shennian 0.3.85 → 0.3.86

package/dist/src/agents/openclaw.js

@@ -1,2 +1,293 @@
-import{randomUUID as h}from"node:crypto";import{AgentAdapter as E}from"./adapter.js";import{resolveBuiltinCommand as g,spawnResolvedCommand as w}from"./command-spec.js";import{buildAgentProcessEnv as I}from"../agent-env.js";import{buildInlineChannelPreamble as x}from"./platform-instructions.js";function C(r){if(r==null)return"";if(typeof r=="string")return r;if(typeof r=="object"){const t=r;if(Array.isArray(t.payloads)){const a=[];for(const n of t.payloads)if(n&&typeof n=="object"){const s=n.text;typeof s=="string"&&a.push(s)}if(a.join("").trim())return a.join(`
-`)}const e=t.response??t.message??t.text??t.output??t.content??t.result;if(typeof e=="string"&&e.trim())return e}return""}function k(r){if(r==null||typeof r!="object")return;const t=r,n=t.meta?.agentMeta?.sessionId??t.sessionId??t.session_id;return typeof n=="string"&&n?n:void 0}function v(r){if(r==null||typeof r!="object")return;const t=r,n=t.meta?.agentMeta?.usage??t.usage;if(!n||typeof n!="object")return;const s=n,u=s.input??s.inputTokens??s.input_tokens,o=s.output??s.outputTokens??s.output_tokens;if(!(typeof u!="number"&&typeof o!="number"))return{inputTokens:typeof u=="number"?u:0,outputTokens:typeof o=="number"?o:0}}function y(r){if(r==null||typeof r!="object")return;const t=r,e=t.error??t.err??t.errorMessage;if(typeof e=="string"&&e.trim())return e}class O extends E{type="openclaw";process=null;sessionId=null;agentSessionId=null;currentModelId=null;workDir=null;seq=0;runId="";externalChannel=null;shennianSessionId=null;extraEnv={};configure(t){this.shennianSessionId=t.sessionId??null,this.externalChannel=t.externalChannel??null,this.extraEnv=t.env??{}}async start(t,e,a){this.sessionId=t,this.workDir=e,this.seq=0,a&&(this.agentSessionId=a)}async send(t,e,a,n,s){await this.killProcess(),this.runId=h(),this.seq=0;const u=this.agentSessionId??this.sessionId;if(!u){this.emitEvent({state:"error",message:"openclaw: session not started"});return}if(e&&e!==this.currentModelId){const i=await this.runAgentCommand(["--message",`/model ${e}`,"--session-id",u]);if(!i.ok){this.emitEvent({state:"error",message:i.error??"openclaw model switch failed"});return}this.currentModelId=e}const o=`${x(this.workDir??process.cwd(),this.externalChannel,this.shennianSessionId??void 0,s)}${t}`;this.spawnAgent(["--message",o,"--session-id",u])}async resume(t){await this.killProcess(),this.agentSessionId=t,this.runId=h(),this.seq=0,this.spawnAgent(["--message","\u200B","--session-id",t])}async stop(){await this.killProcess()}spawnAgent(t){const e=g("openclaw");if(!e){this.emit("error",new Error('Command "openclaw" not found. Is OpenClaw CLI installed?'));return}const a=["agent","--local","--json",...t],n=w(e,a,{cwd:this.workDir??void 0,stdio:["ignore","pipe","pipe"],env:I(this.extraEnv)});this.process=n;let s="";n.stdout?.on("data",o=>{s+=o.toString()});let u="";n.stderr?.on("data",o=>{u+=o.toString()}),n.on("close",o=>{if(this.process!==n)return;if(this.process=null,o!==0&&o!