Fix Issue #1428: Deny bash permission for Prometheus agent
- Change PROMETHEUS_PERMISSION bash from 'allow' to 'deny' to prevent unrestricted bash execution - Prometheus is a read-only planner and should not execute bash commands - The prometheus-md-only hook provides additional blocking as backup
This commit is contained in:
YeonGyu-Kim
+20
-52
@@ -2,61 +2,29 @@
|
||||
|
||||
## OVERVIEW
|
||||
|
||||
17 feature modules: background agents, skill MCPs, builtin skills/commands, Claude Code compatibility layer, task management.
|
||||
|
||||
**Feature Types**: Task orchestration, Skill definitions, Command templates, Claude Code loaders, Supporting utilities
|
||||
Background agents, skills, Claude Code compat, builtin commands, MCP managers, etc.
|
||||
|
||||
## STRUCTURE
|
||||
|
||||
```
|
||||
features/
|
||||
├── background-agent/ # Task lifecycle (1556 lines)
|
||||
│ ├── manager.ts # Launch → poll → complete
|
||||
│ └── concurrency.ts # Per-provider limits
|
||||
├── builtin-skills/ # Core skills
|
||||
│ └── skills/ # playwright, agent-browser, frontend-ui-ux, git-master, dev-browser
|
||||
├── builtin-commands/ # ralph-loop, refactor, ulw-loop, init-deep, start-work, cancel-ralph, stop-continuation
|
||||
├── claude-code-agent-loader/ # ~/.claude/agents/*.md
|
||||
├── claude-code-command-loader/ # ~/.claude/commands/*.md
|
||||
├── claude-code-mcp-loader/ # .mcp.json with ${VAR} expansion
|
||||
├── claude-code-plugin-loader/ # installed_plugins.json (486 lines)
|
||||
├── claude-code-session-state/ # Session persistence
|
||||
├── opencode-skill-loader/ # Skills from 6 directories (loader.ts 311 lines)
|
||||
├── context-injector/ # AGENTS.md/README.md injection
|
||||
├── boulder-state/ # Todo state persistence
|
||||
├── hook-message-injector/ # Message injection
|
||||
├── task-toast-manager/ # Background task notifications
|
||||
├── skill-mcp-manager/ # MCP client lifecycle (640 lines)
|
||||
├── tmux-subagent/ # Tmux session management (472 lines)
|
||||
├── mcp-oauth/ # MCP OAuth handling
|
||||
└── claude-tasks/ # Task schema/storage - see AGENTS.md
|
||||
```
|
||||
├── background-agent/ # Task lifecycle, concurrency (manager.ts 1642 lines)
|
||||
├── builtin-skills/ # Skills like git-master (1107 lines)
|
||||
├── builtin-commands/ # Commands like refactor (619 lines)
|
||||
├── skill-mcp-manager/ # MCP client lifecycle (640 lines)
|
||||
├── claude-code-plugin-loader/ # Plugin loading
|
||||
├── claude-code-mcp-loader/ # MCP loading
|
||||
├── claude-code-session-state/ # Session state
|
||||
├── claude-code-command-loader/ # Command loading
|
||||
├── claude-code-agent-loader/ # Agent loading
|
||||
├── context-injector/ # Context injection
|
||||
├── hook-message-injector/ # Message injection
|
||||
├── task-toast-manager/ # Task toasts
|
||||
├── boulder-state/ # State management
|
||||
├── tmux-subagent/ # Tmux subagent
|
||||
├── mcp-oauth/ # OAuth for MCP
|
||||
├── opencode-skill-loader/ # Skill loading
|
||||
├── tool-metadata-store/ # Tool metadata
|
||||
|
||||
## LOADER PRIORITY
|
||||
## HOW TO ADD
|
||||
|
||||
| Type | Priority (highest first) |
|
||||
|------|--------------------------|
|
||||
| Commands | `.opencode/command/` > `~/.config/opencode/command/` > `.claude/commands/` |
|
||||
