witbitz-code 1.2.0__py3-none-any.whl

witbitz_code/pair.py

@@ -0,0 +1,222 @@
+"""PAIR this computer with your Spaces account, so the Code section on every device you are signed in on reaches the
+OpenCode running here — through the sealed relay, with nothing typed. The flows of tools/opencode-pair.mjs.
+
+What a pairing is (docs/opencode-relay.md §3): a random 32-byte SECRET per (computer, account), stored here in
+~/.witbitz/code/pairings.json (0600) and published into the account's sealed `computers` registry, which every signed-in
+device reads. The relay channel and both encryption keys derive from it; the relay never sees it.
+
+Several accounts can pair the same computer — each is a separate entry, secret and channel (§10). OpenCode has no users,
+so every paired account reaches the same sessions, files and shell; this tool says so when a second account pairs.
+"""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from typing import Any
+
+from . import account as acct
+from . import link, net
+from . import pairings as pp
+from ._js import UNDEFINED, number_str, to_number, truthy
+from .connector import START_HINT
+
+LinkFn = Callable[[], Awaitable[Any]]
+
+
+def _out(msg: str) -> None:
+    print(msg, flush=True)
+
+
+def _err(msg: str) -> None:
+    print(msg, file=sys.stderr, flush=True)
+
+
+class UsageError(Exception):
+    pass
+
+
+@dataclass
+class Args:
+    rotate: bool = False
+    dry: bool = False
+    unpair: bool = False
+    status: bool = False
+    name: str = ""
+    account: str = ""
+    opencode_url: str = ""
+
+
+def parse_args(argv: list[str]) -> Args:
+    a = Args()
+    i = 0
+    while i < len(argv):
+        x = argv[i]
+        nxt = argv[i + 1] if i + 1 < len(argv) else ""
+        if x == "--rotate":
+            a.rotate = True
+        elif x == "--dry-run":
+            a.dry = True
+        elif x == "--unpair":
+            a.unpair = True
+        elif x == "--status":
+            a.status = True
+        elif x in ("--name", "--account", "--opencode-url", "--port"):
+            i += 1
+            if x == "--name":
+                a.name = nxt
+            elif x == "--account":
+                a.account = nxt
+            elif x == "--opencode-url":
+                a.opencode_url = nxt
+            else:
+                port = to_number(nxt)
+                if truthy(port):
+                    a.opencode_url = f"http://127.0.0.1:{number_str(port)}"
+        else:
+            raise UsageError(f"witbitz-code: unknown argument {x}")
+        i += 1
+    return a
+
+
+def ensure_local_password(out: Callable[[str], Any] = _out) -> None:
+    path = pp.env_path()
+    try:
+        text = path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        text = ""
+    if pp.env_get(text, "OPENCODE_SERVER_PASSWORD"):
+        return
+    pp.write_in_place(path, pp.env_set(text, "OPENCODE_SERVER_PASSWORD", pp.new_password()))
+    out(f"witbitz-code: ✓ minted a local OpenCode password in {path} (0600) — it never leaves this computer")
+
+
+async def _publish_entry(call: net.ApiCall, e: dict, out: Callable, err: Callable) -> bool:
+    r = await acct.publish_computer(call=call, idx=e["idx"], computer_id=e["computerId"], name=e["name"], relay=e["relay"],
+                                    secret=e["secret"])
+    who = e["account"] or "account"
+    if not r["ok"]:
+        err(f"witbitz-code: ✖ {who}: {r['why']}")
+        return False
+    out(f"witbitz-code: ✓ \"{e['name']}\" is in {e['account'] or 'the account'}'s computers ({len(r['computers'])} paired)")
+    lg = await acct.clear_legacy_direct(call=call, idx=e["idx"])
+    if not lg["ok"]:
+        out(f"witbitz-code: ⚠ could not clear the old direct-server settings ({lg['why']}) — harmless while a computer is paired")
+    elif not lg.get("noop"):
+        out("witbitz-code: ✓ cleared the old direct-server address from the account (devices use the relay now)")
+    return True
+
+
+async def _link_by_qr(link_fn: LinkFn | None, out: Callable, err: Callable) -> dict | None:
+    """The QR ritual: show the Add-a-device QR and wait for a signed-in device to seal the account to this computer. The
+    account stays in memory; an expired or failed scan changes nothing."""
