Dashboard › opencode › Distillation
32342058-8acd-4f33-9456-d8e10ce984fd["lore_tm_v1_rMCnwF84HgNKwWe19NLOmImBJSV9roiui9NkHrMoKzo","lore_tm_v1_CoPhr_z_SUMC4YlyUPTjH_j61Q4u_NYn_WCPwpOgLyE","lore_tm_v1_dYr6I3mbNUF0n9mxvxttNYvh8kCtWPmJv5-JQyHCBgY","lore_tm_v1_uzhtgdcttTqPoRSXj3lXq-RMS6F4eDeE4ZSDI2cU8I0","lore_tm_v1_rCAyEcNIB_xh0oJI_SNnuTmjohomldBSKcw0ZKzND-0","lore_tm_v1__dUf66CscrmIYNajZgu2GfLOeaJz1gYy0_sxXtBfxys","lore_tm_v1_5KmkXfovDH6cTy_-LYkBuOMSF6GBOwhvDd1nf5aNO_A","lore_tm_v1_aeX0MISom6R5yYJox29lcLBycEOQ3FDINihwTl8pKn4","lore_tm_v1_sTRm4tEYaZFgaO0t2xqnBC-YUlX8fbwJLQya7ooNfL4","lore_tm_v1_tFYIcd66nig1DZHUtgu4wtT7m1p9XsEoMAr1v-zq24M"]
Date: Sep 8, 2026
/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts showed plugin local-pty registers five tools: pty_spawn, pty_write, pty_read, pty_list, and pty_kill; pty_spawn, pty_write, and pty_kill require "shell" permission, while pty_read and pty_list do not.pty.ts limits include MAX_BUFFER_SIZE = 1_000_000, MAX_SESSIONS = 16, MAX_SESSIONS_PER_OWNER = 5, DEFAULT_READ_LIMIT = 500, MAX_READ_LIMIT = 2_000, MAX_READ_OFFSET = 10_000, MAX_LINE_LENGTH = 2_000, MAX_PATTERN_LENGTH = 500, MAX_WRITE_SIZE = 65_536, MAX_TIMEOUT_SECONDS = 3_600, CLOSE_TIMEOUT_MS = 27_000, NOTIFICATION_TIMEOUT_MS = 5_000, MAX_COMMAND_LENGTH = 4_096, MAX_ARGUMENTS = 128, MAX_ARGUMENT_LENGTH = 16_384, MAX_ARGUMENT_BYTES = 65_536, MAX_PATH_LENGTH = 4_096, MAX_TITLE_LENGTH = 500, MAX_DESCRIPTION_LENGTH = 2_000, and MAX_REGEX_WORKERS = 4.pty_spawn validates the command and arguments, rejects plugin closure or a deleted parent Session, reserves capacity before asynchronous authorization, enforces 16 total sessions and 5 per parent Session, and at the per-owner limit evicts one inactive session ("exited" or "killed") or rejects when none exists.pty_spawn tracks global pending operations in pendingSpawns, per-owner operations in ownerSpawns, and per-owner counts in reservations; its finally block decrements reserved, updates/removes the owner reservation, and removes the tracked operation from both pending sets.pty.ts canonicalizes both the requested workdir and project directory with realpath(), requires external_directory permission when outside the project, then requires shell permission for a single-quoted shellCommand(command, args) resource. After approval it rechecks the workdir path, opens it with O_RDONLY | O_DIRECTORY | O_NOFOLLOW, verifies it is a directory, and compares /proc/self/fd/${handle.fd} against the approved canonical path to prevent workdir replacement.pty_spawn creates an ID of the form pty_ plus the first 8 hex characters of a hyphen-stripped UUID, calls openSupervisorTransport(binding.handle, command, args, timeoutSeconds ?? 0, supervisor), closes the directory handle, and does not add the session to sessions until transport startup has succeeded.pty.ts session records id, title, description, command, args, canonical workdir, status, notifyOnExit, optional timeoutSeconds, timedOut, optional exit code/signal, supervisor unitName, ISO createdAt, parent Session ID, transport, closure/termination promises, optional timer, and buffered output.1_000_000 characters. On structured transport exit, status becomes "killed" if it had been "killing" and otherwise "exited"; result === "timeout" sets timedOut, execMainCode === 1 maps status to exitCode, and execMainCode === 2 || execMainCode === 3 maps status to exitSignal. Transport rejection sets exitCode = 1 and appends the error text to the buffer.notifyOnExit: true, pty.ts sends a synthetic parent-Session message with delivery: "steer", description PTY exited: ${truncate(description, 100)}, and JSON fields type: "pty.exit", id, description truncated to 