| Skills | `.opencode/skills/` > `~/.config/opencode/skills/` > `.claude/skills/` |
|
||||
| MCPs | `.claude/.mcp.json` > `.mcp.json` > `~/.claude/.mcp.json` |
|
||||
|
||||
## BACKGROUND AGENT
|
||||
|
||||
- **Lifecycle**: `launch` → `poll` (2s) → `complete`
|
||||
- **Stability**: 3 consecutive polls = idle
|
||||
- **Concurrency**: Per-provider/model limits via `ConcurrencyManager`
|
||||
- **Cleanup**: 30m TTL, 3m stale timeout
|
||||
- **State**: Per-session Maps, cleaned on `session.deleted`
|
||||
|
||||
## SKILL MCP
|
||||
|
||||
- **Lazy**: Clients created on first call
|
||||
- **Transports**: stdio, http (SSE/Streamable)
|
||||
- **Lifecycle**: 5m idle cleanup
|
||||
|
||||
## ANTI-PATTERNS
|
||||
|
||||
- **Sequential delegation**: Use `task` parallel
|
||||
- **Trust self-reports**: ALWAYS verify
|
||||
- **Main thread blocks**: No heavy I/O in loader init
|
||||
- **Direct state mutation**: Use managers for boulder/session state
|
||||
Create dir with index.ts, types.ts, etc.
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
import type { OpencodeClient } from "../constants"
|
||||
import type { ConcurrencyManager } from "../concurrency"
|
||||
import type { LaunchInput } from "../types"
|
||||
import { log } from "../../../shared"
|
||||
|
||||
export async function createBackgroundSession(options: {
|
||||
client: OpencodeClient
|
||||
input: LaunchInput
|
||||
parentDirectory: string
|
||||
concurrencyManager: ConcurrencyManager
|
||||
concurrencyKey: string
|
||||
}): Promise<string> {
|
||||
const { client, input, parentDirectory, concurrencyManager, concurrencyKey } = options
|
||||
|
||||
const body = {
|
||||
parentID: input.parentSessionID,
|
||||
title: `Background: ${input.description}`,
|
||||
permission: [{ permission: "question", action: "deny" as const, pattern: "*" }],
|
||||
}
|
||||
|
||||
const createResult = await client.session
|
||||
.create({
|
||||
body,
|
||||
query: {
|
||||
directory: parentDirectory,
|
||||
},
|
||||
})
|
||||
.catch((error) => {
|
||||
concurrencyManager.release(concurrencyKey)
|
||||
throw error
|
||||
})
|
||||
|
||||
if (createResult.error) {
|
||||
concurrencyManager.release(concurrencyKey)
|
||||
throw new Error(`Failed to create background session: ${createResult.error}`)
|
||||
}
|
||||
|
||||
if (!createResult.data?.id) {
|
||||
concurrencyManager.release(concurrencyKey)
|
||||
throw new Error("Failed to create background session: API returned no session ID")
|
||||
}
|
||||
|
||||
const sessionID = createResult.data.id
|
||||
log("[background-agent] Background session created", { sessionID })
|
||||
return sessionID
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
import type { LaunchInput } from "../types"
|
||||
|
||||
export function getConcurrencyKeyFromLaunchInput(input: LaunchInput): string {
|
||||
return input.model
|
||||
? `${input.model.providerID}/${input.model.modelID}`
|
||||
: input.agent
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
import type { OpencodeClient } from "../constants"
|
||||
import { log } from "../../../shared"
|
||||
|
||||
export async function resolveParentDirectory(options: {
|
||||
client: OpencodeClient
|
||||
parentSessionID: string
|
||||
defaultDirectory: string
|
||||
}): Promise<string> {
|
||||
const { client, parentSessionID, defaultDirectory } = options
|
||||
|
||||