+    out("witbitz-code: on your phone open Spaces → Settings → Back up & recovery → Add a device, and scan the QR below "
+        "with the account to pair.\n")
+    account = await (link_fn() if link_fn else link.link_node())
+    if not account:
+        return None
+    idx = account.get("idx")
+    if not isinstance(idx, dict) or not truthy(idx.get("room")) or not truthy(idx.get("mk")):
+        err("witbitz-code: the scan carried no index-room pointer, so there is nowhere to publish — nothing changed.")
+        return None
+    return account
+
+
+async def main(argv: list[str], *, call: net.ApiCall | None = None, link_fn: LinkFn | None = None,
+               out: Callable[[str], Any] = _out, err: Callable[[str], Any] = _err) -> int:
+    """pair / --status / --unpair / --rotate. Returns the exit code."""
+    try:
+        args = parse_args(argv)
+    except UsageError as e:
+        err(str(e))
+        return 2
+    client = None
+    if call is None and not args.status:
+        client = net.new_client()
+        call = net.make_api_call(client)
+    try:
+        return await _run(args, call, link_fn, out, err)
+    finally:
+        if client is not None:
+            await client.aclose()
+
+
+async def _run(args: Args, call: Any, link_fn: LinkFn | None, out: Callable, err: Callable) -> int:
+    doc = pp.read_pairings()
+
+    if args.status:
+        if not doc["pairings"]:
+            out("witbitz-code: not paired")
+        for p in doc["pairings"]:
+            out(f"· \"{p.get('name')}\" → {p.get('account') or '(account)'} · OpenCode {p.get('opencodeUrl')} · relay {p.get('relay')}")
+        return 0
+
+    if args.unpair:
+        targets = [p for p in doc["pairings"] if not args.account or p.get("account") == args.account]
+        if not targets:
+            err(f"witbitz-code: no pairing{' for ' + args.account if args.account else ''} on this computer")
+            return 1
+        if len(targets) > 1 and not args.account:
+            names = ", ".join(str(p.get("account")) for p in targets)
+            err(f"witbitz-code: this computer is paired with {len(targets)} accounts ({names}) — pass --account <email>")
+            return 1
+        if args.dry:
+            out(f"witbitz-code: --dry-run — would remove \"{targets[0].get('name')}\" from {targets[0].get('account')}")
+            return 0
+        ok = True
+        for p in targets:
+            r = await acct.unpublish_computer(call=call, idx=p["idx"], computer_id=p["computerId"])
+            if not r["ok"]:
+                ok = False
+                err(f"witbitz-code: ✖ {p.get('account')}: {r['why']} — kept the local pairing so you can retry")
+                continue
+            note = " (it was not listed)" if r.get("noop") else ""
+            out(f"witbitz-code: ✓ removed \"{p.get('name')}\" from {p.get('account')}{note} — every device drops it on its next sync")
+            pp.write_pairings(pp.remove_pairings(pp.read_pairings(), p.get("account") or "")["doc"])
+        out(f"witbitz-code: restart the connector ({START_HINT}) so it stops answering on the old channel.")
+        return 0 if ok else 1
+
+    if args.rotate:
+        if not doc["pairings"]:
+            err("witbitz-code: nothing to rotate — pair first")
+            return 1
+        to_rotate = [x for x in doc["pairings"] if not args.account or x.get("account") == args.account]
+        if args.dry:
+            out(f"witbitz-code: --dry-run — would rotate {len(to_rotate)} pairing(s)")
+            return 0
+        cur, ok = doc, True
+        for p in to_rotate:
+            u = pp.upsert_pairing(cur, account=p.get("account") or "", idx=p["idx"], name=p.get("name") or "",
+                                  relay=p.get("relay", UNDEFINED), opencode_url=p.get("opencodeUrl", UNDEFINED), rotate=True)
+            if await _publish_entry(call, u["entry"], out, err):
+                cur = u["doc"]
+                pp.write_pairings(cur)
+            else:
+                ok = False
+        out("witbitz-code: restart the connector so it listens on the new channel(s).")
