Dashboard › opencode › Distillation
1a2a5e14-6170-4117-85ca-4868aedfa10f["lore_tm_v1_3I5F3_EdaKqbid4LLGud9RQVZei-H9L-LeLlVQ2-cmk","lore_tm_v1_trIYskhbvgIe-kOju0m1G8pnF_mmPZI0vY3qxj0mOho","lore_tm_v1_VeNyAS1uHE8xL5GbhyYd84wkwq2gMYDRwRNbb-O57Sc","lore_tm_v1_RVV_DGHsYJ80m8LJvQorxSxrDNfg3aUasNRA-I2RNsY","lore_tm_v1_iOy-Ex-09PsMfVjnhcOx1kVaJXuj-rnoW0wgu6e7kiw","lore_tm_v1_EjXiE1zikXJhiHjWD6TpU18S1hETgh40n7of_NWt4dc","lore_tm_v1_nmiFMBwO1A7j8_Lauc4KDNjvLRDl9JThy_u9bH59dC8"]
Date: Sep 8, 2026
/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go implements a root-only Unix-socket PTY supervisor listening at /run/opencode-pty/supervisor.sock; limits are maxSessions = 16, maxUnauthenticated = 32, maxAdmissionsPerMinute = 120, socketBufferSize = 128 * 1024, and handshakeTimeout = 5 * time.Second.Server.Serve() requires os.Geteuid() == 0, runs manager.CleanupOrphans(ctx) before listening, tracks active connections, closes them on context cancellation, and reports cleanup failures through a one-shot fatal channel.NewServer() looks up the fixed client account "byk" and stores its parsed 32-bit UID and GID as expectedUID and expectedGID.server.go uses a buffered unauthenticated semaphore capped at 32, a rolling one-minute admission history capped at 120, and a separate authenticated-session semaphore capped at 16; rejected clients receive "authentication admission limit reached" or "session limit reached".server.go authenticates the Unix peer, receives a protocol.TypeStart frame plus exactly one cwd file descriptor, verifies cwd device/inode metadata, generates a cryptographically random systemd unit name from 16 random bytes, rechecks peer identity, starts the transient unit, and sends protocol.TypeStarted.serveSession() concurrently runs copyInput(), copyOutput(), watchDisconnect(), and manager.Wait(); it handles protocol.TypeStop, client disconnect/input closure, PTY forwarding failures, context cancellation, unit completion, PTY-output draining with outputDrainTimeout, and final protocol.TypeStopped or protocol.TypeExit frames.copyInput() accepts only nonempty protocol.TypeInput payloads no larger than protocol.MaxIOPayloadSize, except an empty protocol.TypeStop; copyOutput() emits protocol.TypeOutput chunks up to protocol.MaxIOPayloadSize.watchDisconnect() duplicates the Unix connection descriptor with unix.F_DUPFD_CLOEXEC and polls every 250 ms for unix.POLLRDHUP | unix.POLLHUP | unix.POLLERR.receiveStart() and receiveExact() receive SCM_RIGHTS descriptors using unix.Recvmsg(..., unix.MSG_CMSG_CLOEXEC), reject unix.MSG_TRUNC/unix.MSG_CTRUNC, reject more than one descriptor, enforce protocol.MaxFrameSize, and require a protocol.TypeStart frame with exactly one directory descriptor whose Stat_t.Dev and inode match the encoded start metadata.listen() refuses to replace a non-socket at /run/opencode-pty/supervisor.sock, removes an existing socket, creates a Unix listener, and applies mode 0660.socketPair() creates AF_UNIX SOCK_STREAM|SOCK_CLOEXEC endpoints and sets both SO_SNDBUF and SO_RCVBUF to socketBufferSize; frameWriter.write() serializes writes with a mutex and applies operationTimeout as the write deadline./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth.go authenticates clients with both SO_PEERCRED and SO_PEERPIDFD; credentials must have a positive PID and exactly match the expected UID/GID.authenticatedPeer.validateIdentity() requires the peer PID to equal the systemd client service MainPID, ActiveState == "active", SubState == "running", ControlGroup == expectedClientCgroup, and an InvocationID of exactly 16 bytes.authenticatedPeer.Recheck() verifies pidfd liveness with unix.PidfdSendSignal(peer.pidfd, 0, nil, 0), requeries manager.ClientState(ctx), repeats identity validation, and rejects an InvocationID change during admission.operationTimeout = 5 * time.Second and validates unit names with ^opencode-pty-[0-9a-f]{32}\.service$; visible transient-unit hardening includes UMask = 0077, CollectMode = "inactive", ProtectKernelTunables = true, and allowed address families AF_UNIX, AF_INET, and AF_INET6.Failed to connect to bus: No medium found.systemd-analyze security reported opencode-pty-supervisor.service at overall exposure level 0.9 SAFE :-); flagged exposure items included host-root access via unset RootDirectory=/RootImage= (0.1), running as root via unset User=/DynamicUser= (0.4), permitted AF_UNIX sockets (0.1), unset PrivateUsers= (0.2), a DeviceAllow= ACL including char-rtc:r (0.1), and unset IPAddressDeny= (0.2).2980699 executing openat(AT_FDCWD, "/sys/kernel/mm/transparent_hugepage/hpage_pmd_size", O_RDONLY) = 3./home/byk/Code/opencode-v2-pilot/packages/cli/src/session-target.ts:115 calls .fork({ sessionID: explicit.id, boundary: { type: "through" } }, ...requestOptions(input.signal)); 2. the same file at line 129 calls .fork({ sessionID: selected.id, boundary: { type: "through" } }, ...requestOptions(input.signal)); 3. /home/byk/Code/opencode-v2-pilot/packages/cli/src/services/standalone.ts:40 calls spawner.spawn(command(password, options)); 4. /home/byk/Code/opencode-v2-pilot/packages/cli/src/commands/handlers/session/list.ts:68 contains .spawn(; 5. /home/byk/Code/opencode-v2-pilot/packages/cli/src/acp/service.ts:265 calls input.client.session.fork({.