YeonGyu-Kim
e5d3fe96c4
Blocking fixes: - B1: Return empty restrictions for unknown/custom agents instead of EXPLORATION_AGENT_DENYLIST, allowing custom agents full tool access - B2: Use Object.create(null) consistently across all 5 agent-loading result objects to prevent prototype pollution - B3: Add code comment documenting custom agent bash access trust model - B4: Mock getOpenCodeConfigDir in opencode-config-agents-reader tests to prevent global config dir leakage Non-blocking fixes: - N1: Use resolveAgentDefinitionPaths with project boundary enforcement in opencode-config-agents-reader for path containment - N2: Add session-scoped 30s TTL cache to resolveCallableAgents to avoid redundant SDK IPC calls per tool invocation - N3: Extract shared parseToolsConfig into src/shared/parse-tools-config.ts replacing 4 duplicated local implementations - N4: Add .min(1) to AgentDefinitionPathSchema rejecting empty paths - N5: Add resolve-agent-definition-paths.test.ts covering tilde expansion, relative paths, boundary enforcement, and null containmentDir - N6: Validate agent mode against allowed values instead of bare type assertion in opencode-config-agents-reader
65 lines
2.2 KiB
TypeScript
65 lines
2.2 KiB
TypeScript
import type { PluginInput } from "@opencode-ai/plugin";
|
|
import { ALLOWED_AGENTS } from "./constants";
|
|
import { normalizeSDKResponse } from "../../shared";
|
|
import { log } from "../../shared/logger";
|
|
|
|
type AgentInfo = {
|
|
name: string;
|
|
mode?: "subagent" | "primary" | "all";
|
|
};
|
|
|
|
const callableAgentsCache = new Map<string, { agents: string[]; timestamp: number }>();
|
|
const CACHE_TTL_MS = 30_000;
|
|
|
|
export function clearCallableAgentsCache(): void {
|
|
callableAgentsCache.clear();
|
|
}
|
|
|
|
/**
|
|
* Resolves the set of callable agent names at execute-time by merging the
|
|
* hardcoded `ALLOWED_AGENTS` with any additional agents discovered dynamically
|
|
* via `client.app.agents()`. Custom agents loaded from registered agent
|
|
* directories appear here alongside built-ins.
|
|
*
|
|
* Results are cached per session for 30s to avoid redundant SDK IPC calls.
|
|
*
|
|
* Falls back to `ALLOWED_AGENTS` alone if the dynamic lookup fails.
|
|
*
|
|
* @param client - The plugin client with access to the agent registry
|
|
* @param sessionId - Optional session ID for cache scoping
|
|
* @returns Array of lowercase callable agent names (excludes primary-mode agents)
|
|
*/
|
|
export async function resolveCallableAgents(
|
|
client: PluginInput["client"],
|
|
sessionId?: string,
|
|
): Promise<string[]> {
|
|
const cacheKey = sessionId ?? "__default__";
|
|
const cached = callableAgentsCache.get(cacheKey);
|
|
if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
|
|
return cached.agents;
|
|
}
|
|
|
|
try {
|
|
const agentsResult = await client.app.agents();
|
|
const agents = normalizeSDKResponse(agentsResult, [] as AgentInfo[], {
|
|
preferResponseOnMissingData: true,
|
|
});
|
|
|
|
const dynamicAgents = agents
|
|
.filter((a) => a && typeof a.name === "string" && a.name.trim().length > 0 && a.mode !== "primary")
|
|
.map((a) => a.name.trim().toLowerCase());
|
|
|
|
const merged = new Set([...ALLOWED_AGENTS, ...dynamicAgents]);
|
|
const result = [...merged];
|
|
callableAgentsCache.set(cacheKey, { agents: result, timestamp: Date.now() });
|
|
return result;
|
|
} catch (error) {
|
|
const message = error instanceof Error ? error.message : String(error);
|
|
log(
|
|
"[call_omo_agent] Failed to resolve dynamic agents, falling back to built-in list",
|
|
{ error: message },
|
|
);
|
|
return [...ALLOWED_AGENTS];
|
|
}
|
|
}
|