Distillation

Date: Sep 8, 2026

• 🔴 (08:17) User directed that Bun should always use the canary build; persistent configuration is BUN_CANARY=1 in the shell startup script.
• 🔴 (08:17) User stated the fixed interactive shell never evaluates command arguments; the inner launcher directly invokes execve with the original argv vector, preserving all argument bytes and argv boundaries.
• 🟡 (08:17) Inspected /tmp/opencode/pty-plugin-smoke.ts (356 lines), which imports createPtyPlugin from /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts and assertSupervisorAvailable, SupervisorExit, and SupervisorTransport from /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts.
• 🟡 (08:17) /tmp/opencode/pty-plugin-smoke.ts constructs a mock transport supporting /bin/printf, /bin/flood, /bin/true, interactive /bin/sh input, runtime timeout, output queueing before listener registration, and close completion as { result: "stopped", execMainCode: 2, execMainStatus: 15 }. Generated unit names use opencode-pty-${crypto.randomUUID().replaceAll("-", "")}.service.
• 🟡 (08:17) The smoke harness first verifies fail-closed activation by calling assertSupervisorAvailable({ helperPath: "/tmp/opencode/does-not-exist", socketPath: "/tmp/opencode/does-not-exist.sock" }) and requiring an ENOENT failure.
• 🟡 (08:17) The smoke harness requires exactly these five registered tools in order: 1. pty_spawn; 2. pty_write; 3. pty_read; 4. pty_list; 5. pty_kill. It requires pty_spawn, pty_write, and pty_kill to use permission "shell".
• 🟡 (08:17) PTY smoke argv-limit cases are: 1. command of "x".repeat(4_097); 2. 129 arguments; 3. five arguments each containing 16,000 bytes, exceeding the aggregate bound; 4. one argument containing 16,385 bytes. Each must fail with an error containing "limit" or "argv".
• 🟡 (08:17) PTY permission smoke cases require: explicit shell denial blocks /bin/true; an external_directory denial blocks workdir /tmp/opencode/pty-project/outside, a symlink to /tmp; and pty_write authorization includes the exact terminal input resource containing <stdin>.
• 🟡 (08:17) The smoke harness uses canonical tool context { sessionID: "session-smoke", agent: "build", messageID: "message-smoke", id: "call-smoke" } and canonical permission source { type: "tool", messageID: "message-smoke", id: "call-smoke" }. Every shell side effect must carry that source, and no shell permission call may place a command resource in save.
• 🟡 (08:17) Interactive smoke spawns /bin/sh with argv ["-c", "read value; printf 'got:%s\\n' \"$value\""], description "interactive input smoke test", and notifyOnExit: true; writes "hello\\n"; requires an exit notification with exitCode === 0; and reads a line matching got:hello.
• 🟡 (08:17) Cross-session ownership smoke uses sessionID: "other-session" and requires pty_write, pty_read, and pty_kill against another session’s ID to fail with "PTY session not found"; pty_list for the other session must return exactly [].
• 🟡 (08:17) Timeout smoke spawns /bin/sh -c "read value" with timeoutSeconds: 1 and notifyOnExit: true, requiring the synthetic notification to contain timedOut: true.
• 🟡 (08:17) Cleanup smoke verifies the original PTY appears in pty_list, then calls pty_kill with { id, cleanup: true }.
• 🟡 (08:17) Forced-cleanup escalation smoke spawns /bin/sh -c "trap '' TERM; while :; do sleep 1; done", requires both PTY ID and unit name, and invokes pty_kill with cleanup: true.
• 🟡 (08:17) Session-deletion smoke spawns /bin/sh -c "read value", emits { type: "session.deleted", data: { sessionID: "session-smoke" } }, and requires the deleted PTY ID to disappear from pty_list.
• 🟡 (08:17) Line-paging smoke under sessionID: "session-paging" runs /bin/printf with "one\\ntwo\\n" and requires exactly 2 lines and totalLines === 2, proving a trailing newline does not create a phantom line.
• 🟡 (08:17) Pre-listener output-bound smoke under sessionID: "session-flood" queues 40 buffers of 32,768 bytes followed by "tail-marker\n" before listener registration. Reading with pattern "tail-marker" must return at least one line and no more than 500,000 total lines, proving retention as a bounded tail.
• 🟡 (08:17) UTF-8 byte-bound smoke under sessionID: "session-bytes" attempts to write "😀".repeat(20_000) and requires failure containing "UTF-8 byte limit"; the session is then killed with cleanup: true.
• 🟡 (08:17) In-flight deletion smoke under sessionID: "session-inflight" pauses spawn during permission authorization, emits session.deleted, then releases permission. The pending spawn must fail with "Session has been deleted", and every later spawn for that owner must fail with the same message.
• 🟡 (08:17) Atomic-reservation smoke under sessionID: "session-reservations" pauses five concurrent /bin/sh -c "read value" spawns behind a permission gate. A sixth spawn must fail with "PTY session limit reached"; after releasing the gate, all five reserved sessions must return IDs and be killed with cleanup: true.