==null){const f=u.trim()||`openclaw exited with code ${o}`;this.emitEvent({state:"error",message:f});return}const i=s.trim();if(!i){const f=u.trim()||"openclaw returned empty stdout";this.emitEvent({state:"error",message:f});return}let c;try{c=JSON.parse(i)}catch{this.emitEvent({state:"error",message:`openclaw stdout is not valid JSON: ${i.slice(0,200)}`});return}const l=c;if(l.ok===!1||l.success===!1){this.emitEvent({state:"error",message:y(c)??"openclaw request failed"});return}const p=k(c);p&&(this.agentSessionId=p);const m=C(c);m&&this.emitEvent({state:"delta",text:m});const S=v(c);this.emitEvent({state:"final",agentSessionId:this.agentSessionId??void 0,usage:S})}),n.on("error",o=>{this.process===n&&(this.process=null,o.code==="ENOENT"?this.emit("error",new Error('Command "openclaw" not found. Is OpenClaw CLI installed?')):this.emit("error",o))})}async runAgentCommand(t){return new Promise(e=>{const a=g("openclaw");if(!a){e({ok:!1,error:'Command "openclaw" not found. Is OpenClaw CLI installed?'});return}const n=["agent","--local","--json",...t],s=w(a,n,{cwd:this.workDir??void 0,stdio:["ignore","pipe","pipe"],env:I(this.extraEnv)});let u="",o="";s.stdout?.on("data",i=>{u+=i.toString()}),s.stderr?.on("data",i=>{o+=i.toString()}),s.on("close",i=>{if(i!==0&&i!==null){e({ok:!1,error:o.trim()||`openclaw exited with code ${i}`});return}const c=u.trim();if(!c){e({ok:!0});return}try{const l=JSON.parse(c);if(l.ok===!1||l.success===!1){e({ok:!1,error:y(l)??"openclaw request failed"});return}const d=k(l);d&&(this.agentSessionId=d),e({ok:!0,parsed:l})}catch{e({ok:!1,error:`openclaw stdout is not valid JSON: ${c.slice(0,200)}`})}}),s.on("error",i=>{e({ok:!1,error:i instanceof Error?i.message:String(i)})})})}emitEvent(t){const e={...t,runId:this.runId,seq:this.seq++};this.emit("agentEvent",e)}async killProcess(){const t=this.process;t&&(this.process=null,t.kill("SIGTERM"),await new Promise(e=>{t.on("close",e),setTimeout(()=>{t.kill("SIGKILL"),e()},3e3)}))}}export{O as OpenClawAdapter};
+import { randomUUID } from 'node:crypto';
+import { AgentAdapter } from './adapter.js';
+import { resolveBuiltinCommand, spawnResolvedCommand } from './command-spec.js';
+import { buildAgentProcessEnv } from '../agent-env.js';
+import { buildInlineChannelPreamble } from './platform-instructions.js';
+/** Best-effort parse of `openclaw agent --json` stdout; shape may vary by version. */
+function extractResponseText(parsed) {
+    if (parsed == null)
+        return '';
+    if (typeof parsed === 'string')
+        return parsed;
+    if (typeof parsed === 'object') {
+        const o = parsed;
+        // Primary format: { payloads: [{ text: "..." }] }
+        if (Array.isArray(o.payloads)) {
+            const parts = [];
+            for (const p of o.payloads) {
+                if (p && typeof p === 'object') {
+                    const t = p.text;
+                    if (typeof t === 'string')
+                        parts.push(t);
+                }
+            }
+            if (parts.join('').trim())
+                return parts.join('\n');
+        }
+        const direct = o.response ?? o.message ?? o.text ?? o.output ?? o.content ?? o.result;
+        if (typeof direct === 'string' && direct.trim())
+            return direct;
+    }
+    return '';
+}
+function extractSessionId(parsed) {
+    if (parsed == null || typeof parsed !== 'object')
+        return undefined;
+    const o = parsed;
+    const meta = o.meta;
+    const agentMeta = meta?.agentMeta;
+    const id = agentMeta?.sessionId ?? o.sessionId ?? o.session_id;
+    return typeof id === 'string' && id ? id : undefined;
+}
+function extractUsage(parsed) {
+    if (parsed == null || typeof parsed !== 'object')
+        return undefined;
+    const o = parsed;
+    // Primary: meta.agentMeta.usage (openclaw format)
