Heretek-AI/opencode-v2-plugin-teser
1
0 Fork 0
mirror of https://github.com/Heretek-AI/opencode-v2-plugin-teser.git synced 2026-11-07 11:05:59 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity
51 Commits 4 Branches 3 Tags
main
Commit Graph
51 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
BillyOutlast dfc6f6a526 ci(ocr): point review job at org reusable workflow (pinned) 
Fix 'failed to fetch workflow' parse error: ocr.yml referenced a local reusable workflow path (./.github/workflows/ocr-review.yml) that does not exist in this repo. Point at Heretek-AI/.github org reusable workflow pinned to main HEAD (a440b485).
 2026-10-19 16:34:24 -04:00
BillyOutlast 2fe0ba871f ci: add reusable OpenCodeReview PR workflow 2026-10-19 15:49:43 -04:00
John Smith bd36c293c2 ci: require npm >= 11.5 for OIDC trusted publishing v0.1.1 2026-10-18 22:32:58 -04:00
John Smith b9bc7ccf23 chore: bump to 0.1.1 v1 2026-10-18 22:15:42 -04:00
John Smith 2245c87a8e ci: add OIDC trusted-publishing workflow for npm 
Publishes @heretek-ai/opencode-plugin-ci on full semver tags (v*.*.*)
via npm OIDC trusted publishing with provenance. Gates on
bun run check and a tag-vs-package.json version guard.
 2026-10-18 21:38:49 -04:00
John Smith d4deb3ef57 Fix review-main leftovers: dead scrub calls, SECRET_NAME_RE, docs, audit doc move 
- README Security: value-side scrubbing covers only live.keys values
- load.ts/cli.ts: remove no-op collectSecretValues() scrubbing, fix comments
- scripted.ts: fix stale env-scan comment
- redact.ts: delete unused SECRET_NAME_RE
- README/SPEC: deduplicate matrix artifact-name paragraph
- Move audit docs under docs/reports/ with v1-stale status notes
v0.1.0 		2026-10-18 19:09:43 -04:00
Agency Coordinator 8aa4d618ae Docs: add adversarial audit findings + prompt (596+260 lines, no live key, throwaway dummies only) 2026-10-18 02:49:19 -04:00
Agency Coordinator eaf6e21063 Remediate R1/R2/R3 per review-v1.1 
R1: remove gate.artifact multi-version guard (schema superRefine),
delete artifact-guard test, docs to recommendation (README+SPEC).
R2: collectSecretValues returns only live.keys, MIN 4->8,
scrub JSON-escaped form; update evidence-scrub tests.
R3: action.yml resolved-dir guard (pwd -P vs GITHUB_WORKSPACE),
result=fail on reject, allow absolute-inside; update
action-working-dir tests + README/SPEC.

Triad: programmer->QA PASS (316 pass)->Drift Guard VERDICT:PASS
 2026-10-18 01:14:21 -04:00
John Smith 8422645da7 v1.1 M14: decision checklist 14-25 2026-10-18 00:25:30 -04:00
John Smith 8fc1886818 audit P3: docs/guards/artifact 
OCI-6.2-artifact-poisoning: ConfigSchema.superRefine fails when gate.artifact is the default AND opencode.versions has >1 entry (message names file+field); pinned by artifact-guard test; multi-version unit tests updated to distinct artifacts.

OCI-7.1-no-line: README + SPEC 5.2 now say errors name file and field, not a line number; no code change.

OCI-registry-drift: no code change; NOTES policy note on latest float + re-pinning rule.

OCI-6.3-working-dir docs: action.yml input description, README, SPEC 8 constrain working-directory to GITHUB_WORKSPACE.

OCI-7.2-floating-majors: dependabot.yml (weekly github-actions); v7 SHAs recorded in NOTES (checkout 3d3c42e, setup-node 949feb2, upload-artifact cf430e0, setup-bun 0c5077e).
 2026-10-18 00:19:24 -04:00
John Smith 75624bb4e6 audit P2: allowed/symlink/pins 
OCI-6.1-allowed-wiring: extracted pure partitionVersions(versions), called from runCi; pinned by partition test (slice(1)->[] sabotage red).

OCI-2.5-files-symlink: evaluateFiles resolves the real path after the lexical check and re-checks containment, failing closed on realpath error; symlink exfiltration rejected, legit sub/../ paths pass.

OCI-6.4-action-pins + OCI-6.3-working-dir guard + OCI-7.2 pins: checkout/setup-node/upload-artifact bumped v4->v7 (both files; setup-bun stays v2 at HEAD), pinned by action-pins test; IN_WD env passthrough + case-guard rejects ../ and absolute working-directory (zero-interpolation kept), pinned by action-working-dir test.
 2026-10-18 00:19:22 -04:00
John Smith 2c3ac504d5 audit P2: meta/order/noerrors/cap 
OCI-3.3-meta: writeRecord seam pins metadata-last spread; colliding kind/phase/seq test goes red on payload-wins sabotage.