+        return 0 if ok else 1
+
+    # PAIR — the QR ritual
+    if args.dry:
+        out("witbitz-code: --dry-run — would show the QR, then publish this computer to the scanning account")
+        return 0
+    account = await _link_by_qr(link_fn, out, err)
+    if not account:
+        err("witbitz-code: pairing did not complete — nothing changed.")
+        return 1
+    u = pp.upsert_pairing(doc, account=account.get("email") or "", idx=account["idx"], name=args.name,
+                          opencode_url=args.opencode_url or UNDEFINED)
+    ensure_local_password(out)
+    if not await _publish_entry(call, u["entry"], out, err):
+        err("witbitz-code: nothing saved locally — scan again to retry.")
+        return 1
+    pp.write_pairings(u["doc"])
+    e = u["entry"]
+    out(f"witbitz-code: ✓ {'paired' if u['isNew'] else 'refreshed'} \"{e['name']}\" with {e['account'] or 'your account'} ({pp.pairings_path()})")
+    if u["sharedWith"]:
+        out(f"witbitz-code: ⚠ this computer's OpenCode ({e['opencodeUrl']}) is now reachable from {e['account']} AND {', '.join(u['sharedWith'])}.")
+        out("              OpenCode has no users: they share every session, file and shell. Fine for your own accounts;")
+        out("              for another person run a separate OpenCode (another port and OS user) and pair with --opencode-url.")
+    out(f"witbitz-code: next — start OpenCode and the connector:  {START_HINT}")
+    return 0

witbitz_code/pairings.py

@@ -0,0 +1,214 @@
+"""This computer's pairings file and the local OpenCode env file — the pure half of tools/opencode-pair.mjs plus the
+connector's loader.
+
+~/.witbitz/code/pairings.json (0600) is shared with the JS tools, so it is written byte-for-byte as they write it
+(`JSON.stringify(doc, null, 1) + "\\n"`): either implementation can pair a computer and the other can serve or unpair it.
+
+  { "v": 1, "pairings": [ { account, idx: {room, mk}, computerId, secret, name, relay, opencodeUrl } ] }
+
+One entry per (computer, account) — several accounts can pair the same computer, each with its own secret and channel.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import secrets
+import socket
+import sys
+import tempfile
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+from . import _js
+from ._js import NOT_LT, UNDEFINED, WS, strict_eq, truthy
+from .relay import RELAY_URL, new_relay_secret
+
+DEFAULT_OPENCODE_URL = "http://127.0.0.1:4096"
+
+
+def pairings_path() -> Path:
+    env = os.environ.get("WITBITZ_CODE_PAIRINGS")
+    return Path(env) if env else Path.home() / ".witbitz" / "code" / "pairings.json"
+
+
+def env_path() -> Path:
+    env = os.environ.get("OPENCODE_ENV_FILE")
+    return Path(env) if env else Path.home() / ".opencode-server.env"
+
+
+# ── the env file ──────────────────────────────────────────────────────────────────────────────────────────────────────
+def _assignment(key: str) -> re.Pattern:
+    # JS: /^\s*(?:export\s+)?KEY=(.*)$/ on each line split at /\r?\n/ (a Windows-edited file keeps its password). JS `.`
+    # still stops at a lone \r or U+2028, so NOT_LT keeps the two tools agreeing on those.
+    return re.compile(f"[{WS}]*(?:export[{WS}]+)?{re.escape(key)}=({NOT_LT}*)")
+
+
+def env_get(text: Any, key: str) -> str | None:
+    """The value of KEY in an env file — the LAST assignment wins, as when the file is sourced. Quotes are stripped."""
+    rx = _assignment(key)
+    v = None
+    for line in re.split(r"\r?\n", _js.js_string(text if truthy(text) else "")):
+        m = rx.fullmatch(line)
+        if m:
+            q = re.fullmatch(f"(['\"])({NOT_LT}*)\\1", _js.trim(m.group(1)))
+            v = q.group(2) if q else _js.trim(m.group(1))
+    return v
+
+
+def env_set(text: Any, key: str, value: str) -> str:
+    """Set KEY=value: every existing assignment of KEY is removed, one is appended, every other line is kept verbatim."""