const parentSession = await client.session
|
||||
.get({ path: { id: parentSessionID } })
|
||||
.catch((error) => {
|
||||
log(`[background-agent] Failed to get parent session: ${error}`)
|
||||
return null
|
||||
})
|
||||
|
||||
const parentDirectory = parentSession?.data?.directory ?? defaultDirectory
|
||||
log(`[background-agent] Parent dir: ${parentSession?.data?.directory}, using: ${parentDirectory}`)
|
||||
return parentDirectory
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
import type { OnSubagentSessionCreated } from "../constants"
|
||||
import { TMUX_CALLBACK_DELAY_MS } from "../constants"
|
||||
import { log } from "../../../shared"
|
||||
import { isInsideTmux } from "../../../shared/tmux"
|
||||
|
||||
export async function maybeInvokeTmuxCallback(options: {
|
||||
onSubagentSessionCreated?: OnSubagentSessionCreated
|
||||
tmuxEnabled: boolean
|
||||
sessionID: string
|
||||
parentID: string
|
||||
title: string
|
||||
}): Promise<void> {
|
||||
const { onSubagentSessionCreated, tmuxEnabled, sessionID, parentID, title } = options
|
||||
|
||||
log("[background-agent] tmux callback check", {
|
||||
hasCallback: !!onSubagentSessionCreated,
|
||||
tmuxEnabled,
|
||||
isInsideTmux: isInsideTmux(),
|
||||
sessionID,
|
||||
parentID,
|
||||
})
|
||||
|
||||
if (!onSubagentSessionCreated || !tmuxEnabled || !isInsideTmux()) {
|
||||
log("[background-agent] SKIP tmux callback - conditions not met")
|
||||
return
|
||||
}
|
||||
|
||||
log("[background-agent] Invoking tmux callback NOW", { sessionID })
|
||||
await onSubagentSessionCreated({
|
||||
sessionID,
|
||||
parentID,
|
||||
title,
|
||||
}).catch((error) => {
|
||||
log("[background-agent] Failed to spawn tmux pane:", error)
|
||||
})
|
||||
|
||||
log("[background-agent] tmux callback completed, waiting")
|
||||
await new Promise<void>((resolve) => setTimeout(resolve, TMUX_CALLBACK_DELAY_MS))
|
||||
}
|
||||
@@ -0,0 +1,204 @@
|
||||
import { describe, test, expect, beforeEach, afterEach } from "bun:test"
|
||||
import { existsSync, mkdirSync, rmSync, writeFileSync, readdirSync } from "fs"
|
||||
import { join } from "path"
|
||||
import type { OhMyOpenCodeConfig } from "../../config/schema"
|
||||
import {
|
||||
getSessionTaskDir,
|
||||
listSessionTaskFiles,
|
||||
listAllSessionDirs,
|
||||
findTaskAcrossSessions,
|
||||
} from "./session-storage"
|
||||
|
||||
const TEST_DIR = ".test-session-storage"
|
||||
const TEST_DIR_ABS = join(process.cwd(), TEST_DIR)
|
||||
|
||||
function makeConfig(storagePath: string): Partial<OhMyOpenCodeConfig> {
|
||||
return {
|
||||
sisyphus: {
|
||||
tasks: { storage_path: storagePath, claude_code_compat: false },
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
describe("getSessionTaskDir", () => {
|
||||
test("returns session-scoped subdirectory under base task dir", () => {
|
||||
//#given
|
||||
const config = makeConfig("/tmp/tasks")
|
||||
const sessionID = "ses_abc123"
|
||||
|
||||
//#when
|
||||
const result = getSessionTaskDir(config, sessionID)
|
||||
|
||||
//#then
|
||||
expect(result).toBe("/tmp/tasks/ses_abc123")
|
||||
})
|
||||
|
||||
test("uses relative storage path joined with cwd", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
const sessionID = "ses_xyz"
|
||||
|
||||
//#when
|
||||
const result = getSessionTaskDir(config, sessionID)
