Dashboard › opencode › Distillation
4de7885b-3be7-4327-a6ce-68a81f884f62["lore_tm_v1_qUOFeAw5bs9mtfvI0CRaKGGAclOyleOgMSIrVHYrzto"]
Date: Sep 8, 2026
internal/supervisor/systemd.go constants: clientService = "opencode-v2.service", supervisorService = "opencode-pty-supervisor.service", ptySlice = "opencode-pty.slice", expectedClientCgroup = "/system.slice/opencode-v2.service", launcherPath = "/usr/local/libexec/opencode-pty-launcher", unitPrefix = "opencode-pty-", unitSuffix = ".service", operationTimeout = 5 * time.Second, stopTimeout = 15 * time.Second, outputDrainTimeout = 2 * time.Second, defaultRuntimeSec = 3600, perSessionMemoryMax = 512 * 1024 * 1024, perSessionMemoryHigh = 384 * 1024 * 1024, and perSessionTasksMax = 64; valid generated units must match ^opencode-pty-[0-9a-f]{32}\.service$ (systemd.go:17-34).unitManager exposes ClientState(context.Context), Start(context.Context, string, protocolCommand, *os.File, *os.File, uint32), StopAndWait(context.Context, string), Wait(context.Context, string), CleanupOrphans(context.Context), and Close(); protocolCommand contains exact fields Command string and Args []string (internal/supervisor/systemd.go:50-62).NewSystemdManager() connects to systemd with systemddbus.NewSystemConnectionContext under the 5-second operationTimeout; Close() closes the systemd connection (internal/supervisor/systemd.go:64-80).systemdManager.ClientState() reads unit and Service properties for opencode-v2.service, strictly type-checks MainPID as uint32, ActiveState, SubState, and ControlGroup as strings, and InvocationID as exactly 16 bytes; it returns a copied InvocationID to avoid aliasing (internal/supervisor/systemd.go:82-112).systemdManager.Start() invokes StartTransientUnitContext with job mode "fail" and a buffered result channel, all under operationTimeout; waitForJobResult() accepts only the exact job result "done", rejects a closed result channel or any other result, and returns the context error on timeout/cancellation (internal/supervisor/systemd.go:114-137).systemdManager.Wait() subscribes to unit signals before querying state, then repeatedly reads ActiveState and SubState; it considers ActiveState == "failed", SubState == "exited", or ActiveState == "inactive" terminal, fetches Service properties, and decodes Result, ExecMainCode, and ExecMainStatus. Otherwise it waits for another D-Bus signal; a closed or nil signal channel is an error (internal/supervisor/systemd.go:139-178,412-425).systemdManager.StopAndWait() first rejects names not matching unitPattern, then uses a 15-second timeout derived from context.WithoutCancel(ctx) so caller cancellation does not interrupt cleanup. It subscribes before calling StopUnitContext(name, "replace", result) and treats org.freedesktop.systemd1.NoSuchUnit during subscription or stopping as successful cleanup (internal/supervisor/systemd.go:180-200,428-435).UnitRemoved signal; the stop job result alone does not return success. Closed signal and stop-result channels or non-"done" job results are retained as diagnostics while waiting. On timeout, StopAndWait() performs a fresh 5-second background GetUnitPropertiesContext: a final NoSuchUnit means success, while an existing unit produces an error containing final ActiveState and ControlGroup plus stop/signal diagnostics (internal/supervisor/systemd.go:201-237).subscribeUnitSignals() directly dials /run/dbus/system_bus_socket, creates a godbus/dbus connection, bounds Auth(nil) plus Hello() initialization by operationTimeout, calls org.freedesktop.systemd1.Manager.Subscribe, and installs two matches: PropertiesChanged on the escaped unit object path and UnitRemoved on /org/freedesktop/systemd1 filtered by argument 0 equal to the unit name. Signals are delivered through a channel buffered to 8 (internal/supervisor/systemd.go:239-296).CleanupOrphans() lists units matching opencode-pty-*.service under a 5-second call timeout, skips names failing validUnitName(), then reads each candidate’s properties and stops only units whose BindsTo is exactly a one-element []string{"opencode-pty-supervisor.service"}. Any property-read or cleanup failure aborts startup cleanup, with stop failures wrapped as clean orphan <unit>: ... (internal/supervisor/systemd.go:298-322).unitProperties() constructs ExecStart as /usr/local/libexec/opencode-pty-launcher followed by the command and each argument independently encoded as "a" + base64.RawURLEncoding.EncodeToString([]byte(value)); a requested runtimeSec of 0 becomes defaultRuntimeSec = 3600 seconds (internal/supervisor/systemd.go:341-351)."OpenCode PTY " + name, type "exec", slice opencode-pty.slice, BindsTo=opencode-pty-supervisor.service, After=opencode-pty-supervisor.service, User="byk", Group="byk", empty SupplementaryGroups, UMask=0077, KillMode="control-group", KillSignal=15, FinalKillSignal=9, SendSIGKILL=true, TimeoutStopUSec=15 seconds, OOMPolicy="kill", Delegate=false, RemainAfterExit=true, and CollectMode="inactive" (internal/supervisor/systemd.go:352-374).stream fd to StandardInputFileDescriptor and StandardOutputFileDescriptor, while mapping the cwd directory fd to StandardErrorFileDescriptor (internal/supervisor/systemd.go:375-377).NoNewPrivileges=true, zero CapabilityBoundingSet, zero AmbientCapabilities, PrivateDevices=true, DevicePolicy="closed", PrivateTmp=true, PrivateMounts=true, ProtectControlGroups=true, ProtectKernelTunables=true, ProtectKernelModules=true, ProtectKernelLogs=true, ProtectClock=true, ProtectProc="invisible", ProcSubset="pid", RestrictNamespaces=0, RestrictSUIDSGID=true, and LockPersonality=true (internal/supervisor/systemd.go:362-364,378-391).AF_UNIX, AF_INET, and AF_INET6; SystemCallArchitectures=[]string{"native"}; syscall denylist @clock, @cpu-emulation, @debug, @module, @mount, @obsolete, @privileged, @raw-io, @reboot, and @swap; inaccessible paths /run/opencode-pty, /run/dbus/system_bus_socket, /run/docker.sock, /run/user/1000/bus, and /var/run/docker.sock (internal/supervisor/systemd.go:392-395).CPUAccounting, MemoryAccounting, TasksAccounting, and IOAccounting; set CPUQuotaPerSecUSec to 500*time.Millisecond/time.Microsecond (50% of one CPU), MemoryHigh to 384 * 1024 * 1024, MemoryMax to 512 * 1024 * 1024, TasksMax to 64, and RuntimeMaxUSec to the selected runtime in seconds converted to microseconds (internal/supervisor/systemd.go:396-405).decodeUnitResult() requires Service property Result to be a string and both ExecMainCode and ExecMainStatus to be int32; validUnitName() applies unitPattern, and isNoSuchUnit() recognizes only D-Bus errors named org.freedesktop.systemd1.NoSuchUnit (internal/supervisor/systemd.go:412-435).