+    rx = re.compile(f"[{WS}]*(?:export[{WS}]+)?{re.escape(key)}=")
+    keep = [ln for ln in re.split(r"\r?\n", _js.js_string(text if truthy(text) else "")) if not rx.match(ln)]
+    while keep and keep[-1] == "":
+        keep.pop()
+    keep.append(f"{key}={value}")
+    return "\n".join(keep) + "\n"
+
+
+def parse_env_password(text: Any) -> str:
+    """OPENCODE_SERVER_PASSWORD from an env file ('' when absent)."""
+    return env_get(text, "OPENCODE_SERVER_PASSWORD") or ""
+
+
+def read_env_password(path: Path | None = None) -> str:
+    p = path or env_path()
+    try:
+        return parse_env_password(p.read_text(encoding="utf-8"))
+    except OSError:
+        return ""
+
+
+def new_password() -> str:
+    """32 URL-safe characters (192 bits) — the LOCAL OpenCode password; it never leaves this computer."""
+    return secrets.token_urlsafe(24)
+
+
+def new_computer_id() -> str:
+    """16 random bytes, base64url. One per (computer, account) pairing."""
+    return secrets.token_urlsafe(16)
+
+
+def hostname() -> str:
+    return socket.gethostname()
+
+
+# ── the pairings doc (pure) ───────────────────────────────────────────────────────────────────────────────────────────
+def _usable(p: Any) -> bool:
+    idx = p.get("idx") if isinstance(p, dict) else None
+    return (isinstance(idx, dict) and truthy(idx.get("room")) and truthy(idx.get("mk"))
+            and isinstance(p.get("secret"), str) and isinstance(p.get("computerId"), str))
+
+
+def norm_pairings(doc: Any) -> dict:
+    """The pairings file as a list-holder; tolerant of a missing or broken file."""
+    lst = doc.get("pairings") if isinstance(doc, dict) else None
+    return {"v": 1, "pairings": [p for p in lst if _usable(p)] if isinstance(lst, list) else []}
+
+
+def upsert_pairing(doc: Any, *, idx: dict, account: str = "", name: str = "", relay: Any = UNDEFINED,
+                   opencode_url: Any = UNDEFINED, rotate: bool = False, mint_id: Callable[[], str] = new_computer_id,
+                   mint_secret: Callable[[], str] = new_relay_secret) -> dict:
+    """Add this computer for an account, or refresh the existing entry (same id + secret unless `rotate`). Pure.
+    → {doc, entry, isNew, sharedWith}: sharedWith names the other accounts that reach the same OpenCode."""
+    relay = RELAY_URL if relay is UNDEFINED else relay
+    cur = norm_pairings(doc)
+    i = next((k for k, p in enumerate(cur["pairings"]) if strict_eq(p["idx"].get("room"), idx.get("room"))), -1)
+    prev = cur["pairings"][i] if i >= 0 else None
+
+    def pick(v: Any, key: str, dflt: Any) -> Any:
+        if truthy(v):
+            return v
+        return prev[key] if prev is not None and truthy(prev.get(key)) else dflt
+
+    entry = {
+        "account": pick(account, "account", ""),
+        "idx": {"room": idx.get("room"), "mk": idx.get("mk")},
+        "computerId": prev["computerId"] if prev is not None else mint_id(),
+        "secret": prev["secret"] if prev is not None and not rotate else mint_secret(),
+        "name": pick(name, "name", None) or hostname(),
+        "relay": relay,
+        # An OpenCode asked for (`pair --port 4097`) wins; not asked → the entry keeps the one it had (tools/opencode-pair.mjs).