OCI-4.3-order: extracted buildLoadPlugins(pre,shim,post), pinned by load-order test; swap sabotage goes red. runLoad-level hook e2e inapplicable (tier 1 emits no hook records).

OCI-2.5-noerrors: noerrors.test.ts pins the ?? true fallback (unset+error event must fail); no prod change, schema default untouched.

OCI-1.4-cap: clip() capArrays flag; inventory records bypass the 200-item array cap (strings still clip). 201-tool inventory test.

OCI-1.4-providers + OCI-5.6-inert-window: verified already remediated by M7 removal; removed-fields.test.ts pins the rejection.
 2026-10-18 00:19:20 -04:00
John Smith b5876a6301 audit P1: redact + evidence scrub + skip assertion 
OCI-7.3-redact-untested: test/unit/probe-redact.test.ts pins all six
alternatives individually; narrowings go red.
OCI-7.3-evidence-leaks: redactSecretValues/collectSecretValues in
src/util/redact.ts, applied to stub recordFile, tier events.jsonl/stderr.log,
results.json display strings and report.md/summary/gate section; in-memory
evidence stays raw. test/unit/evidence-scrub.test.ts; scrub-bypass sabotage
goes red. README security section narrowed to env/headers + author
responsibility.
OCI-1.5-skip: cli.test.ts asserts throws-smoke skipped 'tier 1 failed'
e2e green.
Also: action-guard fixtures avoid literal expressions; drop dead pluginPath
local in load.ts (lint). docs/NOTES.md audit P1 section. 286 pass.
 2026-10-18 00:09:33 -04:00
John Smith 0de0a68087 audit P1: action/files guards + unpublished doc 
OCI-6.3-action-guard: test/unit/action-guard.test.ts pins zero-interpolation
in run: blocks; injection sabotage goes red.
OCI-6.4-files-guard: test/unit/packaging.test.ts pins files/bin + npm pack
contents; drop-probe sabotage goes red.
OCI-6.4-unpublished: README quickstart uses source checkout form; bunx only
mentioned in the unpublished note.
Also: observe Sandbox git-init promise so a throwing constructor never
leaves an unhandled rejection. 271 pass.
 2026-10-18 00:04:10 -04:00
John Smith 7ba0cdb9e4 audit P1: workspace escape + ancestor guard 
OCI-4.4-workspace-escape: safeWorkspaceDest containment (resolve+sep,
absolute rejected) throws ConfigError; test/unit/sandbox-escape.test.ts.
OCI-4.4-ancestor: fail-closed allow-list in runLoad (builtins exempt,
local id+path match) + detectAncestorConfig scan; test/unit/ancestor-guard.test.ts.
Verified: clean tier1 exit 0; planted ancestor exit 1; evil local plugin
caught by id; guard-removal sabotage goes red. 264 pass.
 2026-10-18 00:02:24 -04:00
John Smith bec6543263 v1.1 M13: README and NOTES for v1.1 2026-10-17 23:52:47 -04:00
John Smith 410b26254f v1.1 M12: failing scenario per fixture; tool-direct proves it is direct; Action self-test job 2026-10-17 23:51:30 -04:00
John Smith 0955a39e5a v1.1 M11: judge stub defaults to fail; single defaults warning; comment fix 2026-10-17 23:49:54 -04:00
John Smith 7a2b4d5c5f v1.1 M10: PR gate history from the base branch; --gate-artifact 2026-10-17 23:45:24 -04:00
John Smith 553ac2a9f7 v1.1 M9: normalize namespaced tool names in assertions 2026-10-17 23:44:04 -04:00
John Smith 22add43f4c v1.1 M8: missing values fail every matcher except exists: false 2026-10-17 23:43:29 -04:00
John Smith 5fbfd25ad3 v1.1 M7: remove no-op config fields; live.timeoutMs is the live default 2026-10-17 23:42:55 -04:00
John Smith 4c3e8db59c v1.1 M6: reset evidence dirs per case; reserve tool ids; validate --opencode and --scenario 2026-10-17 23:37:10 -04:00
John Smith c19eeced10 v1.1 M5: budget exhaustion fails started cases; one budget per run 2026-10-17 23:34:46 -04:00
John Smith 1cc883cc79 v1.1 M4: run .opencode-ci test files by explicit path 2026-10-17 23:33:44 -04:00
John Smith 91231e4ffe v1.1 M3: build before resolving entries; tier 1 uses plugin.entry 2026-10-17 23:30:20 -04:00
John Smith cdb58cbaab v1.1 M2: fake opencode binary and runCi test setup 2026-10-17 23:27:46 -04:00
BillyOutlast 32eb99d772 Merge pull request #5 from Heretek-AI/claude/project-thread-9cgpai 
docs: v1.1 fix brief, v1 review report and SPEC decisions 14-25
 2026-10-17 23:24:38 -04:00
Claude ca6bdd546e docs: v1.1 fix brief, review report and SPEC decisions 14-25 
Add the v1 review (docs/reports/review-v1.md) and a milestone-by-milestone
fix brief for the local agent (docs/IMPLEMENTATION_PROMPT_v1.1.md). Every
code block in the brief was replayed on a fresh copy of main at af6675c;
each milestone's unit count matches (213 -> 248) and e2e goes 24 -> 28.

