Distillation

Current State

• Date: Sep 8, 2026, latest recorded time 18:24.
• Active repository/worktree: /home/byk/Code/opencode-v2-pilot, branch v2-pilot, tracking origin/v2.
• HEAD/rebase base remains 2ac698d65aa4690a694307e9cbdf44537ea9a4fb (feat(ai): add Moonshot provider (#47851)).
• No commit or staging has occurred. Latest repository status at 17:55 showed 7 modified tracked files (220 insertions, 62 deletions):
  • /home/byk/Code/opencode-v2-pilot/packages/core/src/plugin/host.ts
  • /home/byk/Code/opencode-v2-pilot/packages/core/test/plugin.test.ts
  • /home/byk/Code/opencode-v2-pilot/packages/core/test/plugin/fixture.ts
  • /home/byk/Code/opencode-v2-pilot/packages/core/test/plugin/host.ts
  • /home/byk/Code/opencode-v2-pilot/packages/plugin/src/effect/permission.ts
  • /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/adapter.ts
  • /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/permission.ts
• Untracked CLI build directories:
  • packages/cli/dist-v2-pilot/
  • packages/cli/dist-v2-pilot-next/
  • packages/cli/dist-v2-pilot-final/
  • newly built packages/cli/dist-v2-pilot-byk/
  • These generated executable artifacts must not be staged accidentally.
• Fresh final-source Node 26.4 SEA:
  • Binary: /home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-byk/cli-node-linux-x64/bin/opencode2-node
  • Version: opencode2-node v0.0.0-v2-pilot-202609081820
  • Built successfully at 18:24 with pinned Bun 1.4.2 (744846f84) and Node 26.4.0.
  • Full build output: /home/byk/.local/share/opencode/tool-output/tool_08240aa3a001mcQ006R2Jm3MCR
• Immediate next work:
  1. Update the inactive candidate unit to point to dist-v2-pilot-byk.
  2. Launch the new SEA on an unused loopback port with isolated V2 config/database.
  3. Verify authenticated health, integrated UI, real activation of followup and local-pty, and an end-to-end PTY session.
  4. Obtain fresh independent correctness and security approval for the exact direct-PTY source and new candidate binary.
  5. Do not touch production without explicit cutover approval.
• Current project status:
  1. Rebase v2-pilot onto latest origin/v2 — completed, high.
  2. Rebuild and smoke-test rebased V2 Node server — completed, high.
  3. Verify isolated V2 server/database — completed, high.
  4. Verify integrated V2 web UI — completed, high.
  5. Port and verify follow-up plugin — completed, medium.
  6. Add canonical Promise permission assertion for PTY tools — completed, high.
  7. Restore and harden unprivileged byk PTY implementation — source/tests completed locally; runtime activation still pending, high.
  8. Remove root supervisor from candidate cutover — effectively completed in active files; candidate-unit binary path still needs updating, high.
  9. Build and verify final V2 pilot plugins — fresh build completed; isolated runtime verification pending, high.
  10. Obtain independent final PTY correctness/security approval — pending, high.
  11. Finalize cutover/rollback documentation — substantially updated, but final review remains pending, medium.
• Active isolated pilot configuration: /home/byk/.local/share/opencode-v2-pilot/config/opencode
  • Plugin directory contains exactly:
    • plugins/followup.ts
    • plugins/pty.ts
  • plugins/pty-transport.ts is absent.
  • Persistent PTY tests: test/pty.test.ts
  • Follow-up tests: test/followup.test.ts
  • package.json is private ESM and resolves effect from the checkout’s exact Effect instance.
  • tsconfig.json uses strict/no-emit Bundler resolution, maps @opencode/plugin to the checkout Promise API, and includes plugins/**/*.ts plus test/**/*.ts.
• Active PTY architecture is now the user-approved unprivileged model:
  • Runs in-process under the existing byk service.
  • Uses Node child_process plus /usr/bin/script.