+        "opencodeUrl": pick(None if opencode_url is UNDEFINED else opencode_url, "opencodeUrl", DEFAULT_OPENCODE_URL),
+    }
+    pairings = list(cur["pairings"])
+    if i >= 0:
+        pairings[i] = entry
+    else:
+        pairings.append(entry)
+    others = [p for p in pairings if not strict_eq(p["idx"].get("room"), idx.get("room"))
+              and strict_eq(p.get("opencodeUrl", UNDEFINED), entry["opencodeUrl"])]
+    return {"doc": {"v": 1, "pairings": pairings}, "entry": entry, "isNew": prev is None,
+            "sharedWith": [p["account"] if truthy(p.get("account")) else "(another account)" for p in others]}
+
+
+def remove_pairings(doc: Any, account: str = "") -> dict:
+    """Drop the entries matching `account` (email) — or every entry when `account` is empty. Pure."""
+    cur = norm_pairings(doc)
+    gone = [p for p in cur["pairings"] if not truthy(account) or strict_eq(p.get("account", UNDEFINED), account)]
+    kept = [p for p in cur["pairings"] if not any(p is g for g in gone)]
+    return {"doc": {"v": 1, "pairings": kept}, "removed": gone}
+
+
+# ── files ─────────────────────────────────────────────────────────────────────────────────────────────────────────────
+def read_pairings(path: Path | None = None) -> dict:
+    try:
+        return norm_pairings(_js.parse((path or pairings_path()).read_text(encoding="utf-8")))
+    except (OSError, ValueError):
+        return norm_pairings(None)
+
+
+def write_private(path: Path, text: str, dir_mode: int = 0o700) -> None:
+    """Write a 0600 file atomically: the secret is never readable by others, not even for the moment between write and
+    chmod, and a crash never leaves half a file."""
+    path.parent.mkdir(parents=True, exist_ok=True, mode=dir_mode)
+    fd, tmp = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8", newline="") as f:
+            f.write(text)
+        os.chmod(tmp, 0o600)
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def write_in_place(path: Path, text: str) -> None:
+    """Rewrite a file the user may manage (the env file — possibly a symlink): atomically at its real location, 0600
+    from the first byte, so there is no moment when a new password sits in a world-readable file and no crash that
+    leaves the user's other lines half-written."""
+    write_private(Path(os.path.realpath(path)), text)
+
+
+def serialize_pairings(doc: dict) -> str:
+    return _js.stringify(doc, 1) + "\n"
+
+
+def write_pairings(doc: dict, path: Path | None = None) -> None:
+    write_private(path or pairings_path(), serialize_pairings(doc))
+
+
+def load_pairings(path: Path | None = None, log: Callable[[str], Any] | None = None) -> list[dict]:
+    """The connector's view: the list (empty when absent). Entries without a secret are skipped, loudly."""
+    log = log or (lambda m: print(m, file=sys.stderr, flush=True))
+    p = path or pairings_path()
+    if not p.exists():
+        return []
+    try:
+        doc = _js.parse(p.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as e:
+        log(f"witbitz-code: {p} is not valid JSON ({e})")
+        return []
+    lst = doc.get("pairings") if isinstance(doc, dict) else None
+    out = []
+    for entry in lst if isinstance(lst, list) else []:
+        secret = entry.get("secret") if isinstance(entry, dict) else None
+        if isinstance(secret, str) and _js.utf16_len(secret) >= 43:
+            out.append(entry)
+        else:
+            log("witbitz-code: skipping a pairing with no secret")
+    return out

witbitz_code/plugins.py

@@ -0,0 +1,140 @@
+"""Our OpenCode plugins — project notes and the agent's progress updates — for a computer running the Python connector.
+
+The twin of tools/opencode-plugins/install.mjs: the same three files (package data in opencode_plugins/, copied from the
+sources by `node tools/opencode-plugins/embed.mjs`; a test fails when a copy is stale) are written into OpenCode's config
+folder on every `serve`, where OpenCode loads {plugin,plugins}/*.js and {command,commands}/**.md at boot.
+
+With the notes plugin installed, the connector allows each session to read its project's notes folder and write into
+notes/ (connector.py, the twin of ruleNotes in tools/opencode-connector.mjs): the plugin makes the agent keep notes at the
+end of a turn, and one note used to cost four approvals.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import re
+import shutil
+from importlib import resources
+from pathlib import Path
+
+# Installed path (under OpenCode's config folder) → the packaged file.