|
||||
|
||||
//#then
|
||||
expect(result).toBe(join(TEST_DIR_ABS, "ses_xyz"))
|
||||
})
|
||||
})
|
||||
|
||||
describe("listSessionTaskFiles", () => {
|
||||
beforeEach(() => {
|
||||
if (existsSync(TEST_DIR_ABS)) {
|
||||
rmSync(TEST_DIR_ABS, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
if (existsSync(TEST_DIR_ABS)) {
|
||||
rmSync(TEST_DIR_ABS, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
test("returns empty array when session directory does not exist", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
|
||||
//#when
|
||||
const result = listSessionTaskFiles(config, "nonexistent-session")
|
||||
|
||||
//#then
|
||||
expect(result).toEqual([])
|
||||
})
|
||||
|
||||
test("lists only T-*.json files in the session directory", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
const sessionDir = join(TEST_DIR_ABS, "ses_001")
|
||||
mkdirSync(sessionDir, { recursive: true })
|
||||
writeFileSync(join(sessionDir, "T-aaa.json"), "{}", "utf-8")
|
||||
writeFileSync(join(sessionDir, "T-bbb.json"), "{}", "utf-8")
|
||||
writeFileSync(join(sessionDir, "other.txt"), "nope", "utf-8")
|
||||
|
||||
//#when
|
||||
const result = listSessionTaskFiles(config, "ses_001")
|
||||
|
||||
//#then
|
||||
expect(result).toHaveLength(2)
|
||||
expect(result).toContain("T-aaa")
|
||||
expect(result).toContain("T-bbb")
|
||||
})
|
||||
|
||||
test("does not list tasks from other sessions", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
const session1Dir = join(TEST_DIR_ABS, "ses_001")
|
||||
const session2Dir = join(TEST_DIR_ABS, "ses_002")
|
||||
mkdirSync(session1Dir, { recursive: true })
|
||||
mkdirSync(session2Dir, { recursive: true })
|
||||
writeFileSync(join(session1Dir, "T-from-s1.json"), "{}", "utf-8")
|
||||
writeFileSync(join(session2Dir, "T-from-s2.json"), "{}", "utf-8")
|
||||
|
||||
//#when
|
||||
const result = listSessionTaskFiles(config, "ses_001")
|
||||
|
||||
//#then
|
||||
expect(result).toEqual(["T-from-s1"])
|
||||
})
|
||||
})
|
||||
|
||||
describe("listAllSessionDirs", () => {
|
||||
beforeEach(() => {
|
||||
if (existsSync(TEST_DIR_ABS)) {
|
||||
rmSync(TEST_DIR_ABS, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
if (existsSync(TEST_DIR_ABS)) {
|
||||
rmSync(TEST_DIR_ABS, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
test("returns empty array when base directory does not exist", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
|
||||
//#when
|
||||
const result = listAllSessionDirs(config)
|
||||
|
||||
//#then
|
||||
expect(result).toEqual([])
|
||||
})
|
||||
|
||||
test("returns only directory entries (not files)", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
mkdirSync(TEST_DIR_ABS, { recursive: true })
|
||||
mkdirSync(join(TEST_DIR_ABS, "ses_001"), { recursive: true })
|
||||
mkdirSync(join(TEST_DIR_ABS, "ses_002"), { recursive: true })
|
||||
writeFileSync(join(TEST_DIR_ABS, ".lock"), "{}", "utf-8")
|
||||
writeFileSync(join(TEST_DIR_ABS, "T-legacy.json"), "{}", "utf-8")
|
||||
|
||||
//#when
|
||||
const result = listAllSessionDirs(config)
|
||||
|
||||
//#then
|
||||
expect(result).toHaveLength(2)
|
||||
expect(result).toContain("ses_001")
|
||||
expect(result).toContain("ses_002")
|
||||
})
|
||||
})
|
||||
|
||||
describe("findTaskAcrossSessions", () => {
|
||||
beforeEach(() => {
|
