: string) => {
-        if (!line.trim()) return;
+        // Output after a translated native step belongs to a run Pi already ended.
+        if (!line.trim() || nativeCalls) return;
         let parsed: unknown;
         try {
           parsed = JSON.parse(line);
@@ -1449,26 +1596,42 @@ export function streamOpenCode(
             finishReason = "length";
           }
           const tokens = objectRecord(part?.tokens);
-          if (!tokens) return;
-          const cache = objectRecord(tokens.cache);
-          output.usage.input = Number(tokens.input ?? 0);
-          output.usage.output =
-            Number(tokens.output ?? 0) + Number(tokens.reasoning ?? 0);
-          output.usage.cacheRead = Number(cache?.read ?? 0);
-          output.usage.cacheWrite = Number(cache?.write ?? 0);
-          output.usage.totalTokens = Number(
-            tokens.total ??
-              output.usage.input +
-                output.usage.output +
-                output.usage.cacheRead +
-                output.usage.cacheWrite,
-          );
-          calculateCost(model, output.usage);
+          if (tokens) {
+            const cache = objectRecord(tokens.cache);
+            output.usage.input = Number(tokens.input ?? 0);
+            output.usage.output =
+              Number(tokens.output ?? 0) + Number(tokens.reasoning ?? 0);
+            output.usage.cacheRead = Number(cache?.read ?? 0);
+            output.usage.cacheWrite = Number(cache?.write ?? 0);
+            output.usage.totalTokens = Number(
+              tokens.total ??
+                output.usage.input +
+                  output.usage.output +
+                  output.usage.cacheRead +
+                  output.usage.cacheWrite,
+            );
+            calculateCost(model, output.usage);
+          }
+          const calls = stepNativeCalls;
+          stepNativeCalls = [];
+          // A fully translatable step ends the turn like a normal tool-call response.
+          // Otherwise OpenCode continues and the model sees the blocker's correction.
+          if (calls.length > 0 && calls.every(Boolean)) {
+            nativeCalls = calls as ParsedToolCall[];
+            throw nativeStepEnd;
+          }
           return;
         }
 
         if (event.type === "tool_use") {
           opencodeToolUse = part?.tool ? String(part.tool) : "unknown";
+          nativeTextMark = accumulatedText.length;
+          stepNativeCalls.push(translateNativeToolCall(
+            opencodeToolUse,
+            objectRecord(part?.state)?.input,
+            allowedToolNames,
+            projectDirs,
+          ));
           return;
         }
 
@@ -1514,22 +1677,24 @@ export function streamOpenCode(
           for (const line of lines) await handleLine(line);
         },
         onEnd: () => handleLine(stdoutRemainder),
+      }).catch((error: unknown) => {
+        // Stopping OpenCode after a translated native step is a normal end of turn.
+        if (error === nativeStepEnd) return undefined;
+        throw error;
       });
-      const { code } = result;
-      stderr = (stderr + result.stderr).slice(-STDERR_LIMIT);
-      if (code !== 0) {
-        throw new Error(stderr.trim() || `opencode exited with code ${code}`);
+      if (result) {
+        stderr = (stderr + result.stderr).slice(-STDERR_LIMIT);
+        if (result.code !== 0) {
+          throw new Error(stderr.trim() || `opencode exited with code ${result.code}`);
+        }
       }
       if (opencodeError) throw new Error(opencodeError);
-      if (opencodeToolUse) {
+      if (opencodeToolUse && !nativeCalls && !accumulatedText.slice(nativeTextMark).trim()) {
         throw new Error(
           `OpenCode attempted to use its disabled native tool (${JSON.stringify(opencodeToolUse)}). Retry the request; Pi tools must be requested with <pi_tool_call>{"name":"...","arguments":{}}</pi_tool_call> markers.`,
         );
       }
 
-      const allowedToolNames = new Set(
-        context.tools?.map((tool) => tool.name) ?? [],
-      );
       const toolCallResult = parseToolCallResponse(
         accumulatedText,
         allowedToolNames,
@@ -1539,7 +1704,7 @@ export function streamOpenCode(
           toolCallRejectionMessage(toolCallResult, allowedToolNames),
         );
       }
-      const toolCalls = toolCallResult.calls;
+      const toolCalls = [...toolCallResult.calls, ...(nativeCalls ?? [])];
       // Unrecoverable marker text is stripped so it never leaks into the
       // visible chat response; remaining prose still displays normally.
       const displayText = toolCallResult.cleanedText ?? accumulatedText;
@@ -1585,7 +1750,8 @@ export function streamOpenCode(
       );
       // The turn succeeded: record the session for reuse, or delete the
       // one-shot session record so it cannot accumulate (#71, #75).
-      if (piState && !payloadHook) {
+      // A session holding a blocked native call cannot be continued as a transcript prefix.
+      if (piState && !payloadHook && !nativeCalls) {
         piState.opencodeSessionId =
           capturedSessionId ?? piState.opencodeSessionId;
         piState.modelId = model.id;
@@ -1593,6 +1759,7 @@ export function streamOpenCode(
         piState.systemPrompt = context.systemPrompt ?? "";
         piState.sentParts = transcriptParts;
       } else {
+        if (piState) dropOpencodeSession(piState);
         deleteOpenCodeSession(capturedSessionId);
       }
 
@@ -1800,6 +1967,13 @@ export default async function opencodePiExtension(pi: ExtensionAPI) {
       `opencode-pi: registered ${registeredModels.length} OpenCode CLI model(s). Use /model and pick ${PROVIDER_ID}.`,
       "info",
     );
+    const version = /\d+\.\d+\.\d+/.exec(cliStatus.summary)?.[0];
+    if (version !== VERIFIED_OPENCODE_VERSION) {
+      ctx.ui.notify(
+        `opencode-pi: OpenCode ${version ?? cliStatus.summary} is not ${VERIFIED_OPENCODE_VERSION}, the version the native-tool guard was verified with. Native OpenCode tools may not stay blocked.`,
+        "warning",
+      );
+    }
     if (lastDiscoveryError) {
       ctx.ui.notify(
         `opencode-pi: model discovery used fallback (${lastDiscoveryError})`,

package/src/process.ts

@@ -33,8 +33,11 @@ export async function runOpenCodeProcess(
   const signalChild = (signal: NodeJS.Signals) => {
     if (!child.pid) return;
     try {
-      if (process.platform === "win32") child.kill(signal);
-      else process.kill(-child.pid, signal);
+      if (process.platform === "win32") {
+        // child.kill would stop only the launcher; /T also ends the native CLI it spawned.
+        spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true })
+          .on("error", () => child.kill(signal));
+      } else process.kill(-child.pid, signal);
     } catch { /* The child may already have exited. */ }
   };
   const stop = (error: Error) => {
@@ -59,7 +62,10 @@ export async function runOpenCodeProcess(
   });
   // Observe spawn failures immediately, even while a start callback is awaiting.
   void closed.catch(() => undefined);
-  child.stdin?.on("error", stop);
+  // A CLI that quits before reading its prompt explains why via stderr and exit code.
+  child.stdin?.on("error", (error: NodeJS.ErrnoException) => {
+    if (error.code !== "EPIPE") stop(error);
+  });
   child.stdout.setEncoding("utf8");
   child.stderr.setEncoding("utf8");
   child.stderr.on("data", (chunk: string) => {