optio-opencode 0.1.8__tar.gz → 0.2.0__tar.gz

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-opencode
-Version: 0.1.8
+Version: 0.2.0
 Summary: Run opencode web as an optio task; local subprocess or remote via SSH.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -22,7 +22,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: optio-core<0.3,>=0.2
 Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.2,>=0.1
+Requires-Dist: optio-agents<0.3,>=0.2
 Requires-Dist: asyncssh>=2.14
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "optio-opencode"
-version = "0.1.8"
+version = "0.2.0"
 description = "Run opencode web as an optio task; local subprocess or remote via SSH."
 readme = "README.md"
 license = "Apache-2.0"
@@ -30,7 +30,7 @@ dependencies = [
     # 0.1.1 introduces the bind_addr kwarg on Host.establish_tunnel —
     # required for OPTIO_WIDGET_TUNNEL_BIND to work.
     "optio-host>=0.2,<0.3",
-    "optio-agents>=0.1,<0.2",
+    "optio-agents>=0.2,<0.3",
     "asyncssh>=2.14",
 ]
 

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/src/optio_opencode/prompt.py

@@ -81,6 +81,9 @@ the situation as a resume:
 
 If a resume slips past unnoticed, a failing tool call is the
 next-best signal — re-check `./resume.log` then.
+
+You may also be notified of a resume by a `System:` message on your input
+channel; when you see one, follow the `resume.log` procedure above.
 """
 
 

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/src/optio_opencode/session.py

@@ -31,6 +31,7 @@ from optio_core.context import ProcessContext
 from optio_core.models import BasicAuth, TaskInstance
 
 from optio_agents import HookContext
+from optio_agents import RESUME_NOTICE, SYSTEM_MESSAGE_PREFIX
 from optio_host.host import Host, LocalHost, ProcessHandle, RemoteHost
 from optio_host.paths import task_dir
 from optio_agents.protocol.session import _SessionFailed, run_log_protocol_session
@@ -327,6 +328,13 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
             await _post_opencode_prompt(
                 worker_port, password, session_id, AUTO_START_PROMPT,
             )
+        elif resuming and config.supports_resume:
+            # Push notification: make the resumed agent NOTICE the resume
+            # promptly (resume.log remains the pull-based source of truth).
+            await _post_opencode_prompt(
+                worker_port, password, session_id,
+                f"{SYSTEM_MESSAGE_PREFIX}{RESUME_NOTICE}",
+            )
 
         # --- await opencode subprocess exit -----------------------------
         # The protocol driver runs this body alongside the tail dispatcher
@@ -343,6 +351,14 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
     # --- run the protocol session -----------------------------------------
     # host.connect() already happened up-front (before install + resume).
     session_error: BaseException | None = None
+
+    async def _agent_sender(message: str) -> None:
+        # worker_port / session_id are set by _opencode_body at launch;
+        # password is established at function scope. _post_opencode_prompt
+        # raises on a non-2xx / unreachable worker, which
+        # send_to_agent converts to False.
+        await _post_opencode_prompt(worker_port, password, session_id, message)
+
     try:
         # before_execute is wired manually inside _opencode_body (after
         # install, before launch) per opencode's documented timing.
@@ -355,6 +371,7 @@ async def run_opencode_session(ctx: ProcessContext, config: OpencodeTaskConfig)
             on_deliverable=config.on_deliverable,
             after_execute=config.after_execute,
             protocol=protocol,
+            agent_sender=_agent_sender,
         )
     except _SessionFailed as fail:
         session_error = fail
@@ -483,6 +500,24 @@ async def _capture_snapshot(
     opencode_executable: str = "opencode",
     session_blob_encrypt: "Callable[[bytes], bytes] | None" = None,
 ) -> None:
+    # Defense-in-depth (guard #2): refuse to capture a resumable snapshot
+    # unless opencode's auth.json exists and is non-empty on the host. A
+    # credential-less workdir is degenerate — restoring it would relaunch
+    # opencode with no auth, so marking it resumable is worse than useless.
+    # (Live-reach is already covered by the session_id is not None gate at
+    # the call site; this covers the bad/empty-seed edge.)
+    workdir = host.workdir.rstrip("/")
+    chk = await host.run_command(
+        f"test -s {shlex.quote(workdir)}/home/.local/share/opencode/auth.json "
+        f"&& echo OK || true"
+    )
+    if "OK" not in chk.stdout:
+        _LOG.warning(
+            "snapshot capture skipped: opencode auth.json absent/empty; "
+            "refusing to mark resumable"
+        )
+        return
+
     session_json = await host_actions.opencode_export(
         host, opencode_db, session_id,
         opencode_executable=opencode_executable,

