deps/

cover/

doc/

docs/

test/

tmp/

assets/node_modules/

priv/static/assets/

Date: 2026-08-20

Status: First complete OpenCode SCV environment implemented and proven locally

and in the shared-project read-only staging lane; durable coordination, durable

tool effects, isolated staging, and autonomous deployment remain disabled

Status: OpenCode SCV environment and bounded report path implemented and proven

locally; three shared-project read-only audit SCVs deployed; durable

coordination, durable tool effects, isolated staging, and autonomous deployment

remain disabled

## Outcome

  explicit permission profile.

- `OpenAgents.SCV.OpenCodeEvents` normalizes content-free event counts, tool

  outcomes, token classes, and estimated cost.

- `OpenAgents.SCV.OpenCodeReport` collects only redacted OpenCode text events

  into a versioned report capped at 32 KiB. It never includes tool output or

  diagnostic lines.

- `OpenAgents.SCV.ResourceSampler` observes the direct OpenCode process from the

  host and records RSS and CPU samples.

- `mix openagents.scv.opencode` exposes the adapter for local qualification.

so an operator or process can consume the receipt without waiting blindly for

the command to finish.

The terminal worker result now includes `openagents.scv.report.v1`. The executor

applies its run-specific provider-key redaction before the report parser sees a

line, preserves valid UTF-8 at the byte limit, and marks truncated reports. This

path makes a read-only audit result consumable through Cloud Logging. It does

not replace durable artifact storage: a write-capable SCV must persist and

acknowledge the report, event artifact, and their digests before it reports

success.

The adapter writes the bounded prompt to a mode `0600` scratch file and gives

that finite file to OpenCode as standard input. This keeps prompt content out of

the process argument list and delivers EOF after the prompt. OpenCode reads a

    }

  end

  @doc "Splits a report into UTF-8-safe chunks for structured log delivery."

  @spec chunks(map(), pos_integer()) :: [String.t()]

  def chunks(%{text: text}, maximum_bytes)

      when is_binary(text) and is_integer(maximum_bytes) and maximum_bytes >= 4 do

    split_chunks(text, maximum_bytes, [])

  end

  defp append(state, ""), do: state

  defp append(state, text) do

      |> remove_invalid_suffix()

    end

  end

  defp split_chunks("", _maximum_bytes, chunks), do: Enum.reverse(chunks)

  defp split_chunks(text, maximum_bytes, chunks) do

    chunk = valid_prefix(text, maximum_bytes)

    remaining_bytes = byte_size(text) - byte_size(chunk)

    remaining = binary_part(text, byte_size(chunk), remaining_bytes)

    split_chunks(remaining, maximum_bytes, [chunk | chunks])

  end

end

  """

  alias OpenAgents.SCV

  alias OpenAgents.SCV.OpenCodeReport

  alias OpenAgents.SCV.Run

  @default_model "openai/gpt-5.4-mini"

  @default_timeout_ms 300_000

  @default_output_root "/workspace/runs"

  @maximum_report_chunk_bytes 3_072

  @spec run(map(), keyword()) :: {:ok, map()} | {:error, term()}

  def run(environment \\ System.get_env(), options \\ [])

    case run(System.get_env(), event_sink: sink) do

      {:ok, %{status: "succeeded"} = result} ->

        write_json(worker_result(result))

        write_terminal_events(result)

        :ok

      {:ok, result} ->

        write_json(worker_result(result))

        write_terminal_events(result)

        raise "SCV worker finished with status #{result.status}"

