rtrt-agent 0.1.0 → 0.1.1

package/README.ko.md

@@ -7,14 +7,14 @@ hook 사이에서 상위 session, agent, worktree, invocation 및 permission bro
 ## 설치
 
 ```sh
-npm install rtrt-agent@0.1.0
+npm install rtrt-agent@0.1.1
 ```
 
 `opencode.json`의 단수형 `plugin` 배열에 패키지를 등록합니다.
 
 ```json
 {
-  "plugin": ["rtrt-agent"]
+  "plugin": ["rtrt-agent@0.1.1"]
 }
 ```
 
@@ -22,18 +22,20 @@ OpenCode는 이름 있는 `RtrtProvenance` export를 로드합니다. 이 패키
 default export를 제공하지 않습니다. 선택 사항인 RTRT TUI statusline은 별도 소스
 통합으로 유지되며 이 패키지에서 export하거나 pack하지 않습니다.
 
-`rtrt setup --agent opencode --apply`는 다른 setup write보다 먼저 인식된 legacy RTRT
-plugin을 제거합니다. Setup은 전체 RTRT 통합을 관리하지만 npm 설치는 수행하지 않으며,
-설정된 패키지는 OpenCode가 시작할 때 설치합니다. Setup은 `rtrt-agent`의 정확히 일치하는
-bare, pinned, ranged, tuple, object 형식만 소유하며 bare `"rtrt-agent"` string 하나로
-정규화합니다. 이전의 미게시 `rtrt`와 초안 `rtrt-opencode` 패키지 spec은 외부 값이며 순서를
-유지합니다. 위 직접 등록과 `opencode plugin rtrt-agent --global`은 계속 유효합니다.
+`rtrt setup --agent opencode --apply`는 전체 RTRT 통합을 관리하지만 npm 설치는 수행하지
+않으며, 설정된 패키지는 OpenCode가 시작할 때 설치합니다. Setup은 먼저 정확한
+`rtrt-agent@0.1.1` 등록과 모든 대체 관리 asset을 기록합니다. 이 기록이 성공한 뒤에만
+인식된 legacy RTRT plugin을 제거하며, 이전 단계가 실패하면 legacy runtime을 보존합니다.
+Setup은 `rtrt-agent`의 정확히 일치하는 bare, pinned, ranged, tuple, object 형식만 소유하고
+정확한 `"rtrt-agent@0.1.1"` string 하나로 정규화합니다. 이전의 미게시 `rtrt`와 초안
+`rtrt-opencode` 패키지 spec은 외부 값이며 순서를 유지합니다. 위 직접 등록과
+`opencode plugin rtrt-agent@0.1.1 --global`은 계속 유효합니다.
 
 관리 agent 소유권 상태는 다음 순서의 첫 비어 있지 않은 root에서 읽습니다.
 `$OPENCODE_CONFIG_DIR`, `$XDG_CONFIG_HOME/opencode`, `~/.config/opencode`. 공존은 OMO
 4.19.4를 대상으로 CI에서 검사하고 OpenCode 1.18.29에서 직접 검증했으며, 어느 쪽도
-미래 버전 지원을 보장하지 않습니다. RTRT CLI 릴리스가 이를 등록하기 전에
-`rtrt-agent@0.1.0`을 게시해야 합니다.
+미래 버전 지원을 보장하지 않습니다. 통합 RTRT 릴리스 워크플로는 정확한
+`rtrt-agent@0.1.1` 패키지를 일치하는 Rust 릴리스와 함께 게시합니다.
 
 ## 라이선스
 

package/README.md

@@ -7,14 +7,14 @@ hooks while keeping the broker loopback-only.
 ## Install
 
 ```sh
-npm install rtrt-agent@0.1.0
+npm install rtrt-agent@0.1.1
 ```
 
 Register the package in the singular `plugin` array in `opencode.json`:
 
 ```json
 {
-  "plugin": ["rtrt-agent"]
+  "plugin": ["rtrt-agent@0.1.1"]
 }
 ```
 
@@ -22,19 +22,21 @@ OpenCode loads the named `RtrtProvenance` export. The package intentionally has
 default export. The optional RTRT TUI statusline remains a separate source integration
 and is not exported or packed by this package.
 
-`rtrt setup --agent opencode --apply` first removes a recognized legacy RTRT plugin
-before any other setup write. It manages the full RTRT integration but performs no npm
-installation; OpenCode installs the configured package at startup. Setup owns exact bare,
-pinned, ranged, tuple, and object forms of `rtrt-agent` only, and normalizes them to one
-bare `"rtrt-agent"` string. Old unpublished `rtrt` and draft `rtrt-opencode` package specs
-are foreign and retain their order. The direct registration above and
-`opencode plugin rtrt-agent --global` remain valid.
+`rtrt setup --agent opencode --apply` manages the full RTRT integration but performs no
+npm installation; OpenCode installs the configured package at startup. Setup first writes
+the exact `rtrt-agent@0.1.1` registration and every replacement managed asset. Only after
+those writes succeed does it remove a recognized legacy RTRT plugin; an earlier failure
+preserves the legacy runtime. Setup owns exact bare, pinned, ranged, tuple, and object forms
+of `rtrt-agent` only and normalizes them to one exact `"rtrt-agent@0.1.1"` string. Old
+unpublished `rtrt` and draft `rtrt-opencode` package specs are foreign and retain their
+order. The direct registration above and `opencode plugin rtrt-agent@0.1.1 --global`
+remain valid.
 
