GH#34545: fix(opencode): fail closed on standalone browser Task transport by vladimirdulov · Pull Request #34547 · marcusquinn/aidevops

vladimirdulov · 2026-10-13T15:19:34Z

Summary

Resolves #34545.

Add aidevops.browser-task/v1 JSON Task envelopes for explicit browser transport selection.
Reject standalone-only native Task dispatch before child creation/resume: the configured Playwright role enables MCP and cannot honor an invocation-only standalone ceiling.
Validate explicit MCP envelopes against their own supplied readiness result; reject unknown dimensions and standalone evidence. Preserve default calls and existing permission gates.
Document the contract in .agents/tools/browser/playwright.md and cover the shared quality pre-tool boundary with offline regressions.

Files and reference pattern

Implementation: .agents/plugins/opencode-aidevops/browser-task-transport.mjs, called by quality-hooks.mjs before native Task execution. Reference: canonical Playwright role defaults, capability registry and existing fail-closed research-only boundary. Regression: tests/test-browser-task-transport.mjs.

Verification

Final local commit: b9de982bbd66499d31934bd9aba6d9d9d73ed2ae. All 111 scoped tests passed (transport, research-only, subagent effort, MCP lifecycle, V2 adapter and permissions).
Node syntax checks, markdownlint (0 errors), pre-commit quality validation and checkpoint pre-push typecheck passed. Repository Biome configuration excludes these MJS paths; no Biome lint success is claimed.
Full plugin suite: 1149 passed, 8 skipped, 6 failures. All six failures reproduced on unchanged base 4dbdd625c by running node --test on test-shell-env-origin.mjs, test-source-access-approval.mjs and test-source-access-context.mjs from a Git archive of that revision.

Blocked finalization checkpoint

full-loop-helper.sh commit-and-pr finalized the WIP history locally but its mandatory npm run test validator failed before pushing. The PR remains draft with the earlier pushed implementation checkpoint. Do not treat this as ready or merged. No validator, signing, permission or merge controls were bypassed.

Baseline failures are the shell-env PATH assertion, two V3 source-access manifest tests, two source-context transport tests and the runtime-adapter socket assertion. Observed failures concern selected Node PATH and private source-context/socket environment requirements. They are unrelated to browser Task transport and were not repaired in this task. Original implementation files are unchanged by the intervening release-only base update.

Resume after those baseline validator failures are resolved on the runner/default branch: rerun the full plugin validator and scoped tests, then full-loop-helper.sh commit-and-pr --issue 34545 with the recorded summary/testing, mark the exact-head PR ready, verify MERGE_SUMMARY and remote checks, and attempt guarded merge once.

Evidence and limitations

Offline reproduction covers the unsafe dispatch configuration, not the original child's unavailable historical tool trace. No live provider, sign-in, playback or credentials were used. The implementation deliberately fails closed instead of adding a standalone child runner or claiming a shell sandbox. Legacy prose-only requests retain default behavior; explicit transport restrictions must use the structured envelope. Supplied readiness is not independently reconstructed live evidence or site authorization.

aidevops.sh v3.39.27 plugin for OpenCode v1.18.34 with gpt-6.1-sol spent 15m and 133,184 tokens on this as a headless worker.

coderabbitai · 2026-10-13T15:19:46Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

🚫 Excluded labels (none allowed): 1

no-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: marcusquinn/aidevops/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 79695240-2665-4712-950f-ee8bba460c1c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-13T15:20:11Z

Markdown Lint (changed-line scoped)

No new violations in changed lines (0 pre-existing in touched files — ignored).

Metric	Base (`4dbdd62`)	Head (`370faf9`)
Total in touched files	—	0
New (in changed lines)	—	0

codacy-production · 2026-10-13T15:21:01Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

github-actions · 2026-10-13T15:21:03Z

Qlty New-File Smell Gate

✅ Clean — 1 new source file(s) scanned, no smells found.

Base (`1a4cdaa`)	Head (`370faf9`)	New files	Smells
		1	0

New files scanned

.agents/plugins/opencode-aidevops/browser-task-transport.mjs

github-actions · 2026-10-13T15:21:15Z

Shell Function Complexity Regression Gate

✅ No regression — no new function(s) >100 lines.

Metric	Base (`4dbdd62`)	Head (`370faf9`)
Total function(s) >100 lines	0	0

github-actions · 2026-10-13T15:22:03Z

Qlty Smell Regression Gate

✅ No change — smell count unchanged.

Metric	Base (`1a4cdaa`)	Head (`370faf9`)	Delta
Total smells	65	65	+0

github-actions · 2026-10-13T15:24:13Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Tue Oct 13 15:21:29 UTC 2026: Code review monitoring started
Tue Oct 13 15:21:30 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Tue Oct 13 15:24:02 UTC 2026: Codacy analysis completed - no issues

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 1
VULNERABILITIES: 0

Generated on: Tue Oct 13 15:24:03 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

github-actions · 2026-10-13T15:25:14Z

Shell Nesting Depth Regression Gate

✅ No regression — no new file(s) with nesting depth >8.