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/src/optio_opencode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: optio-opencode
-Version: 0.1.8
+Version: 0.2.0
 Summary: Run opencode web as an optio task; local subprocess or remote via SSH.
 Author-email: Kristof Csillag <kristof.csillag@deai-labs.com>
 License-Expression: Apache-2.0
@@ -22,7 +22,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: optio-core<0.3,>=0.2
 Requires-Dist: optio-host<0.3,>=0.2
-Requires-Dist: optio-agents<0.2,>=0.1
+Requires-Dist: optio-agents<0.3,>=0.2
 Requires-Dist: asyncssh>=2.14
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/src/optio_opencode.egg-info/SOURCES.txt

@@ -12,6 +12,7 @@ src/optio_opencode.egg-info/SOURCES.txt
 src/optio_opencode.egg-info/dependency_links.txt
 src/optio_opencode.egg-info/requires.txt
 src/optio_opencode.egg-info/top_level.txt
+tests/test_agent_sender_opencode.py
 tests/test_host_actions.py
 tests/test_host_local.py
 tests/test_host_primitives_local.py
@@ -20,6 +21,7 @@ tests/test_host_remote_resume.py
 tests/test_host_resume.py
 tests/test_prompt.py
 tests/test_purge_seed.py
+tests/test_resume_sentence_opencode.py
 tests/test_sanity.py
 tests/test_seed_config.py
 tests/test_session_blob_hooks.py

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/src/optio_opencode.egg-info/requires.txt

@@ -1,6 +1,6 @@
 optio-core<0.3,>=0.2
 optio-host<0.3,>=0.2
-optio-agents<0.2,>=0.1
+optio-agents<0.3,>=0.2
 asyncssh>=2.14
 
 [dev]

optio_opencode-0.2.0/tests/test_agent_sender_opencode.py

@@ -0,0 +1,29 @@
+import pytest
+
+import optio_opencode.session as S
+from optio_agents import RESUME_NOTICE, SYSTEM_MESSAGE_PREFIX
+
+
+@pytest.mark.asyncio
+async def test_post_prompt_signature_used_by_sender(monkeypatch):
+    """The opencode sender forwards (port, password, session_id, message) to
+    _post_opencode_prompt verbatim. Mirrors the closure built in
+    run_opencode_session."""
+    calls = []
+
+    async def fake_post(port, password, session_id, message):
+        calls.append((port, password, session_id, message))
+
+    monkeypatch.setattr(S, "_post_opencode_prompt", fake_post)
+
+    worker_port, password, session_id = 4321, "pw", "sess-1"
+
+    async def _agent_sender(message: str) -> None:
+        await S._post_opencode_prompt(worker_port, password, session_id, message)
+
+    await _agent_sender("hello")
+    assert calls == [(4321, "pw", "sess-1", "hello")]
+
+
+def test_resume_notice_string():
+    assert f"{SYSTEM_MESSAGE_PREFIX}{RESUME_NOTICE}" == "System: you have been resumed"

optio_opencode-0.2.0/tests/test_resume_sentence_opencode.py

@@ -0,0 +1,7 @@
+from optio_opencode.prompt import _render_resume_section
+
+
+def test_resume_section_mentions_system_notification():
+    section = _render_resume_section(None)
+    assert "`System:` message" in section
+    assert "resume.log" in section

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/tests/test_session_blob_hooks.py

@@ -99,6 +99,11 @@ async def test_capture_writes_through_session_blob_encrypt(monkeypatch):
         yield b"workdir-bytes"
     fake_host = MagicMock()
     fake_host.archive_workdir = _fake_archive
+    # Satisfy the snapshot-capture defense-in-depth guard: it runs a
+    # `test -s .../auth.json && echo OK` probe on the host and refuses to
+    # capture unless the output contains "OK".
+    fake_host.workdir = "/work"
+    fake_host.run_command = AsyncMock(return_value=MagicMock(stdout="OK\n"))
 
     await _capture_snapshot(
         fake_ctx, fake_host,

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/tests/test_session_local.py