||||
if (existsSync(TEST_DIR_ABS)) {
|
||||
rmSync(TEST_DIR_ABS, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
if (existsSync(TEST_DIR_ABS)) {
|
||||
rmSync(TEST_DIR_ABS, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
|
||||
test("returns null when task does not exist in any session", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
mkdirSync(join(TEST_DIR_ABS, "ses_001"), { recursive: true })
|
||||
|
||||
//#when
|
||||
const result = findTaskAcrossSessions(config, "T-nonexistent")
|
||||
|
||||
//#then
|
||||
expect(result).toBeNull()
|
||||
})
|
||||
|
||||
test("finds task in the correct session directory", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
const session2Dir = join(TEST_DIR_ABS, "ses_002")
|
||||
mkdirSync(join(TEST_DIR_ABS, "ses_001"), { recursive: true })
|
||||
mkdirSync(session2Dir, { recursive: true })
|
||||
writeFileSync(join(session2Dir, "T-target.json"), '{"id":"T-target"}', "utf-8")
|
||||
|
||||
//#when
|
||||
const result = findTaskAcrossSessions(config, "T-target")
|
||||
|
||||
//#then
|
||||
expect(result).not.toBeNull()
|
||||
expect(result!.sessionID).toBe("ses_002")
|
||||
expect(result!.path).toBe(join(session2Dir, "T-target.json"))
|
||||
})
|
||||
|
||||
test("returns null when base directory does not exist", () => {
|
||||
//#given
|
||||
const config = makeConfig(TEST_DIR)
|
||||
|
||||
//#when
|
||||
const result = findTaskAcrossSessions(config, "T-any")
|
||||
|
||||
//#then
|
||||
expect(result).toBeNull()
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,52 @@
|
||||
import { join } from "path"
|
||||
import { existsSync, readdirSync, statSync } from "fs"
|
||||
import { getTaskDir } from "./storage"
|
||||
import type { OhMyOpenCodeConfig } from "../../config/schema"
|
||||
|
||||
export function getSessionTaskDir(
|
||||
config: Partial<OhMyOpenCodeConfig>,
|
||||
sessionID: string,
|
||||
): string {
|
||||
return join(getTaskDir(config), sessionID)
|
||||
}
|
||||
|
||||
export function listSessionTaskFiles(
|
||||
config: Partial<OhMyOpenCodeConfig>,
|
||||
sessionID: string,
|
||||
): string[] {
|
||||
const dir = getSessionTaskDir(config, sessionID)
|
||||
if (!existsSync(dir)) return []
|
||||
return readdirSync(dir)
|
||||
.filter((f) => f.endsWith(".json") && f.startsWith("T-"))
|
||||
.map((f) => f.replace(".json", ""))
|
||||
}
|
||||
|
||||
export function listAllSessionDirs(
|
||||
config: Partial<OhMyOpenCodeConfig>,
|
||||
): string[] {
|
||||
const baseDir = getTaskDir(config)
|
||||
if (!existsSync(baseDir)) return []
|
||||
return readdirSync(baseDir).filter((entry) => {
|
||||
const fullPath = join(baseDir, entry)
|
||||
return statSync(fullPath).isDirectory()
|
||||
})
|
||||
}
|
||||
|
||||
export interface TaskLocation {
|
||||
path: string
|
||||
sessionID: string
|
||||
}
|
||||
|
||||
export function findTaskAcrossSessions(
|
||||
config: Partial<OhMyOpenCodeConfig>,
|
||||
taskId: string,
|
||||
): TaskLocation | null {
|
||||
const sessionDirs = listAllSessionDirs(config)
|
||||
for (const sessionID of sessionDirs) {
|
||||
const taskPath = join(getSessionTaskDir(config, sessionID), `${taskId}.json`)
|
||||
if (existsSync(taskPath)) {
|
||||
return { path: taskPath, sessionID }
|
||||
}
|
||||
}
|
||||
return null
|
||||
}
|
||||
Reference in New Issue
Block a user