• 🟡 (08:17) Successful /tmp/opencode/pty-plugin-smoke.ts output is JSON asserting tools, permissions, ownership, interactive, notification, timeout, supervisorStop, failClosedActivation, sessionDeletion, inflightDeletion, atomicReservations, argvBounds, utf8Bytes, linePaging, preListenerOutputBound, and cleanup.
• 🟡 (08:17) Three ripgrep operations failed because a JSON record exceeded 65,536 bytes.
• 🟡 (08:17) Inspected /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame_test.go (78 lines). Tests cover: Start round-trip with device 12, inode 34, runtime 60, command "printf", and args ["%s", "hello world"]; input-frame round-trip with payload "hello"; rejection of MaxFrameSize+1; rejection of NUL argument "a\x00b"; command, individual argument, and aggregate argument limits; invalid UTF-8 command byte 0xff; and fuzzing ParsePacket() from a valid input-frame seed.
• 🟡 (08:17) Inspected /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main_test.go (192 lines). TestNodePassesConnectedSocketWithoutChangingPeerMainPID starts Node, has Node connect to a temporary Unix socket, opens "." as a directory, and spawns the fixed helper with inherited stdio entries placing the connected socket at fd 3 and cwd at fd 4.
• 🟡 (08:17) In TestNodePassesConnectedSocketWithoutChangingPeerMainPID, the accepted socket’s SO_PEERCRED PID must equal the Node process PID rather than the helper PID. The received transfer must have no MSG_TRUNC or MSG_CTRUNC, exactly one control message, exactly one Unix-rights descriptor, and a valid protocol packet.
• 🟡 (08:17) The Node helper test subsequently spawns unrelated /bin/sh -c "test ! -e /proc/self/fd/3 && test ! -e /proc/self/fd/4" with ignored stdio and requires it not to inherit fd 3 or fd 4.
• 🟡 (08:17) TestSendStartTransfersExactlyOneCloexecDirectoryDescriptor uses a CLOEXEC Unix socketpair, calls sendStart() with runtime "60", command /bin/printf, and argument "ok", receives with unix.MSG_CMSG_CLOEXEC, and requires exactly one untruncated descriptor with FD_CLOEXEC; decoded start metadata must preserve /bin/printf and sole arg "ok".
• 🟡 (08:17) TestDecodeStartEnforcesCommandArgumentAndAggregateLimits rejects: a command of protocol.MaxCommandSize+1; an argument of protocol.MaxArgSize+1; and four arguments of exactly protocol.MaxArgSize plus one additional byte.
• 🟡 (08:18) Inspected /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go (126 lines). TestDecodeArgumentsPreservesEveryArgument verifies canonical encoded argv decodes exactly to ["printf", "%s\\n", "a'b; $(id)", ""], including shell metacharacters and an empty final argument; TestDecodeArgumentsRejectsInvalidGrammar rejects "bad=".
• 🟡 (08:18) TestScriptArgumentsRequireInteractiveShellAndExitPropagation requires exact launcher argv ["script", "-q", "-e", "-f", "-c", "/bin/sh -i -c 'exec /proc/self/fd/3 --exec'", "/dev/null"].
• 🟡 (08:18) TestLauncherExecutesInDescriptorDirectory passes a temporary directory as launcher stderr/cwd descriptor, executes encoded /usr/bin/pwd, strips carriage returns, and requires output containing that exact directory followed by newline.
• 🟡 (08:18) TestLauncherPropagatesExitAndSignalStatus requires /bin/sh -c "exit 7" to exit 7 and /bin/sh -c "kill -TERM $$" to exit 143.
• 🟡 (08:18) TestLauncherPreservesMetacharactersAndNewlinesWithoutEvaluation passes the single literal argument "a'b; $(id)\nsecond line" to encoded /usr/bin/printf "%s\n" and requires exact output of that value plus one newline after removing PTY carriage returns, proving no shell evaluation or argv-boundary loss.
• 🟡 (08:18) Launcher tests build a fresh binary at <temporary-directory>/opencode-pty-launcher using go build -trimpath -o <path> ..
• 🟡 (08:18) Inspected /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth_test.go (96 lines). Test identity is the current process PID with ActiveState: "active", SubState: "running", ControlGroup: expectedClientCgroup, and 16-byte InvocationID: []byte("0123456789abcdef").
• 🟡 (08:18) Authentication tests verify successful authentication and peer.Recheck() for the current Unix peer, and separately reject wrong UID, wrong GID, changed MainPID, inactive state, substate "exited", control group "/wrong", and a missing InvocationID.
• 🟡 (08:18) TestRecheckRejectsChangedInvocation authenticates with InvocationID "0123456789abcdef", changes it to "fedcba9876543210", and requires the subsequent peer identity recheck to fail.