+FILES = {
+    "plugins/witbitz-notes.js": "witbitz-notes.js",
+    "plugins/witbitz-progress.js": "witbitz-progress.js",
+    "commands/notes-init.md": "notes-init.md",
+}
+
+
+def opencode_config_dir(env: dict | None = None) -> Path:
+    """OpenCode's config folder, as OpenCode finds it: $XDG_CONFIG_HOME/opencode, else ~/.config/opencode (Windows too)."""
+    env = os.environ if env is None else env
+    return Path(env.get("XDG_CONFIG_HOME") or (Path.home() / ".config")) / "opencode"
+
+
+def packaged(name: str) -> str:
+    return resources.files("witbitz_code").joinpath("opencode_plugins", name).read_text(encoding="utf-8")
+
+
+def install(config_dir: Path | None = None) -> list[Path]:
+    """Write the plugin files into OpenCode's config folder; → the installed paths that changed. An identical file is left
+    alone; the notes' old confidential-model list is removed (the notes no longer split by model)."""
+    root = Path(config_dir) if config_dir else opencode_config_dir()
+    changed = []
+    for rel, name in FILES.items():
+        target = root / rel
+        text = packaged(name)
+        try:
+            if target.read_text(encoding="utf-8") == text:
+                continue
+        except (OSError, UnicodeDecodeError):
+            pass
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(text, encoding="utf-8", newline="")
+        changed.append(target)
+    try:
+        (root / "witbitz-confidential-models.json").unlink()
+    except FileNotFoundError:
+        pass
+    return changed
+
+
+# ── witbitz-media: image/PDF/video/audio tools as one stdio MCP server (tools/media-mcp/server.mjs; docs/media-mcp.md) ───────
+# The twin of install.mjs installMedia/mediaMcpConfig. The server is JavaScript, so it runs only where `node` is on PATH
+# (OpenCode installed with npm brings it; the standalone OpenCode binary does not) — without node the agent works without it.
+MEDIA_REL = "witbitz-media/server.mjs"
+
+
+def install_media(config_dir: Path | None = None) -> Path:
+    """Write the media server into OpenCode's config folder (an identical file is left alone); → its path."""
+    target = (Path(config_dir) if config_dir else opencode_config_dir()) / MEDIA_REL
+    text = packaged("witbitz-media-server.mjs")
+    try:
+        if target.read_text(encoding="utf-8") == text:
+            return target
+    except (OSError, UnicodeDecodeError):
+        pass
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(text, encoding="utf-8", newline="")
+    return target
+
+
+def media_mcp_config(server: Path | str, node: str) -> dict:
+    """The OpenCode config block that runs it (merged into OPENCODE_CONFIG_CONTENT; the user's opencode.json is never written)."""
+    return {"mcp": {"witbitz-media": {"type": "local", "command": [node, str(server)], "enabled": True}}}
+
+
+def media_config(config_dir: Path | None = None, which=shutil.which) -> tuple[dict, str]:
+    """→ (the mcp block or {}, a line for the log, or "")."""
+    node = which("node")
+    if not node:
+        return {}, "witbitz-code: no node on PATH — the agent works without the media tools (images, PDFs, video, transcription)"
+    try:
+        return media_mcp_config(install_media(config_dir), node), ""
+    except OSError as e:
+        return {}, f"witbitz-code: could not install the media tools ({e}) — the agent works without them"
+
+
+# ── project notes: which folder, and the rules that let a session use it (witbitz-notes.js helpers, ported) ──────────────
+def notes_plugin_path(env: dict | None = None) -> Path:
+    return opencode_config_dir(env) / "plugins" / "witbitz-notes.js"
+
+
+def notes_root(env: dict | None = None) -> str:
+    env = os.environ if env is None else env
+    return env.get("WITBITZ_NOTES_DIR") or str(Path.home() / ".local" / "share" / "witbitz-notes")
+
+
+def notes_key(root: str) -> str:
+    """`<folder name>-<sha1(root)[:8]>`, exactly as the plugin names it: the JS regex replaces each UTF-16 code unit that is
+    not [A-Za-z0-9._-] with one "_" — so a character outside the BMP becomes two."""