@@ -92,6 +92,21 @@ def _config(scenario: str, deliverable_cb=None, raises: bool = False) -> Opencod
     )
 
 
+async def _plant_auth_json(hook_ctx) -> None:
+    """before_execute hook: plant a non-empty opencode auth.json in the workdir.
+
+    The snapshot-capture defense-in-depth guard refuses to mark a session
+    resumable unless ``home/.local/share/opencode/auth.json`` exists and is
+    non-empty on the host, so capture-expecting tests must plant credentials
+    the same way a real seeded launch would.
+    """
+    await hook_ctx.run_on_host(
+        "mkdir -p home/.local/share/opencode && "
+        "printf '{\"anthropic\": {\"type\": \"api\", \"key\": \"sk-test\"}}' "
+        "> home/.local/share/opencode/auth.json"
+    )
+
+
 @pytest.fixture(autouse=True)
 def _supply_scenario(monkeypatch):
     """Substitute fake_opencode.py for the real opencode binary.
@@ -596,11 +611,14 @@ async def test_session_local_supports_resume_true_captures_snapshot(
     ctx_and_captures, _supply_scenario, tmp_workdir,
 ):
     """With supports_resume=True (default), a snapshot IS captured."""
+    import dataclasses
     from optio_opencode.snapshots import SESSION_SNAPSHOT_COLLECTION_SUFFIX
     ctx, _, _ = ctx_and_captures
     _supply_scenario["name"] = "happy"
 
-    cfg = _config("happy")  # default supports_resume=True
+    # Plant auth.json so the snapshot-capture defense-in-depth guard permits
+    # capture; without credentials it would refuse to mark resumable.
+    cfg = dataclasses.replace(_config("happy"), before_execute=_plant_auth_json)
     await run_opencode_session(ctx, cfg)
 
     coll_name = f"{ctx._prefix}{SESSION_SNAPSHOT_COLLECTION_SUFFIX}"

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/tests/test_session_resume.py

@@ -121,9 +121,30 @@ async def _make_ctx(mongo_db, process_id: str, *, resume: bool):
     return ctx, proc["_id"]
 
 
-async def _run_one_cycle(mongo_db, process_id: str, resume: bool) -> None:
+async def _plant_auth_json(hook_ctx) -> None:
+    """before_execute hook: plant a non-empty opencode auth.json in the workdir.
+
+    The snapshot-capture defense-in-depth guard refuses to mark a session
+    resumable unless ``home/.local/share/opencode/auth.json`` exists and is
+    non-empty on the host. Capture-expecting tests must therefore plant a
+    credentials file the same way a real seeded launch would, mirroring how
+    claudecode tests plant ``.credentials.json``.
+    """
+    await hook_ctx.run_on_host(
+        "mkdir -p home/.local/share/opencode && "
+        "printf '{\"anthropic\": {\"type\": \"api\", \"key\": \"sk-test\"}}' "
+        "> home/.local/share/opencode/auth.json"
+    )
+
+
+async def _run_one_cycle(
+    mongo_db, process_id: str, resume: bool, *, plant_auth: bool = True,
+) -> None:
     ctx, _ = await _make_ctx(mongo_db, process_id, resume=resume)
-    cfg = OpencodeTaskConfig(consumer_instructions=f"(scenario: happy {process_id})")
+    cfg = OpencodeTaskConfig(
+        consumer_instructions=f"(scenario: happy {process_id})",
+        before_execute=_plant_auth_json if plant_auth else None,
+    )
     await run_opencode_session(ctx, cfg)
 
 
@@ -142,6 +163,27 @@ async def test_terminal_flow_captures_snapshot_and_wipes_workdir(mongo_db, task_
     assert not wd.exists() or not any(wd.iterdir())
 