Update SPEC to the fixed behavior: build before entry resolution, explicit
plugin.entry must exist, bun-test file paths, one live budget per run that
never hides a failure, evidence dirs reset per case, removed no-op fields,
missing-value and namespaced-name matcher rules, PR gate history from the
base branch, --gate-artifact, and the Action's real inputs and outputs.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01HhCPhJ7HTV7GEU2UMhroSc
 2026-10-18 03:15:03 +00:00
BillyOutlast af6675cc17 Merge pull request #4 from Heretek-AI/impl/v1 
Implement opencode-plugin-ci v1
 2026-10-17 20:34:47 -04:00
John Smith 4d5e556d6c M14: final pass - SPEC audit, Known gaps, check (213 pass) and e2e (24 pass) green 2026-10-17 20:32:47 -04:00
John Smith ad1e21ea4c M13: composite action, examples, README and CI workflow 2026-10-17 19:13:09 -04:00
John Smith 876c799c9c M12: flake gate with verbatim verdict port, history and gate orchestration 2026-10-17 19:08:38 -04:00
John Smith 276bbf08d9 M11: live tier, judge run and budget enforcement 2026-10-17 19:01:32 -04:00
John Smith 3df33a06ab M10: results, report, CLI run/validate/init/report with required-vs-allowed 2026-10-17 18:55:38 -04:00
John Smith 74b5ddfe75 M9: matchers, expect evaluation and scripted tier 2 2026-10-17 18:47:43 -04:00
John Smith 1c8b799ee6 M8: entry resolution, shim, install/build, tier 1 load checks 2026-10-17 18:43:20 -04:00
John Smith 7ebc575ed8 M7: config and scenario schema with validation, loader and JSON schemas 2026-10-17 18:39:30 -04:00
John Smith f7816fdb9e M6: fixture plugins for every surface (pass/fail, throws, tui, no-entry) 2026-10-17 18:35:49 -04:00
John Smith 42aca14049 M5: probe pre/post with inventory, hooks, events and readProbe 2026-10-17 18:33:33 -04:00
John Smith 887b706871 M4: stub model with Code Mode auto-wrap and judge detection 2026-10-17 18:30:36 -04:00
John Smith bf6c9e5ebb M3: sandbox and opencode binary resolution (events, logs, isolated run) 2026-10-17 18:26:24 -04:00
John Smith 54e3631b10 M2: spike re-run results (hook order, Code Mode namespacing) 2026-10-17 18:23:17 -04:00
John Smith 1823929f0c M1: scaffold opencode-plugin-ci (cli --version, check green) 2026-10-17 18:19:14 -04:00
BillyOutlast 3758b60cf4 Merge pull request #3 from Heretek-AI/claude/project-thread-9cgpai 
Add step-by-step implementation brief
 2026-10-17 18:13:42 -04:00
Claude 5d9512a06e Add step-by-step implementation brief 
A 14-milestone brief for a coding agent. It carries the verified
opencode 2.0.26 facts, a tested reference probe, exact file layout,
acceptance checks per milestone, and the gotchas hit in the spike.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01HhCPhJ7HTV7GEU2UMhroSc
 2026-10-17 22:13:13 +00:00
BillyOutlast fa620dbea4 Merge pull request #2 from Heretek-AI/claude/project-thread-9cgpai 
Record spike results in the spec
 2026-10-17 18:07:12 -04:00
Claude 94152cb9b5 Record spike results in the spec 
Plugin dirs load server/index only, hooks run in config order, plugin
tools default to Code Mode, and deny-all permissions give a tool-less
judge. Update the probe, shim, stub and tier 1 design to match.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01HhCPhJ7HTV7GEU2UMhroSc
 2026-10-17 22:06:13 +00:00
BillyOutlast d1dff0d623 Merge pull request #1 from Heretek-AI/claude/project-thread-9cgpai 
Add v1 spec for opencode v2 plugin CI
 2026-10-17 17:54:22 -04:00
Claude 73bd2cadf6 Add v1 spec for opencode v2 plugin CI 
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01HhCPhJ7HTV7GEU2UMhroSc
 2026-10-17 21:53:07 +00:00