+    base = os.path.basename(root) or "root"
+    safe = "".join(ch if re.fullmatch(r"[A-Za-z0-9._-]", ch) else "_" * (len(ch.encode("utf-16-le")) // 2) for ch in base)
+    return f"{safe}-{hashlib.sha1(root.encode('utf-8')).hexdigest()[:8]}"
+
+
+def root_from_session(s: dict | None) -> str:
+    """A session record → its project root: directory minus its `path` (a git session's path is "" or the subfolder, a plain
+    folder's path is its directory without the leading "/")."""
+    directory = (s or {}).get("directory")
+    if not isinstance(directory, str) or not directory:
+        return ""
+    rel = str((s or {}).get("path") or "")
+    if not rel or directory == "/" + rel:
+        return directory
+    return (directory[: -(len(rel) + 1)] or "/") if directory.endswith("/" + rel) else directory
+
+
+def notes_rules(s: dict, root_dir: str) -> list[dict]:
+    """The rules a session needs for its project's notes: reads of the folder, writes into notes/ (never AGENTS.md). The
+    edit tool's pattern is relative to the WORKTREE — the git root, or "/" for a plain folder (measured)."""
+    root = root_from_session(s)
+    if not root:
+        return []
+    folder = f"{root_dir}/{notes_key(os.path.abspath(root))}"
+    plain = bool(s.get("path")) and s.get("directory") == "/" + str(s.get("path"))
+    rel = os.path.relpath(folder, "/" if plain else os.path.abspath(root))
+    return [
+        {"permission": "external_directory", "pattern": f"{folder}/*", "action": "allow"},
+        {"permission": "edit", "pattern": f"{rel}/notes/*", "action": "allow"},
+    ]

witbitz_code/policy.py

@@ -0,0 +1,48 @@
+"""The OpenCode config the Code section's approvals depend on — twin of tools/code-opencode-policy.mjs.
+
+Read that file's header for the two findings (OpenCode 1.18.30): a subagent does NOT inherit its parent session's `ask`
+rules, so the built-in subagents are told to ask here, per agent and only for what each one ALLOWS (never loosening a
+deny); and a denied tool call ends the turn unless `experimental.continue_loop_on_deny` is set. tests/test_policy.py
+holds this object identical to the JS one.
+"""
+from __future__ import annotations
+
+import copy
+import json
+from typing import Any
+
+SUBAGENT_ASK: dict[str, dict[str, str]] = {
+    "explore": {"bash": "ask", "webfetch": "ask", "websearch": "ask"},
+    "general": {"bash": "ask", "edit": "ask", "webfetch": "ask", "websearch": "ask", "task": "ask", "skill": "ask"},
+}
+
+SUBAGENT_GATED: tuple[str, ...] = ("bash", "edit", "webfetch", "websearch")
+
+
+def policy_config() -> dict[str, Any]:
+    """The config object, fresh each call."""
+    return {
+        "experimental": {"continue_loop_on_deny": True},
+        "agent": {name: {"permission": dict(perms)} for name, perms in SUBAGENT_ASK.items()},
+    }
+
+
+def merge_config(a: dict, b: dict | None) -> dict:
+    """Deep-merge plain dicts (b wins), without mutating either."""
+    out = copy.deepcopy(a)
+    for k, v in (b or {}).items():
+        out[k] = merge_config(out[k], v) if isinstance(v, dict) and isinstance(out.get(k), dict) else copy.deepcopy(v)
+    return out
+
+
+def config_content(existing: str | None = None, extra: dict | None = None) -> str:
+    """OPENCODE_CONFIG_CONTENT for the OpenCode `serve` starts: `extra` (the media tools' mcp block) and the policy, under
+    anything the environment already set."""
+    base: dict = {}
+    if existing:
+        try:
+            parsed = json.loads(existing)
+            base = parsed if isinstance(parsed, dict) else {}
+        except ValueError:
+            base = {}
+    return json.dumps(merge_config(merge_config(base, extra), policy_config()))