100, exitCode, exitSignal, timeoutSeconds, timedOut, outputLines, and the last nonblank line truncated to 200; notification is skipped while closing or after parent deletion and is bounded by 5_000 ms.pty_write decodes \n, \r, \t, \xNN, \uNNNN, and \\, then checks the decoded UTF-8 byte size against 65_536; it obtains shell permission using a resource containing the original command plus <stdin> and quoted input, re-fetches the owner-scoped session after permission approval, requires status "running", and writes a Buffer.pty_read supports zero-based offset, a default limit of 500, a maximum limit of 2_000, and optional extended-regex filtering with case-insensitive mode. Regex reads are limited to 4 concurrent workers and call /usr/bin/grep with ["-a", "-m", String(limit), "-nE", ...(ignoreCase ? ["-i"] : []), "--", pattern]; grep is killed after 250 ms, stdout is bounded to MAX_BUFFER_SIZE * 2, stderr to MAX_LINE_LENGTH, exit 1 means no matches, and SIGKILL reports "PTY output pattern timed out.".pty_read returns JSON containing type: "pty.read", session ID/status, optional pattern, offset, limit, line-number/text records with text truncated to 2_000 characters, total buffered line count, hasMore, and conditional nextOffset.pty_list returns only sessions whose parentSessionID equals the caller’s Session ID. pty_kill likewise uses owner-scoped requireSession(), rechecks the session after shell permission approval, optionally calls remove() to terminate and erase output, or otherwise terminates a running/killing session while retaining its record and buffer.terminate() in pty.ts is idempotent through session.terminate, marks the session "killing", calls session.transport.close(), and waits up to 27_000 ms for session.closed; timeout produces PTY ${session.id} supervisor cleanup timed out..session.deleted, pty.ts records the parent Session ID in deleted, waits for all that owner’s in-flight spawns, logs unexpected spawn cleanup failures, then removes all owned PTY sessions. Plugin unload sets closing = true, aborts event subscription, and waits with Promise.allSettled() for pending spawns, all session removals, and pending notifications./home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json uses strict TypeScript with target: "ESNext", module: "Preserve", moduleResolution: "Bundler", noEmit: true, allowImportingTsExtensions: true, Bun types, and path mappings from @opencode/plugin and @opencode/plugin/* to /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/; it includes plugins/**/*.ts and test/**/*.ts./home/byk/.local/share/opencode-v2-pilot/config/opencode/package.json is private ESM and pins dependency effect to 4.0.0-rc.112 and dev dependency @types/bun to 1.2.21./home/byk/.local/share/opencode-v2-pilot/supervisor/ROOT-ACCEPTANCE.md to pass on the exact target host before installing, starting, enabling, or marking the candidate ready; source tests never substitute for these checks./usr/local/libexec, every parent directory, and /usr/local/libexec/opencode-pty-supervisor, /usr/local/libexec/opencode-pty-launcher, and /usr/local/libexec/opencode-pty-client to be root-owned and never writable by byk or a group.MainPID, never the helper; the exact UID, GID, MainPID, active/running state, /system.slice/opencode-v2.service cgroup, 16-byte InvocationID, mandatory SO_PEERPIDFD, and rejections after MainPID/invocation replacement must be confirmed.3 as a duplicate of Node’s connected socket and fd 4 as the approved directory, send one bounded start frame with one SCM_RIGHTS descriptor, mark both inherited descriptors close-on-exec, and exit without leaking descriptors to unrelated Node children.byk:byk with an empty supplementary-group list and never retain