 Managed-agent ownership state is read from the first nonempty root in this order:
 `$OPENCODE_CONFIG_DIR`, `$XDG_CONFIG_HOME/opencode`, then `~/.config/opencode`.
 Coexistence is CI-gated against OMO 4.19.4 and was verified on OpenCode 1.18.29; neither
-is a future-version guarantee. `rtrt-agent@0.1.0` must be published before an RTRT CLI
-release registers it.
+is a future-version guarantee. The unified RTRT release workflow publishes the exact
+`rtrt-agent@0.1.1` package together with the matching Rust release.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rtrt-agent",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "RTRT provenance and permission-broker plugin for OpenCode",
   "type": "module",
   "main": "./index.js",

package/rtrt-provenance.js

@@ -128,94 +128,19 @@ const loadManagedAgents = async (statePath) => {
   }
 }
 
-const realisticInside = async (root, operand) => {
-  if (!operand || operand.includes("\0") || URL_ARGUMENT.test(operand)) return false
-  if (!path.isAbsolute(operand) && operand.split(/[\\/]/).includes("..")) return false
-  const context = typeof root === "string" ? { cwd: root, bounds: [root] } : root
-  const target = path.resolve(context.cwd, operand)
-  if (!context.bounds.some((bound) => isWithin(bound, target))) return false
-  let probe = target
-  while (true) {
-    try {
-      const resolved = await realpath(probe)
-      return context.bounds.some((bound) => isWithin(bound, resolved))
-    } catch (error) {
-      if (error?.code !== "ENOENT" && error?.code !== "ENOTDIR") return false
-      const parent = path.dirname(probe)
-      if (parent === probe || !context.bounds.some((bound) => isWithin(bound, parent))) return false
-      probe = parent
-    }
-  }
-}
-
-const splitOptions = (args, valueOptions = new Set()) => {
-  const operands = []
-  for (let index = 0; index < args.length; index += 1) {
-    const argument = args[index]
-    if (argument === "--") {
-      operands.push(...args.slice(index + 1))
-      break
-    }
-    if (!argument.startsWith("-") || argument === "-") {
-      operands.push(argument)
-      continue
-    }
-    const [option, attached] = argument.split(/=(.*)/s, 2)
-    if (valueOptions.has(option)) {
-      const value = attached ?? args[++index]
-      if (!value) return
-      operands.push(value)
-    }
-  }
-  return operands
-}
-
-const allPathsInside = async (root, operands) => {
-  if (!operands) return false
-  for (const operand of operands) if (!(await realisticInside(root, operand))) return false
-  return true
-}
-
-const READ_COMMANDS = new Set(["cat", "wc", "stat"])
-
+// Auto-approval deliberately covers no command that names a path. This hook
+// resolves operands when the permission is evaluated, but the shell resolves
+// them again when it runs, so anyone who can write to the checkout can swap an
+// approved file for a symlink in between and read an arbitrary file into the
+// model's context. `pwd` is the only command whose meaning cannot be redirected
+// that way; everything else stays at "ask".
 const safeCommand = async (command, root) => {
+  if (typeof command !== "string" || /[{}]/.test(command)) return false
   const tokens = tokenizeCommand(command)
   if (!tokens || !root || !BARE_COMMAND.test(tokens[0]) || tokens.some((item) => URL_ARGUMENT.test(item))) return false
   const [executable, ...args] = tokens
-  for (const argument of args) {
-    const value = argument.includes("=") ? argument.slice(argument.indexOf("=") + 1) : argument
-    if ((path.isAbsolute(value) || value.includes("/") || value.includes("\\") || value.startsWith(".")) && !(await realisticInside(root, value))) return false
-  }
-  if (executable === "pwd") return args.every((item) => item === "-L" || item === "-P")
-  if (executable === "ls") {
-    if (args.some((item) => item.startsWith("-") && !/^-[AacdFfghikLlmnopqRrSstuUx1]+$/.test(item))) return false
-    return allPathsInside(root, args.filter((item) => !item.startsWith("-")))
-  }
-  if (READ_COMMANDS.has(executable)) {
-    if (args.some((item) => item.startsWith("-") && item !== "--")) return false
-    const operands = splitOptions(args)
-    return Boolean(operands?.length) && allPathsInside(root, operands)
-  }
-  if (["head", "tail"].includes(executable)) {
-    const operands = []
-    for (let index = 0; index < args.length; index += 1) {
-      const argument = args[index]
-      if (argument === "-q" || argument === "--quiet" || argument === "--silent" || argument === "-v" || argument === "--verbose") continue
-      const attached = argument.match(/^(?:-n|--lines|-c|--bytes)=(.*)$/)
-      if (attached) {
-        if (!/^[-+]?\d+$/.test(attached[1])) return false
-        continue
-      }
-      if (["-n", "--lines", "-c", "--bytes"].includes(argument)) {
-        if (!/^[-+]?\d+$/.test(args[++index] ?? "")) return false
-        continue
-      }
-      if (argument.startsWith("-")) return false
-      operands.push(argument)
-    }
-    return operands.length > 0 && allPathsInside(root, operands)
-  }
-  return false
+  if (executable !== "pwd") return false
+  return args.every((item) => item === "-L" || item === "-P")
 }
 
 const defaultClientFactory = async (options) => {
@@ -226,7 +151,6 @@ const defaultClientFactory = async (options) => {
 const RTRT_AGENT_TOOLS = new Set([
   "rtrt_agent_call",
   "rtrt_agent_route",
-  "rtrt_team_dispatch",
 ])
 
 const sanitizeSessionID = (sessionID) => {