Metric	Base (`4dbdd62`)	Head (`370faf9`)
Total file(s) with nesting depth >8	0	0

github-actions · 2026-10-13T15:25:25Z

File Size Regression Gate

✅ No regression — no new non-README Markdown file(s) >1000 lines at root / >500 elsewhere.

Metric	Base (`4dbdd62`)	Head (`370faf9`)
Total non-README Markdown file(s) >1000 lines at root / >500 elsewhere	0	0

github-actions · 2026-10-13T15:28:54Z

Maintainer Gate: BLOCKED

This PR cannot be merged because:

Issue #34545 has no assignee — an issue must be assigned before work begins.
What to do:

A maintainer must review the linked issue(s) and approve them using the cryptographic approval command:
```
sudo aidevops approve issue <issue_number>
```
This requires your system password and signs the approval with a root-protected key that automation cannot forge.
The issue(s) must have an assignee before work begins
This check re-runs automatically when the issue is updated

This is an automated check. See issue-triage-gate.yml for the triage policy.

marcusquinn · 2026-10-15T03:59:59Z

Maintainer review and verification at head 9de5722b92:

node --test .agents/plugins/opencode-aidevops/tests/test-browser-task-transport.mjs: 5/5 pass. A standalone selection fails before child creation; an approved MCP envelope keeps its bounded instructions; role changes, resumes and malformed JSON are rejected; default/unrelated Task calls are unchanged.
markdownlint-cli2 .agents/tools/browser/playwright.md: 0 issues.
Design: native Task cannot enforce an invocation-only tool ceiling, so the guard fails closed for standalone selection, as the brief allows. Only an explicit aidevops.browser-task/v1 envelope is parsed; prose is never treated as policy.
The worker's finalization stopped on full-suite plugin failures that it reproduced on unchanged base (shell-env PATH, source-access manifest/context, runtime socket). Those are unrelated to this change.

Marking ready for merge.

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 11h 33m and 901,781 tokens on this with the user in an interactive session.

marcusquinn

Auto-approved by pulse runner @marcusquinn — author @vladimirdulov confirmed collaborator, pre-merge gates passed.

aidevops.sh v3.39.31 automated scan.

alex-solovyev

Auto-approved by pulse runner @alex-solovyev — author @vladimirdulov confirmed collaborator, pre-merge gates passed.

aidevops.sh v3.39.31 automated scan.

github-actions · 2026-10-15T04:14:56Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Thu Oct 15 04:13:00 UTC 2026: Code review monitoring started
Thu Oct 15 04:13:01 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Thu Oct 15 04:14:47 UTC 2026: Codacy analysis completed - no issues

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 1
VULNERABILITIES: 0

Generated on: Thu Oct 15 04:14:47 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

wip: fail closed on standalone browser Task transport

9de5722

vladimirdulov added the origin:worker Created by headless/pulse worker session label Oct 13, 2026

vladimirdulov mentioned this pull request Oct 13, 2026

[Supervisor:vladimirdulov] 1 open PR, 0 issues assigned, 0 local workers — changed 2026-10-19 04:58 UTC #23855

Open

alex-solovyev mentioned this pull request Oct 13, 2026

[Supervisor:alex-solovyev] 1 open PR, 0 issues assigned, 0 local workers — changed 2026-10-19 05:10 UTC #23404

Open

alex-solovyev mentioned this pull request Oct 13, 2026

Browser child can bypass parent-selected standalone transport #34545

Closed

marcusquinn mentioned this pull request Oct 13, 2026

[Supervisor:marcusquinn] 5 open PRs, 4 issues assigned, 0 local workers — changed 2026-10-08 16:39 UTC #23126

Open

alex-solovyev mentioned this pull request Oct 13, 2026

fix(tests): source-access V3 manifest fixture fails under umask 0002 and blocks plugin validator #34550

Closed

marcusquinn marked this pull request as ready for review October 15, 2026 03:59

fix(opencode): reduce browser task transport validation complexity

370faf9

marcusquinn approved these changes Oct 15, 2026

View reviewed changes

alex-solovyev approved these changes Oct 15, 2026

View reviewed changes

marcusquinn merged commit f2f97d4 into main Oct 15, 2026
48 checks passed

marcusquinn deleted the feature/auto-20261013-171040-gh34545 branch October 15, 2026 04:19

github-actions Bot added the status:done Task is complete label Oct 15, 2026

marcusquinn mentioned this pull request Oct 15, 2026

chore(release): preserve signed v3.39.32 publication #34761

Merged

Conversation

vladimirdulov commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Files and reference pattern

Verification

Blocked finalization checkpoint

Evidence and limitations

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Markdown Lint (changed-line scoped)

Uh oh!

codacy-production Bot commented Oct 13, 2026

Up to standards ✅

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qlty New-File Smell Gate

New files scanned

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Shell Function Complexity Regression Gate

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qlty Smell Regression Gate

Uh oh!

github-actions Bot commented Oct 13, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Shell Nesting Depth Regression Gate

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

File Size Regression Gate

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

marcusquinn commented Oct 15, 2026

Uh oh!

marcusquinn left a comment

Choose a reason for hiding this comment

Uh oh!

alex-solovyev left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 15, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vladimirdulov commented Oct 13, 2026 •

edited

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading