Heretek-AI/opencode-harness
1
0 Fork 0
mirror of https://github.com/Heretek-AI/opencode-harness.git synced 2026-11-12 13:00:32 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity
68 Commits 4 Branches 8 Tags
main
Commit Graph
10 Commits
Author SHA1 Message Date
John Smith a4ce2e7470 Audit remediation 20261018: P0 shell/guard/taint + P1/P2 fixes, 1.0.10 bump (QA ACCEPT + VERDICT pending) 2026-10-18 03:38:07 -04:00
John Smith 8ee3efd9bc Wave 8: remediate all AUDIT_REPORT_FINDINGS (P0 guards/taint/symlink, P1 roles/SSRF/rollback/retry, P2/P3 deps/CI/receipts) 
- OH-6.2: explicit evaluatePermission in every harness execute (index + host adapter)
- OH-6.5: canonicalized shell classifier (sudo/env/-u/-g, basenames, git globals, refspec force, .. fail-closed, write over unwrapped)
- OH-6.6: MCP server_tool taint ids, fork inheritance, broadened denylist
- OH-6.3: realpath containment on all writers (hashline, ast, rename, tx, checkpoints)
- OH-6.1: NFKC role normalization + unknown-role least privilege
- OH-7.4: SSRF default-deny + allowlist + redirect guard; OH-7.3 scoped-test containment
- OH-2.1: zod v4 native toJSONSchema, bridge removed; TS 7.0.2; @types/bun 1.4.3
- OH-3.4/4.6: sabotage-catching rollback + retry tests; OH-4.8 created-file receipts
- OH-1.4/1.5/4.3/8.1: run.sh, SHA-pinned CI + upstream verify, hunk error, optional browser peers
- 62 new tests (267 green), scripts/accept/wave-8.sh + docs/reports/wave-8.md
 2026-10-17 02:32:00 -04:00
John Smith 76ccb31364 feat(wave-7): v1.0.6 rename_symbol + post-edit anchor receipts + retry + dead-export + lesson synthesis 
- renameSymbolAcrossWorkspace (repomap) + rename_symbol tool (index): lexer-safe atomic multi-file rename with diagnostics verification and rollback
- buildPostMutationAnchorReceipt (tool-interceptors) + contract-adapter wiring: post-formatter FNV-1a <post-edit-anchors> resync receipt
- handleSessionRetryInPlace (session-interceptors) + retry hook: adaptive stream/overload recovery, halt on fatal auth/overflow
- detectUnusedExportsAndOrphanModules (architecture-advisor): dead-code audit in runArchitectureAudit
- trackCircuitBreakerAndAutoProposeLesson (episodic-memory, normalized style): auto scope-tagged recovery lesson synthesis
- test/wave7-systems.test.ts (5 tests), scripts/accept/wave-7.sh, docs/reports/wave-7.md
- package 1.0.5->1.0.6, HARNESS_RELEASE_VERSION 1.0.6, Makefile wave-7 gate
- 194 pass / 0 fail, wave-1..7 accepts green, zero-stub clean
 2026-10-16 09:56:51 -04:00
John Smith efabedfd21 feat(wave-6): import/export verifier, symbol_references, patch repair, head-tail compactor, dual Code Mode bridge (v1.0.5) 2026-10-16 08:39:19 -04:00
John Smith 7f5fec9f34 feat(wave-5): zero-patch interceptors + architecture advisor (v1.0.4) 
- Add src/interceptors/tool-interceptors.ts (631) and
  src/interceptors/session-interceptors.ts (166) verbatim: in-place
  EditTool repair, near-miss hashline anchors, read fuzzy-resolve,
  shell env hardening, non-zero-exit detection, Tool.Result
  normalization, meta.txt calibration, compaction decontamination,
  multi-hop root session affinity.
- Add src/verify/architecture-advisor.ts (375) verbatim: Tarjan SCC
  cycles, exported-contract impact, engineering smells, audit report.