+    const meta = o.meta;
+    const agentMeta = meta?.agentMeta;
+    const u = agentMeta?.usage ?? o.usage;
+    if (!u || typeof u !== 'object')
+        return undefined;
+    const rec = u;
+    const inTok = rec.input ?? rec.inputTokens ?? rec.input_tokens;
+    const outTok = rec.output ?? rec.outputTokens ?? rec.output_tokens;
+    if (typeof inTok !== 'number' && typeof outTok !== 'number')
+        return undefined;
+    return {
+        inputTokens: typeof inTok === 'number' ? inTok : 0,
+        outputTokens: typeof outTok === 'number' ? outTok : 0,
+    };
+}
+function extractErrorMessage(parsed) {
+    if (parsed == null || typeof parsed !== 'object')
+        return undefined;
+    const o = parsed;
+    const err = o.error ?? o.err ?? o.errorMessage;
+    if (typeof err === 'string' && err.trim())
+        return err;
+    return undefined;
+}
+export class OpenClawAdapter extends AgentAdapter {
+    type = 'openclaw';
+    process = null;
+    sessionId = null;
+    /** OpenClaw session id from JSON or `resume()`; falls back to app `sessionId`. */
+    agentSessionId = null;
+    currentModelId = null;
+    workDir = null;
+    seq = 0;
+    runId = '';
+    externalChannel = null;
+    shennianSessionId = null;
+    extraEnv = {};
+    configure(options) {
+        this.shennianSessionId = options.sessionId ?? null;
+        this.externalChannel = options.externalChannel ?? null;
+        this.extraEnv = options.env ?? {};
+    }
+    async start(sessionId, workDir, agentSessionId) {
+        this.sessionId = sessionId;
+        this.workDir = workDir;
+        this.seq = 0;
+        if (agentSessionId)
+            this.agentSessionId = agentSessionId;
+    }
+    async send(text, modelId, _reasoningEffort, _attachments, agentSystemPrompt) {
+        await this.killProcess();
+        this.runId = randomUUID();
+        this.seq = 0;
+        const sid = this.agentSessionId ?? this.sessionId;
+        if (!sid) {
+            this.emitEvent({ state: 'error', message: 'openclaw: session not started' });
+            return;
+        }
+        // OpenClaw `openclaw agent` uses session-scoped model; `--model` on the same CLI may not apply here.
+        // Sending `/model <id>` as a message matches interactive `/model` and updates the session before the user turn.
+        if (modelId && modelId !== this.currentModelId) {
+            const modelSwitch = await this.runAgentCommand([
+                '--message',
+                `/model ${modelId}`,
+                '--session-id',
+                sid,
+            ]);
+            if (!modelSwitch.ok) {
+                this.emitEvent({
+                    state: 'error',
+                    message: modelSwitch.error ?? 'openclaw model switch failed',
+                });
+                return;
+            }
+            this.currentModelId = modelId;
+        }
+        const outgoing = `${buildInlineChannelPreamble(this.workDir ?? process.cwd(), this.externalChannel, this.shennianSessionId ?? undefined, agentSystemPrompt)}${text}`;
+        this.spawnAgent(['--message', outgoing, '--session-id', sid]);
+    }
+    async resume(agentSessionId) {
+        await this.killProcess();
+        this.agentSessionId = agentSessionId;
+        this.runId = randomUUID();
+        this.seq = 0;
+        // No new user turn; minimal body so the CLI accepts the invocation.