      {:error, reason} ->

    end

  end

  defp worker_result(result) do

  @doc false

  @spec terminal_events(map()) :: [map()]

  def terminal_events(result) when is_map(result) do

    chunks = OpenCodeReport.chunks(result.report, @maximum_report_chunk_bytes)

    emitted_at = DateTime.utc_now() |> DateTime.to_iso8601()

    chunk_count = length(chunks)

    report_digest = digest(result.report.text)

    report_events =

      chunks

      |> Enum.with_index(1)

      |> Enum.map(fn {chunk, sequence} ->

        %{

          schema: "openagents.scv.report.chunk.v1",

          type: "report_chunk",

          emitted_at: emitted_at,

          run_id: result.run_id,

          repository_revision: result.repository.git_sha,

          sequence: sequence,

          chunk_count: chunk_count,

          report_digest: report_digest,

          text: chunk

        }

      end)

    report_metadata = %{

      schema: result.report.schema,

      bytes: result.report.bytes,

      truncated: result.report.truncated,

      chunk_count: chunk_count,

      digest: report_digest

    }

    report_events ++ [worker_result(result, report_metadata, emitted_at)]

  end

  defp worker_result(result, report_metadata, emitted_at) do

    %{

      schema: "openagents.scv.worker.result.v1",

      type: "worker_finished",

      emitted_at: DateTime.utc_now() |> DateTime.to_iso8601(),

      emitted_at: emitted_at,

      run_id: result.run_id,

      status: result.status,

      driver: result.scv.driver,

      usage: result.events.usage,

      resources: result.resources,

      artifact_digest: result.artifacts.events_digest,

      report: result.report

      report: report_metadata

    }

  end

  defp write_terminal_events(result) do

    result

    |> terminal_events()

    |> Enum.each(&write_json/1)

  end

  defp digest(value) do

    "sha256:" <> (:crypto.hash(:sha256, value) |> Base.encode16(case: :lower))

  end

  defp error_code(reason) when is_atom(reason), do: Atom.to_string(reason)

  defp error_code({reason, _detail}) when is_atom(reason), do: Atom.to_string(reason)

  defp error_code(_reason), do: "worker_failed"

    assert String.valid?(report.text)

    assert report.truncated

  end

  test "splits a report into ordered UTF-8-safe chunks" do

    text = String.duplicate("audit 🚀 ", 1_000)

    report = %{text: text}

    chunks = OpenCodeReport.chunks(report, 1_025)

    assert length(chunks) > 1

    assert Enum.all?(chunks, &(byte_size(&1) <= 1_025))

    assert Enum.all?(chunks, &String.valid?/1)

    assert Enum.join(chunks) == text

  end

end

             Worker.run(Map.delete(environment, "OPENAI_API_KEY"))

  end

  test "emits bounded structured report chunks before the terminal result" do

    text = String.duplicate("SCV finding 🚀 ", 500)

    digest = "sha256:" <> (:crypto.hash(:sha256, text) |> Base.encode16(case: :lower))

    result = %{

      run_id: Ecto.UUID.generate(),

      status: "succeeded",

      duration_ms: 100,

      repository: %{git_sha: String.duplicate("a", 40)},

      scv: %{driver: "opencode", environment: "opencode-core"},

      events: %{event_count: 2, tool_calls: %{}, usage: %{}},

      resources: %{},

      artifacts: %{events_digest: String.duplicate("b", 64)},

      report: %{

        schema: "openagents.scv.report.v1",

        text: text,

        bytes: byte_size(text),

        truncated: false

      }

    }

    events = Worker.terminal_events(result)

    terminal = List.last(events)

    chunks = Enum.drop(events, -1)

    assert terminal.type == "worker_finished"

    assert terminal.report.digest == digest

    assert terminal.report.chunk_count == length(chunks)

    refute Map.has_key?(terminal.report, :text)

    assert Enum.map(chunks, & &1.sequence) == Enum.to_list(1..length(chunks))

    assert Enum.all?(chunks, &(&1.type == "report_chunk"))

    assert Enum.all?(chunks, &(&1.report_digest == digest))

    assert Enum.all?(chunks, &(byte_size(Jason.encode!(&1)) < 4_096))

    assert chunks |> Enum.map(& &1.text) |> Enum.join() == text

  end

  defp fake_executable do

    """

    #!/bin/sh