Dashboard › opencode › Distillation
7ec3b3ec-8c66-4c16-800a-306e9f184752["lore_tm_v1_hY9pxJwCvGMqmFRxaOmmmsluku38ixu1OF0d5A00iC4","lore_tm_v1_QCHg7u0yAL6iOARL8mfrAOTTWcXrPGDP-1rWksUXFLI","lore_tm_v1_9hqfl6cJ_AvQmwXFxyrIs2M5WtVp5Ed8nHcRpM6lqBE","lore_tm_v1_4Co3oDYMtUmt346ZmlsAkp7AoS_6N9LYyDvaPZ7xSUE","lore_tm_v1_WaJYky3uy5UUpeJFleZa_EKRg9Ay8dqgWz6qUMqj1E4","lore_tm_v1_fD-J1itVjzGn0MXc-vw2_fo_tVyRO9xTtubgw8b1JXM","lore_tm_v1_MLL4bI594sHvF5HSfpDp2SxcX7limWhOTbIDej5PTz8","lore_tm_v1_zeE2qw2fMBO3s6YdCiuQ2DIPCcETGm5HXc3-SkUwxFA","lore_tm_v1_d-Ar8cPPeLwTuzx-XY5s37-SD-W5czD04GTgiWWtpZI","lore_tm_v1_N5SnSJ4zN-j_9ASVFK0rECQlzWs2w9gTW5TBtfi9zbg","lore_tm_v1_1G9VfOBXPQqT51R-cVSaJHxWaszbCff2o6YJ6LEg75M","lore_tm_v1_ah27vf1Oi2hG2bTkrBf_8Bwv2ulcqJKoozBdOpLOnAA","lore_tm_v1_mKtE3GFs7HEXolFjWO2fovdscfgmz3oeGncWyt-cVbo","lore_tm_v1_0lR3QZC9VCY1ZG6mq2oSkh-HV_g54wBKuccN8GAz_O0","lore_tm_v1_9lmiMbwHnXRm1MymBN3B_yq7NNNR-f04n2TaU3UsIl8","lore_tm_v1_mqOIKr1rfr7bGJ45R-L3tASrltW2vC1CEiQyWORpWck","lore_tm_v1_IC3EEP_xJvpw8dCivkIQCt-qdNRg9INuIEbIodC-MWM","lore_tm_v1_nCFXwlICjkTm2fFNKA1VGBmRlpnHNEUqZluHxzWatKw","lore_tm_v1_L5CTxgOIoBDUjmLEDie80gXPVTuHO4QzOMTWss70wq4","lore_tm_v1_TmmDAgJfjtU2QhlBs_vdMSH7tYtVkXjLScgp38aZXWc","lore_tm_v1_RJ8SaVm8Po_40A_RXkKLlZ47KF2nCi2-VeC4XD5iLyM","lore_tm_v1_HToelmUwdx8zR4grJzPO_gUagRKwYSaFaBVk80RwSw4"]
cmd/client in 0.205s, cmd/supervisor had no test files, cmd/launcher in 1.112s, internal/protocol in 0.004s, and internal/supervisor in 3.713s. Second run: cmd/supervisor had no test files, cmd/client in 2.232s, cmd/launcher in 1.988s, internal/protocol in 1.020s, and internal/supervisor in 4.742s. Output included hash c03f8a6fb5b96be06bcf97784b0b1dbe3636c238f7a4cea803081ac01bf28ee1.bin/opencode-pty-supervisor = c4df4d5074517fd9a1dc0b29578c4916b288fa5607d3787efa792ed40e6c1307; bin/opencode-pty-launcher = d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd; bin/opencode-pty-client = fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde.Internal error: directory mismatch for directory "/tmp/opencode/pty-smoke-tsconfig.json", fd 4. No action was requested in that turn./home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts found stopTimeoutMs?: number, MAX_BUFFER_SIZE = 1_000_000, pendingOutputBytes accounting/trimming, reset at line 208, close() at line 218, and supervisor-stop timeout handling at line 227 using options.stopTimeoutMs ?? STOP_TIMEOUT_MS. /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts imports MAX_BUFFER_SIZE, retains the final MAX_BUFFER_SIZE characters in session buffers, and only collects grep stdout while stdoutSize <= MAX_BUFFER_SIZE * 2./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go lines 442–496. receiveExact(connection, destination, fds) allocates ancillary storage with unix.CmsgSpace((maxStartDescriptors+1)*4), receives through receiveMessage, parses each control message with unix.ParseOneSocketControlMessage and unix.ParseUnixRights, appends descriptors, and returns protocol.ErrInvalidFrame for trailing control bytes, more than 1 accumulated FD, zero-byte reads, unix.MSG_TRUNC, or unix.MSG_CTRUNC. receiveMessage uses connection.SyscallConn(), raw.Read, and unix.Recvmsg(..., unix.MSG_CMSG_CLOEXEC), retrying