  • No root helper, supervisor service, readiness marker, cgroup delegation, or pty-transport.ts.
  • Preserves canonical permissions, Session ownership, fixed environment, bounded resources, cwd descriptor pinning, and process-group TERM→KILL cleanup.
  • Explicit trust boundary: a child that deliberately calls setsid(), daemonizes, or otherwise leaves the process group can escape cleanup and is outside the chosen byk trust model.
  • Never describe this PTY as cgroup-contained or as a general sandbox.
• Dormant, abandoned supervisor-design sources still exist under: /home/byk/.local/share/opencode-v2-pilot/supervisor/
  • They are excluded from plugin discovery, candidate activation, and cutover.
  • No root binaries, system unit, or readiness marker were ever installed.
  • If this approach is ever revived, its prior exact integrity, authentication, descriptor-transfer, and root-host acceptance requirements must be re-evaluated; none are current deployment dependencies.
• Candidate unit: /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service
  • Runs as User=byk.
  • Uses NoNewPrivileges=true, ProtectSystem=strict, ProtectHome=read-only, ReadWritePaths=/home/byk, and PrivateTmp=yes.
  • Loads /home/byk/.opencode/env and isolated server.env.
  • Uses isolated config/database/XDG paths beneath /home/byk/.local/share/opencode-v2-pilot/.
  • Empty SupplementaryGroups= was removed because it does not clear account-database groups.
  • At 12:06 it still pointed to dist-v2-pilot-final; next action is to update it to dist-v2-pilot-byk.
• Production:
  • Remains untouched by pilot changes.
  • Effective unit /etc/systemd/system/opencode.service runs as byk on port 4096.
  • Latest observed live state at 09:36: PID 3086649, active/running since 2026-09-08 09:23:04 UTC, cgroup /system.slice/opencode.service.
  • Production process has UID/GID 1000:1000, no capabilities, NoNewPrivs: 1, and account groups adm, cdrom, sudo, dip, plugdev, lxd, docker, and byk.
  • Production already uses unprivileged opencode-pty@0.3.6, establishing the user-approved trust-model precedent.
• Final direct-PTY local verification:
  • Persistent suite now has 14 tests.
  • Bun 1.4.2 final-source 10-run gate passed every run: 14 pass, 0 fail, 33 expect() calls; 140 tests total.
  • Same final lifecycle source also passed once under Bun 1.3.14: 14 pass, 0 fail, 33 expect() calls.
  • Plugin/Core typechecks pass.
  • Core Promise permission suite passes 19/19, 65 expect() calls.
• Acceptance/cutover gate remains closed:
  • Fresh dist-v2-pilot-byk SEA has not yet been launched against the isolated real plugins.
  • Fresh independent correctness/security reviews have not yet approved the exact direct-source state and new binary.
  • User directive: never cut over while smoke checks or independent reviews are incomplete.
• PTY workflow directive remains:
  • Never poll completion with sleep plus pty_read.
  • If notifyOnExit is enabled, the future exit notification is the completion signal.
  • pty_read before exit is only for genuinely needed live output, explicitly requested logs, or investigation after non-zero exit.

Key Decisions

• Final PTY deployment model was changed back to unprivileged in-process execution at 09:40 with explicit user approval.
  • V2 should match existing production: OpenCode and PTY children run as byk, with NoNewPrivileges=yes, no effective capabilities, and the account’s existing supplementary groups.
  • The root-owned supervisor/cgroup design was abandoned as an active requirement because it enforced a stronger threat model than current production and imposed disproportionate complexity.
  • The accepted caveat is that deliberately escaped descendants are not guaranteed to be cleaned up.
  • The dormant supervisor tree is retained only as inactive design work and must not be activated or referenced by cutover.
• The custom PTY remains because it gives the model five interactive-terminal tools, in exact order:
  1. pty_spawn
  2. pty_write
  3. pty_read
  4. pty_list
  5. pty_kill
  • Its primary use is REPLs, interactive prompts, debuggers, and long-running commands needing later keyboard input.
