0 Fork 0

mirror of https://github.com/Heretek-OpenCode/heretek-opencode.git synced 2026-11-08 17:18:16 -10:00

Files

T

History

Heretek-OpenCode Coordinator 51feda30bf feat(gateway): hardened opencode-gateway contract v1 (closes #18/#19, ready for #20 v1.0.0)

- contract/v1/fixtures: 10 golden JSON-RPC 2.0 pairs for search/fetch/
  extract_structured/research_report (+initialize, tools-list wire compat),
  X-Swarm-Contract:1 headers, real sha256 contentHash digests
- packages/contract-client (@heretek-ai/gateway-contract 1.0.0): Zod schemas
  for all tools, provenance envelope {provenance,trust:untrusted,content},
  typed MCP client (initialize negotiation, Retry-After retry, sha256
  verification, contract header assertion), fixture loader + hash check,
  pure SSRF/sanitize/circuit/cache modules
- packages/opencode-guard (@heretek-ai/gateway-guard): OpenCode v2 plugin on
  @opencode/plugin 2.0.26 exact (define + tool.hook + mcp.transform),
  gateway-only allowlist, lane-egress fallback documented
- apps/gateway (Bun/TS): SSRF fail-closed (literal blocklist + DNS pin +
  no-redirect-to-private), per-(host,engine) circuit breakers with half-open,
  injection sanitize envelope, sha256 cache keys + TTLs, caps as error codes
- catalog (4 engines), deploy (smokescreen + caddy snippets)
- QA: bun test 44/44, tsc clean, oxlint clean

2026-10-12 13:10:42 -04:00

fixtures

feat(gateway): hardened opencode-gateway contract v1 (closes #18/#19, ready for #20 v1.0.0)

2026-10-12 13:10:42 -04:00

README.md

feat(gateway): hardened opencode-gateway contract v1 (closes #18/#19, ready for #20 v1.0.0)

2026-10-12 13:10:42 -04:00

README.md

Contract v1 fixtures

Golden request/response pairs for the gateway's /mcp contract v1, for external consumers to vendor and test their client against without running this stack.

Vendoring

Copy this directory at a pinned commit: record the source commit hash next to your copy (e.g. fixtures-from: opencode-gateway@<sha>).
Match on request → assert response_status, the response_headers subset (x-swarm-contract, plus retry-after for 429s), and response_body.
Volatile fields are normalized: fetchedAt is always <fetchedAt>, Retry-After is always <retry_after_s> (assert presence, not value).
contentHash values are REAL sha256 digests over the fixture content strings — recompute and compare; a mismatch means tampered bytes.
Re-vendor on every contract-version bump (see versioning rules in contract/README.md).

Coverage

Every tool (search, fetch, extract_structured, research_report, plus initialize and tools/list) and the produced error codes (ssrf_denied, upstream_error, upstream_timeout, rate_limited, scope_denied, engine_unavailable, -32601, -32602). blocked_by_policy is reserved (no producer yet).

Conformance

packages/contract-client/test/fixtures.test.ts asserts every fixture validates against the Zod output schemas and that success-fixture contentHash values verify. Regenerate hashes with the fixture generator (delta: content strings in /tmp/gen_fixtures.py pattern) whenever a fixture's content changes.