Initial commit: Elydora Open Source — self-hosted audit platform for AI agents

Full self-hosted port of the Elydora tamper-evident audit protocol:
- Hono API server with PostgreSQL, Redis, MinIO adapters
- Ed25519 signed operations, chain hashing, Merkle epoch rollups
- PBKDF2 password hashing, HMAC-SHA256 JWT, 5-role RBAC
- Next.js management console
- Node.js, Python, and Go SDKs
- Docker Compose for local deployment
- Helm chart for Kubernetes
- Comprehensive security hardening and audit fixes applied

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sdks/node/src/plugins/opencode.ts

@@ -0,0 +1,134 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import type { AgentPlugin, InstallConfig, PluginStatus } from './base.js';
+import { SUPPORTED_AGENTS } from './registry.js';
+
+const AGENT_KEY = 'opencode';
+const entry = SUPPORTED_AGENTS.get(AGENT_KEY)!;
+
+function resolveConfigDir(): string {
+  return path.join(os.homedir(), entry.configDir);
+}
+
+function resolveConfigPath(): string {
+  return path.join(resolveConfigDir(), entry.configFile);
+}
+
+function generatePluginScript(hookScriptPath: string, guardScriptPath: string): string {
+  return `// Elydora Audit Plugin for OpenCode
+// Generated by @elydora/sdk — DO NOT EDIT
+
+import { spawn, spawnSync } from 'node:child_process';
+
+export const ElydoraAuditPlugin = async (ctx) => {
+  return {
+    "tool.execute.before": async (input, output) => {
+      // Guard — blocks tool if agent is frozen
+      try {
+        const result = spawnSync('node', ['__ELYDORA_GUARD_SCRIPT_PATH__'], {
+          timeout: 5000,
+          stdio: ['pipe', 'ignore', 'pipe'],
+        });
+        if (result.status === 2) {
+          const msg = result.stderr ? result.stderr.toString().trim() : 'Agent is frozen by Elydora.';
+          // Signal denial by setting a blocked flag
+          if (output && typeof output === 'object') {
+            output.blocked = true;
+            output.reason = msg;
+          }
+        }
+      } catch {
+        // Fail-open — allow if guard can't run
+      }
+    },
+
+    "tool.execute.after": async (input, output) => {
+      try {
+        const toolName = input?.tool || 'unknown';
+        const toolInput = output?.args || input?.args || {};
+        const sessionId = ctx?.project?.name || 'unknown';
+
+        const data = JSON.stringify({
+          tool_name: toolName,
+          tool_input: toolInput,
+          session_id: sessionId,
+        });
+
+        const child = spawn('node', ['__ELYDORA_HOOK_SCRIPT_PATH__'], {
+          detached: true,
+          stdio: ['pipe', 'ignore', 'ignore'],
+        });
+        child.stdin.write(data);
+        child.stdin.end();
+        child.unref();
+      } catch {
+        // Fire-and-forget — never block the developer
+      }
+    },
+  };
+};
+`;
+}
+
+export const opencodePlugin: AgentPlugin = {
+  async install(config: InstallConfig): Promise<void> {
+    const configDir = resolveConfigDir();
+    await fsp.mkdir(configDir, { recursive: true });
+
+    const configPath = resolveConfigPath();
+    const script = generatePluginScript(config.hookScriptPath, config.guardScriptPath)
+      .replace('__ELYDORA_HOOK_SCRIPT_PATH__', config.hookScriptPath.replace(/\\/g, '\\\\'))
+      .replace('__ELYDORA_GUARD_SCRIPT_PATH__', config.guardScriptPath.replace(/\\/g, '\\\\'));
+
+    await fsp.writeFile(configPath, script, 'utf-8');
+  },
+
+  async uninstall(_agentId?: string): Promise<void> {
+    const configPath = resolveConfigPath();
+    try {
+      await fsp.unlink(configPath);
+    } catch {
+      // Already removed
+    }
+  },
+
+  async status(): Promise<PluginStatus> {
+    const configPath = resolveConfigPath();
+
+    let hookConfigured = false;
+    let hookScriptPath = '';
+    try {
+      const raw = await fsp.readFile(configPath, 'utf-8');
+      hookConfigured = true;
+
+      // Extract hook script path from plugin script content
+      // The plugin script contains a spawn call like: spawn('node', ['<path>'])
+      const match = raw.match(/spawn\('node',\s*\['([^']*elydora[^']*)'\]/);
+      if (match) {
+        hookScriptPath = match[1];
+      }
+    } catch {
+      // File doesn't exist
+    }
+
+    let hookScriptExists = false;
+    if (hookScriptPath) {
+      try {
+        await fsp.access(hookScriptPath);
+        hookScriptExists = true;
+      } catch {
+        // File doesn't exist
+      }
+    }
+
+    return {
+      installed: hookConfigured && hookScriptExists,
+      agentName: AGENT_KEY,
+      displayName: entry.name,
+      hookConfigured,
+      hookScriptExists,
+      configPath,
+    };
+  },
+};