+        this.spawnAgent(['--message', '\u200b', '--session-id', agentSessionId]);
+    }
+    async stop() {
+        await this.killProcess();
+    }
+    spawnAgent(extraArgs) {
+        const spec = resolveBuiltinCommand('openclaw');
+        if (!spec) {
+            this.emit('error', new Error('Command "openclaw" not found. Is OpenClaw CLI installed?'));
+            return;
+        }
+        const args = ['agent', '--local', '--json', ...extraArgs];
+        const proc = spawnResolvedCommand(spec, args, {
+            cwd: this.workDir ?? undefined,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: buildAgentProcessEnv(this.extraEnv),
+        });
+        this.process = proc;
+        let stdoutBuf = '';
+        proc.stdout?.on('data', (chunk) => {
+            stdoutBuf += chunk.toString();
+        });
+        let stderrBuf = '';
+        proc.stderr?.on('data', (chunk) => {
+            stderrBuf += chunk.toString();
+        });
+        proc.on('close', (code) => {
+            if (this.process !== proc)
+                return;
+            this.process = null;
+            if (code !== 0 && code !== null) {
+                const msg = stderrBuf.trim() || `openclaw exited with code ${code}`;
+                this.emitEvent({ state: 'error', message: msg });
+                return;
+            }
+            const raw = stdoutBuf.trim();
+            if (!raw) {
+                const msg = stderrBuf.trim() || 'openclaw returned empty stdout';
+                this.emitEvent({ state: 'error', message: msg });
+                return;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                this.emitEvent({
+                    state: 'error',
+                    message: `openclaw stdout is not valid JSON: ${raw.slice(0, 200)}`,
+                });
+                return;
+            }
+            const rec = parsed;
+            const failed = rec.ok === false || rec.success === false;
+            if (failed) {
+                this.emitEvent({
+                    state: 'error',
+                    message: extractErrorMessage(parsed) ?? 'openclaw request failed',
+                });
+                return;
+            }
+            const nextSid = extractSessionId(parsed);
+            if (nextSid)
+                this.agentSessionId = nextSid;
+            const text = extractResponseText(parsed);
+            if (text) {
+                this.emitEvent({ state: 'delta', text });
+            }
+            const usage = extractUsage(parsed);
+            this.emitEvent({ state: 'final', agentSessionId: this.agentSessionId ?? undefined, usage });
+        });
+        proc.on('error', (err) => {
+            if (this.process !== proc)
+                return;
+            this.process = null;
+            if (err.code === 'ENOENT') {
+                this.emit('error', new Error('Command "openclaw" not found. Is OpenClaw CLI installed?'));
+            }
+            else {
+                this.emit('error', err);
+            }
+        });
+    }
+    async runAgentCommand(extraArgs) {
+        return new Promise((resolve) => {
+            const spec = resolveBuiltinCommand('openclaw');
+            if (!spec) {
+                resolve({ ok: false, error: 'Command "openclaw" not found. Is OpenClaw CLI installed?' });
+                return;
+            }
+            const args = ['agent', '--local', '--json', ...extraArgs];
+            const proc = spawnResolvedCommand(spec, args, {
+                cwd: this.workDir ?? undefined,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: buildAgentProcessEnv(this.extraEnv),
+            });
+            let stdoutBuf = '';
+            let stderrBuf = '';
+            proc.stdout?.on('data', (chunk) => {
+                stdoutBuf += chunk.toString();
+            });
+            proc.stderr?.on('data', (chunk) => {
+                stderrBuf += chunk.toString();
+            });
+            proc.on('close', (code) => {
+                if (code !== 0 && code !== null) {
+                    resolve({ ok: false, error: stderrBuf.trim() || `openclaw exited with code ${code}` });
+                    return;
+                }
+                const raw = stdoutBuf.trim();
+                if (!raw) {
+                    resolve({ ok: true });
+                    return;
+                }
+                try {
+                    const parsed = JSON.parse(raw);
+                    if (parsed.ok === false || parsed.success === false) {
+                        resolve({
+                            ok: false,
+                            error: extractErrorMessage(parsed) ?? 'openclaw request failed',
+                        });
+                        return;
+                    }
+                    const nextSid = extractSessionId(parsed);
+                    if (nextSid)
+                        this.agentSessionId = nextSid;
+                    resolve({ ok: true, parsed });
+                }
+                catch {
+                    resolve({ ok: false, error: `openclaw stdout is not valid JSON: ${raw.slice(0, 200)}` });
+                }
+            });
+            proc.on('error', (err) => {
+                resolve({ ok: false, error: err instanceof Error ? err.message : String(err) });
+            });
+        });
+    }
+    emitEvent(partial) {
+        const event = {
+            ...partial,
+            runId: this.runId,
+            seq: this.seq++,
+        };
+        this.emit('agentEvent', event);
+    }
+    async killProcess() {
+        const proc = this.process;
+        if (!proc)
+            return;
+        this.process = null;
+        proc.kill('SIGTERM');
+        await new Promise((resolve) => {
+            proc.on('close', resolve);
+            setTimeout(() => {
+                proc.kill('SIGKILL');
+                resolve();
+            }, 3000);
+        });
+    }
+}
+// OpenClaw support is intentionally disabled.