  • Ordinary commands/builds/tests/background jobs already work through native shell execution, and the integrated browser terminal remains available for humans.
• The V2-native PTY uses Node-safe util-linux script(1) rather than bun-pty:
  • bun-pty@0.4.10 publishes TypeScript runtime source and fails in Node SEA with ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING.
  • opencode-pty@0.3.6 depends on bun-pty and does not export the V2 default plugin definition.
  • @opencode-ai/pty@0.1.13 exposes a daemon binary path, not an in-process PTY API.
• PTY permission model:
  • options.permission only filters catalog visibility; it never authorizes leaf execution.
  • pty_spawn, every exact decoded pty_write, and pty_kill assert canonical Core permission immediately before side effects.
  • Action is canonical shell, not bash.
  • Permission source always derives from tool context: { type: "tool", messageID: context.messageID, id: context.id }.
  • Model-controlled command/input resources use save: []; arbitrary command text must never be stored as a wildcard-looking saved grant.
  • Exact decoded terminal input is authorized per write; the plugin does not attempt unsafe shell-state inference.
• Promise permission bridge:
  • Canonical assertion is exposed in-process from Core rather than through a new Protocol/HTTP endpoint.
  • Promise adaptation preserves typed Effect failures through a private marker.
  • Permission.CorrectedError.feedback becomes Tool.Error.message.
  • Plain user decline remains a defect tunnel and must never become model-facing tool output.
  • Unrelated defects remain defects.
• PTY filesystem decision:
  • Resolve and open the approved workdir before permission approval.
  • Hold the exact directory descriptor across approval and spawn.
  • Validate /proc/self/fd/<fd> before and after approval.
  • Spawn from /proc/self/fd/<fd> and close the handle after startup.
  • This binds authorization to the same filesystem object without root privilege.
• PTY lifecycle decisions:
  • Reserve global/per-owner capacity synchronously before asynchronous spawn work.
  • Track in-flight spawns and reject late insertion after Session deletion/plugin shutdown.
  • Attach close handling before awaiting startup.
  • Enforce a hard startup deadline; a process arriving after timeout is terminated rather than left untracked.
  • Process close and synthetic notification delivery are separate concerns.
  • Model-visible killed state and timeout exit notification are emitted only after TERM→KILL cleanup completes.
  • Cleanup waits are bounded and process-group based.
• PTY data safety decisions:
  • Reject malformed UTF-16 before permission display or execution, preventing displayed permission text from differing from Buffer.from(...) execution bytes.
  • Use UTF-8 byte counts for write and argv limits.
  • JSON is used for model-facing spawn/read/write/kill/exit envelopes; raw output is never interpolated into control-like XML.
  • Regex matching runs in bounded grep -E workers rather than on the host JS thread.
• Follow-up plugin decisions remain:
  • Replacement lives at isolated plugins/followup.ts and uses Plugin.define({ id, setup }).
  • It fails closed when Session lineage cannot be proved.
  • Subagents cannot schedule/list/cancel deferred follow-ups.
  • Tools use codemode: false.
  • Teardown owns and clears timers; Session deletion clears timer and lineage state.
  • Prompt admission is durable, but timers remain non-durable across restart without ctx.storage.
• Plugin discovery/install decisions remain:
  • Absolute configured plugin file paths are rejected as directories are required.
  • Single-file local plugins use auto-discovered plugins/.
  • Tests must stay under test/, not plugins/.
  • Standalone config-root plugins require locally resolvable runtime dependencies.
  • Plugin resolution must never execute plugin code.
• Build/testing decisions:
  • Use the pinned Bun 1.4.2 builder for Node SEA builds.
  • Bun 1.3.14 remains available and is useful for compatibility, but previously caused resolver-specific failures in packages/plugin/test/host.test.ts; the same suite passed 9/9 under Bun 1.4.2.
  • Never run package tests from repository root; use package directories.