 
+async def test_no_auth_json_refuses_to_capture_snapshot(mongo_db, task_root):
+    """Defense-in-depth: a normal launch (session_id created) but with NO
+    opencode auth.json on the host must NOT capture a snapshot or mark the
+    process resumable. Guards against marking a degenerate, credential-less
+    workdir as resumable.
+    """
+    pid = "oc_no_auth_1"
+    await _run_one_cycle(mongo_db, pid, resume=False, plant_auth=False)
+
+    snap = await load_latest_snapshot(mongo_db, prefix="test", process_id=pid)
+    assert snap is None
+
+    count = await mongo_db[f"test{SESSION_SNAPSHOT_COLLECTION_SUFFIX}"].count_documents(
+        {"processId": pid}
+    )
+    assert count == 0
+
+    proc = await mongo_db["test_processes"].find_one({"processId": pid})
+    assert proc.get("hasSavedState") is not True
+
+
 async def test_resume_creates_second_snapshot(mongo_db, task_root):
     pid = "oc_resume_1"
     await _run_one_cycle(mongo_db, pid, resume=False)

{optio_opencode-0.1.8 → optio_opencode-0.2.0}/tests/test_session_seed.py

@@ -308,9 +308,10 @@ async def test_second_session_consumes_seed(
 async def test_auto_start_posts_on_fresh_and_not_on_resume(
     mongo_db, task_root, _supply_scenario, monkeypatch,
 ):
-    """auto_start=True POSTs the kickoff prompt on a fresh launch and is
-    suppressed on resume (the restored session already carries its
-    conversation)."""
+    """auto_start=True POSTs the kickoff prompt on a fresh launch; on resume
+    the kickoff is suppressed (the restored session already carries its
+    conversation) but a System: resume notice is POSTed so the agent notices
+    the resume."""
     import optio_opencode.session as session_mod
 
     _supply_scenario["name"] = "happy"
@@ -330,19 +331,34 @@ async def test_auto_start_posts_on_fresh_and_not_on_resume(
     await run_opencode_session(ctx_fresh, OpencodeTaskConfig(
         consumer_instructions="(scenario: happy)",
         auto_start=True,
+        # Plant auth.json so the snapshot-capture defense-in-depth guard does
+        # not refuse to mark this resumable; otherwise the resume leg would
+        # fall back to a fresh launch and POST the kickoff prompt again.
+        before_execute=_plant_env,
     ))
-    assert len(posts) == 1
-    posted_session_id, posted_message = posts[0]
-    assert posted_message == session_mod.AUTO_START_PROMPT
-    assert posted_session_id  # a real (pre-created) session id
-
-    # resume the same process → must NOT POST again
+    # The 'happy' scenario also emits a DELIVERABLE, which the mandatory
+    # acknowledgment POSTs as a "deliverable ...: accepted" ack via the same
+    # _post_opencode_prompt. This test is about the kickoff / resume-notice
+    # posts, so filter those out.
+    notice = f"{session_mod.SYSTEM_MESSAGE_PREFIX}{session_mod.RESUME_NOTICE}"
+    kickoffs = [m for _sid, m in posts if m == session_mod.AUTO_START_PROMPT]
+    notices = [m for _sid, m in posts if m == notice]
+    assert kickoffs == [session_mod.AUTO_START_PROMPT]  # kickoff posted exactly once
+    assert notices == []                                # no resume notice on fresh
+    assert all(sid for sid, _m in posts)                # real (pre-created) session ids
+
+    # resume the same process → the kickoff is suppressed, but a System:
+    # resume notice is POSTed so the agent notices the resume.
     ctx_resume = await _make_ctx(mongo_db, pid, resume=True)
     await run_opencode_session(ctx_resume, OpencodeTaskConfig(
         consumer_instructions="(scenario: happy)",
         auto_start=True,
+        before_execute=_plant_env,
     ))
-    assert len(posts) == 1, posts
+    kickoffs = [m for _sid, m in posts if m == session_mod.AUTO_START_PROMPT]
+    notices = [m for _sid, m in posts if m == notice]
+    assert kickoffs == [session_mod.AUTO_START_PROMPT]  # no NEW kickoff on resume
+    assert notices == [notice]                          # resume notice posted once
 
 
 def test_post_opencode_prompt_uses_prompt_async_parts_body(monkeypatch):