+// registerAgent('openclaw', () => new OpenClawAdapter())

package/dist/src/agents/opencode-managed-permissions.js

@@ -1,2 +1,187 @@
-import p from"node:fs";import r from"node:fs/promises";import c from"node:os";import n from"node:path";import{resolveProtectedShennianDirectories as w}from"../security/managed-agent-credential-paths.js";const d="shennian-opencode-managed-",u=[".env",".env.*","**/.env","**/.env.*","*.key","**/*.key","*.pem","**/*.pem","~/.ssh/**","$HOME/.ssh/**","~/.aws/**","$HOME/.aws/**","~/.azure/**","$HOME/.azure/**","~/.config/gcloud/**","$HOME/.config/gcloud/**","~/.netrc","$HOME/.netrc","~/.npmrc","$HOME/.npmrc","~/.shennian/**","$HOME/.shennian/**"],f={commandNetwork:{allow:!1,deny:!0},webSearch:{allow:!0,deny:!0},browser:{allow:!1,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!1,deny:!0}},C={minimumRuntimeVersion:"1.18.0",maximumRuntimeVersionExclusive:"1.19.0",platforms:Object.fromEntries(["darwin","linux","wsl","win32"].map(a=>[a,{level:"partial",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:f,knownGaps:["sandbox.toolPermissionOnly","shell.unavailableInManagedMode","config.globalAndAdministratorSourcesMayRemain"]}]))};function k(a,e){b(e);const o=a.effectivePolicy;if(o.externalCapabilities.commandNetwork)throw new Error("opencode_managed_command_network_unavailable");if(o.externalCapabilities.browser||o.externalCapabilities.computerUse)throw new Error("opencode_managed_interactive_tools_unavailable");if(o.externalCapabilities.mcp)throw new Error("opencode_managed_mcp_allowlist_unavailable");const t=o.fileAccess==="host-full",m=o.fileAccess==="workspace-write",i=g(),s={"*":"deny",read:l("allow",i),glob:"allow",grep:"allow",list:"allow",edit:m||t?l("allow",i):"deny",external_directory:t?l("allow",i):"deny",bash:"deny",task:"deny",skill:"deny",question:"allow",todoread:"allow",todowrite:"allow",webfetch:o.externalCapabilities.webSearch?"allow":"deny",websearch:o.externalCapabilities.webSearch?"allow":"deny",codesearch:o.externalCapabilities.webSearch?"allow":"deny"};return{args:["--pure","--auto"],config:{$schema:"https://opencode.ai/config.json",default_agent:"build",share:"disabled",subagent_depth:0,autoupdate:!1,formatter:!1,lsp:!1,permission:s,agent:{build:{permission:s}},plugin:[],mcp:{},command:{},instructions:[]}}}async function M(a){const e=await r.mkdtemp(n.join(c.tmpdir(),d)),o=n.join(e,"opencode.json");try{return await r.chmod(e,448),await r.writeFile(o,`${JSON.stringify(a.config)}
-`,{encoding:"utf8",mode:384,flag:"wx"}),process.platform!=="win32"&&await r.chmod(o,384),{directory:e,configPath:o}}catch(t){throw await h(e).catch(()=>{}),new Error("opencode_managed_config_initialization_failed",{cause:t})}}async function h(a){const e=n.resolve(a),o=n.resolve(c.tmpdir());if(n.dirname(e)!==o||!n.basename(e).startsWith(d))throw new Error("opencode_managed_config_cleanup_refused");await r.rm(e,{recursive:!0,force:!0})}function l(a,e){return{"*":a,...Object.fromEntries(e.map(o=>[o,"deny"]))}}function _(a){return a.replaceAll("\\","/")}function g(){const a=w().map(e=>`${_(n.normalize(e))}/**`);return[...new Set([...u,...a])]}function b(a){const e=n.normalize(a.trim());if(!e||!n.isAbsolute(e))throw new Error("opencode_managed_workdir_invalid");let o;try{o=p.realpathSync(e)}catch{throw new Error("opencode_managed_workdir_unavailable")}if(n.normalize(o)!==e)throw new Error("opencode_managed_workdir_not_realpath");return e}export{C as OPENCODE_MANAGED_RUNTIME_SECURITY,k as compileOpenCodeManagedPermissions,M as createOpenCodeManagedConfigDirectory,h as disposeOpenCodeManagedConfigDirectory};