docker, lxd, sudo, or other groups.MainPID, obtain/inherit its authenticated socket, or delegate work through an inherited descriptor blocks deployment.3 binaries and record source revision, Go version, dependency sums, build commands, and SHA-256 hashes; 2. verify root-controlled immutable installation and fixed helper path; 3. test root-owned mode-0644 service/slice files in a disposable VM with systemd-analyze verify and D-Bus property inspection; 4. prove exact peer identity, mandatory pidfd support, and admission rechecks; 5. syscall/descriptor-trace the helper; 6. test unauthenticated quotas/rate limits separately from authenticated capacity and bound each handshake D-Bus operation to 5 seconds; 7. validate transient-unit identity and sandboxing; 8. validate the explicit pilot security boundary and same-UID delegation resistance; 9. verify exact protocol limits and malformed-input rejection; 10. verify real PTY behavior and fixed /bin/sh -i; 11. exercise 16 concurrent sessions and reject the 17th while covering disconnect/backpressure/failure paths; 12. prove bounded StopUnit, full cgroup removal, surfaced cleanup errors, and strict orphan cleanup; 13. validate aggregate/per-session CPU, memory, tasks, I/O, runtime, and output-backpressure controls; 14. run the five-tool adversarial plugin smoke 10 times; 15. obtain independent correctness/security approval and create the content-bound readiness marker only afterward.4,096 command bytes, 128 arguments, 16,384 bytes per argument, 65,536 aggregate argument bytes, 3,600 seconds maximum runtime, and 65,536-byte writes split into 32,768-byte frames; malformed UTF-8, NUL, missing/extra descriptors, MSG_CTRUNC, metadata mismatch, wrong direction, unknown frame types, and oversized frames must be rejected./etc/opencode/pty-supervisor-verified must be a root-owned mode-0644 regular non-symlink file containing exactly 4 lines: revision=<reviewed revision>, followed by standard sha256sum records for /usr/local/libexec/opencode-pty-supervisor, /usr/local/libexec/opencode-pty-launcher, and /usr/local/libexec/opencode-pty-client; an absent, empty, stale, writable, wrong-owner, wrong-mode, symlinked, or hash-mismatched marker cannot grant readiness./home/byk/.local/share/opencode-v2-pilot/CUTOVER.md states that OpenCode V2 serves API and web UI from one origin and nginx must not be added. Preflight keeps production healthy on port 4096, validates the candidate revision/build and isolated candidate on port 14102, activates both local plugins through POST /api/plugin/await-activation, creates mode-0600 server.env, completes root acceptance and independent reviews, proves all cleanup and descriptor-inheritance properties, creates the verified marker, and validates service/slice files without changing production./etc/systemd/system/opencode-v2.service; 2. run sudo systemctl daemon-reload; 3. run sudo systemctl stop opencode.service; 4. run sudo systemctl start opencode-v2.service; 5. verify /api/health, /, /site.webmanifest, /sw.js, and /openapi.json on port 4096; 6. activate plugins and confirm followup and local-pty; 7. observe browser traffic and run one follow-up plus one PTY smoke session; 8. enable opencode-v2.service only after all checks, retaining disabled opencode.service for rollback.opencode-v2.service; 2. start opencode.service; 3. verify the legacy health endpoint and browser UI on port 4096; 4. disable opencode-v2.service only after legacy health is confirmed. The V2 database remains isolated under /home/byk/.local/share/opencode-v2-pilot/data, and rollback never rewrites or deletes either database./home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service runs /usr/local/libexec/opencode-pty-supervisor