  • Use current Effect v4/effect-smol source, not remembered v2/v3 APIs.
  • Exact plugin config typechecking must deduplicate Effect identity through the checkout mappings.
• Integrated deployment architecture remains one-origin Node SEA:
  • It serves API, UI, assets, PWA, OpenAPI, CSP, and cache headers itself.
  • Nginx must not be added.
• Cutover remains explicit and reversible:
  • Keep production installed for rollback.
  • Candidate uses isolated config/database and shared environment file plus private password file.
  • Validate on a non-production loopback port first.
  • Require explicit approval before stopping production.
  • Rollback never rewrites or deletes either database.

Technical Changes

• Promise permission API and adapter
  • /packages/core/src/plugin/host.ts
    • Exposes canonical Core Permission.Service.assert as assert: permission.assert.
  • /packages/plugin/src/effect/permission.ts
    • Adds PermissionAssertInput and: assert(input): Effect.Effect<void, unknown>.
  • /packages/plugin/src/promise/permission.ts
    • Adds matching input and: assert(input): Promise<void>.
  • Input supports: sessionID, action, resources, optional save, metadata, source, and agent.
  • /packages/plugin/src/promise/adapter.ts
    • Adds private TypedFailure.
    • Host typed failures cross the Promise seam through the private marker.
    • executePromiseTool(...) uses Effect.tryPromise.
    • Wrapped typed permission failures become Tool.Error; corrected feedback is preferred as the message.
    • Unrelated rejections are re-died as defects.
    • Declines remain defects so “no” never becomes model-facing output.
  • /packages/core/test/plugin/fixture.ts
    • Adds injectable: pluginTestLayer(assert: Permission.Interface["assert"] = () => Effect.void).
  • /packages/core/test/plugin.test.ts
    • Retains "exposes canonical permission assertions to Promise plugins".
    • Adds "preserves Promise permission assertion outcomes through tool execution".
    • Covers:
      1. allow → "allowed";
      2. Permission.CorrectedError → exact message "Use a read-only command instead";
      3. ordinary defect remains a defect;
      4. Permission.DeclinedError remains in the established defect tunnel.
  • Latest validation:
    • tsgo --noEmit passed at 18:04.
    • tsgo -b tsconfig.json tsconfig.tests.json passed.
    • Core test/plugin.test.ts: 19 pass, 0 fail, 65 expect() calls, 2.93s.
• Current PTY plugin
  • Source: /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts
  • Plugin ID: local-pty.
  • Direct backend: /usr/bin/script through Node child_process, detached process group, no supervisor transport.
  • Fixed environment:
    • HOME=/home/byk fallback
    • LANG=C.UTF-8 fallback
    • PATH=/usr/bin:/bin
    • SHELL=/bin/sh
    • TERM=xterm-256color
  • Caller environment is not inherited or merged.
  • Core limits include:
    • MAX_BUFFER_SIZE = 1_000_000
    • MAX_SESSIONS = 25
    • MAX_SESSIONS_PER_OWNER = 5
    • DEFAULT_READ_LIMIT = 500
    • MAX_READ_LIMIT = 2_000
    • MAX_READ_OFFSET = 10_000
    • MAX_LINE_LENGTH = 2_000
    • MAX_PATTERN_LENGTH = 500
    • MAX_WRITE_SIZE = 65_536 UTF-8 bytes
    • MAX_TIMEOUT_SECONDS = 2_147_483
    • KILL_GRACE_MS = 1_000
    • command, argument count/per-argument/aggregate encoded-size, path, title, description, and regex-worker limits remain bounded.
  • Ownership:
    • requireSession enforces originating Session for read/write/kill.
    • pty_list only lists caller-owned PTYs.
    • Eight-hex-character PTY IDs are short but guessed IDs do not bypass ownership.
  • Spawn authorization and cwd binding:
    • Validates well-formed Unicode on command and every argument.