+// @arch docs/features/managed-agent-restricted-runtime.md
+// @test src/__tests__/opencode-managed-permissions.test.ts
+import fs from 'node:fs';
+import fsPromises from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { resolveProtectedShennianDirectories } from '../security/managed-agent-credential-paths.js';
+const OPENCODE_MANAGED_CONFIG_PREFIX = 'shennian-opencode-managed-';
+const BASE_SENSITIVE_PATH_RULES = [
+    '.env',
+    '.env.*',
+    '**/.env',
+    '**/.env.*',
+    '*.key',
+    '**/*.key',
+    '*.pem',
+    '**/*.pem',
+    '~/.ssh/**',
+    '$HOME/.ssh/**',
+    '~/.aws/**',
+    '$HOME/.aws/**',
+    '~/.azure/**',
+    '$HOME/.azure/**',
+    '~/.config/gcloud/**',
+    '$HOME/.config/gcloud/**',
+    '~/.netrc',
+    '$HOME/.netrc',
+    '~/.npmrc',
+    '$HOME/.npmrc',
+    '~/.shennian/**',
+    '$HOME/.shennian/**',
+];
+const supportedExternalCapabilities = {
+    // OpenCode permissions can deny Bash completely, but they cannot constrain
+    // Bash or child processes to a filesystem/network sandbox. Enabling command
+    // networking is therefore unavailable in managed mode.
+    commandNetwork: { allow: false, deny: true },
+    webSearch: { allow: true, deny: true },
+    browser: { allow: false, deny: true },
+    computerUse: { allow: false, deny: true },
+    // MCP tool names are server-defined. There is no safe generic allow rule
+    // that excludes project/global custom tools, so managed mode keeps MCP off.
+    mcp: { allow: false, deny: true },
+};
+/**
+ * Evidence is intentionally limited to the locally exercised 1.18 release
+ * line. The declaration is partial: it describes tool dispatch checks, not an
+ * OS sandbox. Shell execution is disabled rather than presented as isolated.
+ */
+export const OPENCODE_MANAGED_RUNTIME_SECURITY = {
+    minimumRuntimeVersion: '1.18.0',
+    maximumRuntimeVersionExclusive: '1.19.0',
+    platforms: Object.fromEntries(['darwin', 'linux', 'wsl', 'win32'].map((platform) => [
+        platform,
+        {
+            level: 'partial',
+            fileAccess: {
+                'workspace-read': true,
+                'workspace-write': true,
+                'host-full': true,
+            },
+            externalCapabilities: supportedExternalCapabilities,
+            knownGaps: [
+                'sandbox.toolPermissionOnly',
+                'shell.unavailableInManagedMode',
+                'config.globalAndAdministratorSourcesMayRemain',
+            ],
+        },
+    ])),
+};
+/**
+ * Compiles the effective policy into an invocation-scoped OpenCode config.
+ * The global deny rule is deliberate: unknown/custom tools stay disabled.