- Merge src/host/contract-adapter.ts: full interceptor wiring
  (tool/agent/mcp/command transforms, shell + permission + tool +
  session hooks, /doctor + /audit) with Wave-4 fixes re-applied
  (fail-closed non-string context check, .js imports, 1.0.4).
- Merge src/index.ts: keep Wave-4 wiring, add architecture_audit
  tool, HARNESS_RELEASE_VERSION, broader root inference,
  toTrippedDirective dual-shape mapping, computeLineHash
  disambiguation.
- Canonical EpisodicLesson in context-budget; episodic-memory
  imports it (local redef removed).
- Adopt test/plugin-interceptors.test.ts (mkdirSync strict-TS fix).
- scripts/accept/wave-5.sh (11 gates), Makefile chain, docs/reports/wave-5.md.
- 183 pass / 0 fail; make accept waves 1-5 green; build clean.
 2026-10-16 02:52:55 -04:00
John Smith 6b4d9529bf feat(wave-4): argon upgrades — 8 ported harness modules, hardened shell-parse, extended entrypoint 
- New: context/episodic-memory, guards/taint-guard, diagnostics/diagnostics-runner,
  transactions/edit-transaction, repomap/repomap, verify/verifier,
  muse/muse-calibration, host/contract-adapter (from v2-upgraded bundle, dist/ excluded)
- Extended: index.ts (extended tool table + OpenCodeV2Plugin default export;
  5 tools / 3 hooks / MCP exactness preserved), shell-parse.ts (POSIX
  tokenization + subshell unwrapping)
- Strict-TS fixes (no any): local EpisodicLesson type, createRequire for
  babel probe, tripped/directive mapping from triggered/intervention,
  fail-closed unknown-narrowing in session.context hook, .js import extension
- Tests: ported-harness.test.ts (12 tests); 161 prior green (173 total)
- Accept: scripts/accept/wave-4.sh (10 gates); Makefile runs waves 1-4
- Docs: docs/reports/wave-4.md (incl. apply_opencode_v2_core_fixes.bash
  out-of-scope note — targets opencode-2 core repo, not applied here)
 2026-10-16 01:56:17 -04:00
John Smith db2672bd8b feat(wave-3): unified OpenCode v2 plugin entrypoint + QA-ready gates 
- src/index.ts: activate/createHarnessPlugin registering 5 tools
  (file_hash_read/edit, ast_structural_search/rewrite, ui_geometry_audit)
  and 3 hooks (permission evaluate -> evaluateBoardGuard,
  tool.execute.after -> recordAndEvaluateCircuitBreaker,
  session context -> registerContextBudgetHook with KV-cache invariants);
  getRecommendedMcpConfig re-export; all Wave 1+2 modules re-exported.
- test/plugin.test.ts: 61 tests (registration, zod validation, end-to-end
  tools, guard Rules 1-4, breaker thresholds, KV invariants, MCP shape).
- scripts/accept/wave-3.sh + README.md + docs/reports/wave-3.md.
- 161 pass / 0 fail; make accept all-green.
 2026-10-15 18:39:47 -04:00
John Smith 71dbdbc29e feat(wave-2): KV-cache-safe context budget + DOM geometry auditor + MCP defaults 2026-10-15 18:27:56 -04:00
John Smith e54806ad4c feat(wave-1): deterministic editors and guards with green gates 
- hashline-tools: 4-hex FNV-1a hashes, hashReadFile, hashEditFile with
  +/-25 shifted-anchor recovery and fail-closed mismatch handling
- ast-codemod: ast-grep native search with structural-metavariable
  fallback, metavariable-substituting file rewrite
- shell-parse + permission-guard: Rules 0-4 (destructive block,
  leadership read-only, QA src lock, architect contract lock)
- circuit-breaker: doom-loop detector (>=2 failed edits same path,
  >=3 failed shell same prefix) with critical intervention
- 62 bun tests green, tsc clean, scripts/accept/wave-1.sh exit 0
 2026-10-15 17:53:26 -04:00
John Smith 18be48c21f chore: baseline scaffolding (Step 0) - AGENTS.md, SPEC.md, package.json, Makefile, tsconfig 2026-10-15 17:46:27 -04:00