    • Resolves and opens cwd with O_RDONLY | O_DIRECTORY | O_NOFOLLOW before approval.
    • Verifies the handle is a directory.
    • Confirms /proc/self/fd/<fd> identifies the approved path before and after approval.
    • Requests external_directory first when outside the project.
    • Requests shell with save: [].
    • Spawns using the pinned descriptor path.
  • Write:
    • Decodes \n, \r, \t, \xNN, \uNNNN, and \\.
    • Rejects malformed Unicode.
    • Checks UTF-8 bytes, not JS character count.
    • Canonically authorizes the exact decoded input with save: [].
    • Rechecks the Session is still running before writing.
  • Read:
    • Bounded paging and consistent line counts.
    • Does not emit phantom trailing lines for empty/newline-terminated output.
    • Preserves terminal CRLF output.
    • Regex evaluation uses at most 4 bounded /usr/bin/grep -E workers, short timeout, bounded stdout/stderr, and stream-error handling.
  • Lifecycle:
    • Atomic global/per-owner reservations happen before suspension.
    • In-flight spawns are tracked per owner.
    • Session deletion closes admission, waits for in-flight work, rejects late insertion, and removes owned sessions.
    • Startup is bounded with "PTY process startup timed out."; late process creation is cleaned up.
    • Close listeners attach before spawn completion.
    • Explicit kill/timeout/deletion/unload use process-group SIGTERM, wait, then SIGKILL.
    • Status/exit notification now follows verified cleanup, fixing the Bun 1.4.2 race where killed became visible while the group still existed.
    • Synthetic exit notifications are JSON with delivery: "steer".
• Direct PTY defects found and fixed during 17:37–18:20
  1. Stalled /usr/bin/script startup could remain pending indefinitely.
     • Added hard startup deadline and late-process cleanup.
  2. Malformed UTF-16 could make permission text differ from executed UTF-8 bytes.
     • Added String.prototype.isWellFormed() validation before permission/execution.
  3. Initial cwd hardening edit accidentally invoked the PTY opener twice and referenced removed variable current.
     • Corrected before final tests.
  4. Workdir was opened after permission, leaving approval/object replacement race.
     • Open and pin descriptor before approval; revalidate through spawn.
  5. Timeout status became killed before complete process-group cleanup under Bun 1.4.2.
     • Reordered termination/finalization and threaded setup-local notification behavior through removal paths.
  6. Test assumptions were corrected:
     • Relaxed scheduler-sensitive <80ms wall-clock assertion while preserving semantic timeout.
     • Preserved valid PTY carriage returns instead of expecting normalized LF.
• Persistent PTY tests
  • File: /home/byk/.local/share/opencode-v2-pilot/config/opencode/test/pty.test.ts
  • Expanded from 5 to 14 tests.
  • Covers:
    • exact five-tool order;
    • real interactive command/write/read;
    • fixed environment;
    • pinned cwd;
    • argv preservation for spaces, quotes, shell metacharacters, and Unicode;
    • no shell evaluation;
    • canonical permission source;
    • exact write permission with save: [];
    • malformed-Unicode rejection;
    • hard startup deadline and late-start cleanup;
    • timeout cleanup;
    • TERM→KILL process-group handling;
    • exactly one JSON exit notification;
    • Session ownership;
    • Session deletion and late-spawn rejection;
    • cleanup;
    • limits;
    • line-count/paging consistency;
    • atomic per-Session admission;
    • deletion while spawn is in flight.
  • Final Bun 1.4.2 10-run durations: 13.56s, 15.56s, 15.57s, 15.61s, 15.58s, 15.57s, 15.68s, 15.57s, 13.59s, 15.61s.
  • Every run: 14 pass, 0 fail, 33 expect() calls.
• Fresh SEA build
  • Output: packages/cli/dist-v2-pilot-byk/cli-node-linux-x64/bin/opencode2-node
  • Version: v0.0.0-v2-pilot-202609081820.
  • Web build: 13.42s.