+ */
+export function compileOpenCodeManagedPermissions(enforcement, resolvedWorkDir) {
+    validateResolvedWorkDir(resolvedWorkDir);
+    const policy = enforcement.effectivePolicy;
+    if (policy.externalCapabilities.commandNetwork) {
+        throw new Error('opencode_managed_command_network_unavailable');
+    }
+    if (policy.externalCapabilities.browser || policy.externalCapabilities.computerUse) {
+        throw new Error('opencode_managed_interactive_tools_unavailable');
+    }
+    if (policy.externalCapabilities.mcp) {
+        throw new Error('opencode_managed_mcp_allowlist_unavailable');
+    }
+    const hostFull = policy.fileAccess === 'host-full';
+    const workspaceWritable = policy.fileAccess === 'workspace-write';
+    const sensitivePathRules = resolveSensitivePathRules();
+    const permission = {
+        '*': 'deny',
+        read: pathPermission('allow', sensitivePathRules),
+        glob: 'allow',
+        grep: 'allow',
+        list: 'allow',
+        edit: workspaceWritable || hostFull ? pathPermission('allow', sensitivePathRules) : 'deny',
+        external_directory: hostFull ? pathPermission('allow', sensitivePathRules) : 'deny',
+        bash: 'deny',
+        task: 'deny',
+        skill: 'deny',
+        question: 'allow',
+        todoread: 'allow',
+        todowrite: 'allow',
+        webfetch: policy.externalCapabilities.webSearch ? 'allow' : 'deny',
+        websearch: policy.externalCapabilities.webSearch ? 'allow' : 'deny',
+        codesearch: policy.externalCapabilities.webSearch ? 'allow' : 'deny',
+    };
+    return {
+        args: ['--pure', '--auto'],
+        config: {
+            $schema: 'https://opencode.ai/config.json',
+            default_agent: 'build',
+            share: 'disabled',
+            subagent_depth: 0,
+            autoupdate: false,
+            formatter: false,
+            lsp: false,
+            permission,
+            agent: {
+                build: { permission },
+            },
+            plugin: [],
+            mcp: {},
+            command: {},
+            instructions: [],
+        },
+    };
+}
+export async function createOpenCodeManagedConfigDirectory(config) {
+    const directory = await fsPromises.mkdtemp(path.join(os.tmpdir(), OPENCODE_MANAGED_CONFIG_PREFIX));
+    const configPath = path.join(directory, 'opencode.json');
+    try {
+        await fsPromises.chmod(directory, 0o700);
+        await fsPromises.writeFile(configPath, `${JSON.stringify(config.config)}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+            flag: 'wx',
+        });
+        if (process.platform !== 'win32')
+            await fsPromises.chmod(configPath, 0o600);
+        return { directory, configPath };
+    }
+    catch (error) {
+        await disposeOpenCodeManagedConfigDirectory(directory).catch(() => { });
+        throw new Error('opencode_managed_config_initialization_failed', { cause: error });
+    }
+}
+export async function disposeOpenCodeManagedConfigDirectory(directory) {
+    const resolved = path.resolve(directory);
+    const tempRoot = path.resolve(os.tmpdir());
+    if (path.dirname(resolved) !== tempRoot ||
+        !path.basename(resolved).startsWith(OPENCODE_MANAGED_CONFIG_PREFIX)) {
+        throw new Error('opencode_managed_config_cleanup_refused');
+    }
+    await fsPromises.rm(resolved, { recursive: true, force: true });
+}
+function pathPermission(defaultEffect, sensitivePathRules) {
+    return {
+        '*': defaultEffect,
+        ...Object.fromEntries(sensitivePathRules.map((pattern) => [pattern, 'deny'])),
+    };
+}
+function normalizeForOpenCode(value) {
+    return value.replaceAll('\\', '/');
+}
+function resolveSensitivePathRules() {
+    const shennianDirectories = resolveProtectedShennianDirectories()
+        .map((entry) => `${normalizeForOpenCode(path.normalize(entry))}/**`);
+    return [...new Set([...BASE_SENSITIVE_PATH_RULES, ...shennianDirectories])];
+}
+function validateResolvedWorkDir(value) {
+    const normalized = path.normalize(value.trim());
+    if (!normalized || !path.isAbsolute(normalized)) {
+        throw new Error('opencode_managed_workdir_invalid');
+    }
+    let realPath;
+    try {
+        realPath = fs.realpathSync(normalized);
+    }
+    catch {
+        throw new Error('opencode_managed_workdir_unavailable');
+    }
+    if (path.normalize(realPath) !== normalized) {
+        throw new Error('opencode_managed_workdir_not_realpath');
+    }
+    return normalized;
+}