as root with group byk, no supplementary groups, RuntimeDirectory=opencode-pty, mode 0750, UMask=0077, KillMode=control-group, TimeoutStopSec=20s, OOMPolicy=kill, Delegate=no, PrivateNetwork=yes, RestrictAddressFamilies=AF_UNIX, MemoryHigh=192M, MemoryMax=256M, TasksMax=64, accounting for CPU/memory/tasks/I/O, empty capability and ambient sets, closed devices, and extensive system, home, proc, namespace, syscall, and socket restrictions./run/docker.sock, /var/run/docker.sock, and /run/user/1000/bus inaccessible and uses ProtectSystem=strict, ProtectHome=yes, ProtectProc=invisible, ProcSubset=pid, RestrictNamespaces=yes, MemoryDenyWriteExecute=yes, PrivateTmp=yes, PrivateDevices=yes, and PrivateMounts=yes./home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go showed the helper uses inherited socketFD = 3 and cwdFD = 4, calls unix.CloseOnExec() on both, validates fd 3 with unix.Getpeername(), validates fd 4 with unix.Fstat() and S_IFDIR, embeds its device/inode into the start metadata, and sends the framed start plus cwd descriptor using unix.SendmsgN(..., unix.UnixRights(cwd), ..., unix.MSG_NOSIGNAL).decodeStart() requires 2..protocol.MaxArgs+2 metadata values, parses runtime as unsigned 32-bit decimal no greater than protocol.MaxRuntimeSec, requires every encoded command/argument to start with a and use canonical unpadded URL-safe base64 grammar [A-Za-z0-9_-]*, rejects NUL, enforces protocol.MaxCommandSize, protocol.MaxArgSize, and aggregate protocol.MaxArgsSize, and returns protocol.Start{Device, Inode, RuntimeSec, Command, Args}./home/byk/.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md specifies one Unix SOCK_STREAM connection per PTY, opened and retained by Node SEA; the fixed root-owned helper receives duplicate fd 3 plus approved-directory fd 4, sends exactly one type-1 start frame with exactly one SCM_RIGHTS descriptor, then exits, while all other Node children inherit neither descriptor.8-byte big-endian st_dev; 2. 8-byte big-endian st_ino; 3. 4-byte big-endian runtime seconds, where zero selects the supervisor’s 3,600-second default; 4. 2-byte command length; 5. 2-byte argument count; 6. command bytes; 7. each argument as a 2-byte length followed by bytes. The supervisor atomically receives descriptors with MSG_CMSG_CLOEXEC, closes every descriptor on every error, requires exactly one directory, and compares its device/inode with the frame.fchdir(2), replaces stderr with stdout, validates canonical a[A-Za-z0-9_-]* base64 arguments, clears the environment, binds its reviewed executable to fd 3, and executes /usr/bin/script -q -e -f -c "/bin/sh -i -c 'exec /proc/self/fd/3 --exec'" /dev/null; the inner launcher decodes argv, clears the temporary environment value, restores the fixed environment, closes fd 3, and directly invokes execve while preserving argv boundaries./home/byk/.local/share/opencode-v2-pilot/opencode-v2.service requires and starts after opencode-pty-supervisor.service, runs as byk with no supplementary groups from /home/byk, uses isolated config/data/cache/state paths under /home/byk/.local/share/opencode-v2-pilot, and starts opencode2-node serve --hostname=0.0.0.0 --port=4096.opencode-v2.service uses an ExecCondition that requires /etc/opencode/pty-supervisor-verified to exist as a non-symlink with stat value 0:0:644, exactly 4 lines, a first line matching ^revision=[0-9a-f]{40,64}$, and lines 2..4 that pass /usr/bin/sha256sum --check --strict -.opencode-v2.service operational settings include Restart=always, RestartSec=5, Nice=-5, LimitNOFILE=65535, LimitNPROC=4096, MemoryHigh=12G, MemoryMax=13G, NoNewPrivileges=true, ProtectSystem=strict, ProtectHome=read-only, ReadWritePaths=/home/byk, and PrivateTmp=yes.