  • PWA v1.3.0, generateSW, 910 entries, 33181.39 KiB, generated dist/sw.js.
  • SSR:
    • Vite 7.3.6
    • 6063 modules
    • dist-node/opencode.mjs 28,201.05 kB
    • 49.10s
  • SEA:
    • Node 26.4.0
    • built through dist-node/sea.json
    • pre-SEA CLI and SEA both passed --help and --version.
  • Build warnings only:
    • ineffective dynamic imports for @sentry/solid and src/providers/models/select-dialog.tsx;
    • chunks over 500 kB, largest ghostty-web-Ch-lxWIv.js 1,379.62 kB;
    • unused Agent and getGlobalDispatcher in Effect Platform Undici;
    • discouraged eval in gray-matter and web-tree-sitter.
• Candidate cutover artifacts
  • /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service
  • /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md
  • CUTOVER.md preflight now explicitly requires:
    • production healthy on 4096;
    • candidate version/revision;
    • isolated API/UI;
    • both plugins active;
    • private password environment file;
    • at least 10 PTY smoke runs;
    • in-process execution as byk;
    • no root helper/supervisor/readiness marker;
    • process-group cleanup checks;
    • fresh independent reviews;
    • systemd-analyze verify.
  • Cutover:
    • install separate opencode-v2.service;
    • daemon-reload;
    • stop legacy unit;
    • start candidate;
    • verify health/UI/PWA/OpenAPI/plugins;
    • run one follow-up and one PTY smoke;
    • only then enable V2.
  • Rollback:
    1. Stop opencode-v2.service.
    2. Start opencode.service.
    3. Verify legacy health/UI on 4096.
    4. Disable V2 only after legacy health is confirmed.
  • V2 database remains isolated under: /home/byk/.local/share/opencode-v2-pilot/data.
  • Rollback never rewrites or deletes either database.
• Historical abandoned root-supervisor work
  • A Go supervisor/client/launcher was developed and repeatedly reviewed under: /home/byk/.local/share/opencode-v2-pilot/supervisor/.
  • It implemented systemd transient units, pidfd/InvocationID authentication, SCM_RIGHTS cwd transfer, bounded protocol, cgroup cleanup, hardening, reproducible static binaries, and extensive source tests.
  • Reviews found successive blockers involving systemd interface ownership, signal trust, supplementary groups, same-UID delegation, complete runtime content binding, exact Node SEA inheritance, lifecycle/backpressure, and mandatory root-host acceptance.
  • The final source-level supervisor manifest recorded before abandonment was: fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f.
  • Historical post-fix binary hashes:
    • supervisor: ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2
    • launcher: d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd
    • client: fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde
  • No privileged acceptance, installation, service operation, or production change ever occurred.
  • These artifacts are dormant and not part of current acceptance.

Session Timeline

• Sep 8, 2026 01:02–03:08
  • Rebasing/building baseline:
    • v2-pilot advanced to 2ac698d65a.
    • Integrated Node SEA server, authenticated API, UI/PWA, OpenAPI, CSP, and isolated database were verified.
    • Follow-up plugin was ported and tested.
    • Legacy/Bun PTY backend was rejected after Node SEA type-stripping failures.
    • Direct Node script(1) PTY was implemented.
    • Canonical Promise permission.assert bridge was added.
    • First rounds of PTY ownership, permission, cwd, environment, regex, resource, notification, and lifecycle hardening completed.
• 03:23–03:28
  • Independent PTY security/correctness reviews returned blockers:
    • write/kill lacked canonical leaf assertions;
    • saved grants treated command text as wildcard policy;
    • spawn capacity was non-atomic;
    • deletion/unload races could admit late processes;
    • process-group cleanup could not contain escaped descendants;
    • cwd/object TOCTOU remained;
    • XML-like synthetic output allowed control-looking injection;
    • regex concurrency was unbounded;
    • Promise typed-error semantics were incomplete;
    • process closure was coupled to notification delivery;
    • fast-close and line/UTF-8 accounting issues remained.
• 03:31–04:05
  • Direct PTY was hardened:
    • exact write/kill assertions;
    • save: [];
    • atomic reservations;
    • in-flight deletion handling;
    • cwd fd binding;
    • pre-spawn close listener;
    • separate close/notification completion;
    • JSON envelopes;
    • UTF-8/argv limits;
    • bounded regex workers and cleanup.
  • Promise adapter error-channel fixes and four-outcome regression added.
  • Core suite reached 19 pass, 65 expect() calls.
• 04:15–08:40
  • A stronger root-owned per-PTY systemd supervisor was designed and implemented in isolated files.
  • Multiple independent reviews repeatedly returned DO-NOT-MERGE, identifying authentication, systemd-interface, cleanup, backpressure, descriptor, hardening, supplementary-group, content-binding, exact-host, and integration blockers.
  • Successive source-level fixes were made and tested, but root-host acceptance never occurred.
  • No root installation or service change was made.
• 09:31–09:40
  • Assistant explained the custom PTY’s narrow interactive use.
  • User rejected the stronger root model and required parity with existing unprivileged production.
  • Inspection confirmed production already runs opencode-pty@0.3.6 and shell children as byk without a root supervisor.
  • User approved restoring the V2 direct in-process PTY and accepting escaped-descendant cleanup as outside the trust model.
• 11:34–12:10
  • Two delegated attempts returned empty reports.
  • Direct inspection found the approved reversal already present:
    • pty-transport.ts absent;
    • direct script(1) backend active;
    • candidate unit/cutover no longer required root infrastructure.
  • Persistent suite had 5 tests; two missing regressions were identified:
    • stalled startup deadline;
    • malformed-Unicode identity.
• 17:37–17:45
  • Baseline 5-test suite passed under Bun 1.3.14.
  • Fail-first tests demonstrated both defects:
    • expected "PTY process startup timed out." but startup remained pending;
    • malformed `/bin/echo\uD800` was accepted.
  • Added Unicode validation and startup timeout/late-process cleanup.
  • Suite passed 9/9.
• 17:45–17:54
  • Removed misleading empty SupplementaryGroups=.
  • Documented actual byk groups and process-group trust limit.
  • Found and fixed cwd authorization race by opening/pinning before permission.
  • Caught and corrected accidental duplicate PTY opener and stale variable.
  • Suite again passed 9/9.
• 17:55–18:03
  • Expanded persistent suite through limits, timeout, cleanup, line paging, atomic admission, and deletion-during-spawn.
  • Corrected scheduler-sensitive and CRLF test assumptions.
  • Final suite reached 14 pass, 33 expect() calls.
  • Ten Bun 1.3.14 runs passed: 140 tests total.
• 18:04–18:10
  • Plugin/Core typechecks passed.
  • Core Promise bridge suite passed 19/19.
  • Active candidate files were confirmed free of supervisor dependencies; dormant supervisor directory remained excluded.
  • Pinned Bun 1.4.2 was restored to /tmp/opencode.
• 18:12–18:20
  • Bun 1.4.2 exposed a real timeout cleanup-order race: Session status became killed before the process group disappeared.
  • Initial fix produced TS2304: Cannot find name 'notify'; notification behavior was explicitly threaded through termination/removal instead of widening module state.
  • Final lifecycle source passed under both Bun 1.4.2 and 1.3.14.
  • Ten final Bun 1.4.2 runs passed: 140 tests total.
• 18:20–18:24
  • Built fresh dist-v2-pilot-byk with Bun 1.4.2 and Node 26.4.0.
  • Web/PWA, SSR, SEA generation, artifact verification, --help, and --version all succeeded.
  • New version: opencode2-node v0.0.0-v2-pilot-202609081820.
  • Next step is isolated runtime/plugin/PTy verification on an unused loopback port, followed by independent exact-source reviews.