unix.EAGAIN/unix.EWOULDBLOCK./home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts lines 400–529. Plugin teardown sets closing = true, aborts events, then applies withTimeout(..., CLOSE_TIMEOUT_MS, "PTY plugin cleanup timed out.") to Promise.allSettled over pendingSpawns, all session removals, and pendingNotifications; rejected cleanup entries are logged. Helpers include result, requireSession, lineCount, lastNonblankLine, linePage, truncate, decodeEscapes, and shellCommand. terminate(session) sets status "killing", closes the transport with a CLOSE_TIMEOUT_MS timeout, then requires waitForClose(session.closed, CLOSE_TIMEOUT_MS) or throws PTY ${session.id} supervisor cleanup timed out..withTimeout<T> in /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts lines 596–610: it starts an unref’d timer that rejects with new Error(message), and clears the timer on either fulfillment or rejection of the wrapped promise. matchingLines starts /usr/bin/grep with arguments ["-a", "-m", String(limit), "-nE", ...(ignoreCase ? ["-i"] : []), "--", pattern]./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go lines 510–604. Unix socket creation applies mode 0660; socketPair() creates AF_UNIX SOCK_STREAM|SOCK_CLOEXEC descriptors and sets both SO_SNDBUF and SO_RCVBUF to socketBufferSize; randomUnitName() reads 16 random bytes; encodeExit() stores ExecMainCode, big-endian ExecMainStatus, result length, and result bytes; boundedError() truncates to protocol.MaxIOPayloadSize while retaining valid UTF-8; writeAll() detects zero-byte writes as io.ErrShortWrite; closeFDs() closes every FD; and frameWriter.write() serializes writes with a mutex and applies operationTimeout when its writer supports SetWriteDeadline.systemd-analyze security reported opencode-pty-supervisor.service exposure 0.9 SAFE :-). Its protections included system-call deny groups @swap, @resources, @reboot, @raw-io, @privileged, @obsolete, @mount, @module, @debug, @cpu-emulation, and @clock; NoNewPrivileges, empty ambient capabilities, native-only syscall ABI, strict ProtectSystem, PrivateNetwork, PrivateTmp, ProtectHome, PrivateDevices, ProtectControlGroups, ProtectProc, ProcSubset, ProtectClock, ProtectKernelLogs, ProtectKernelModules, PrivateMounts, MemoryDenyWriteExecute, namespace restrictions, address-family restrictions, RestrictSUIDSGID, and restrictive UMask. Reported residual exposures included host root directory 0.1, root user 0.4, AF_UNIX access 0.1, other-user access via PrivateUsers 0.2, char-rtc:r device ACL 0.1, and no IP allow list 0.2.systemd-analyze security reported opencode-v2.service exposure 8.4 EXPOSED :-(. Existing protections included static non-root User, NoNewPrivileges, empty AmbientCapabilities and SupplementaryGroups, strict ProtectSystem, PrivateTmp, KeyringMode, nondelegated control groups, NotifyAccess, and PrivateMounts. Major missing protections included capability bounding, PrivateDevices, clock/kernel/control-group/module protections, syscall architecture/filtering, writable-executable-memory denial, namespace restrictions, address-family restrictions, PrivateNetwork, process-tree restrictions, ProtectHome beyond read-only, and restrictive UMask./home/byk/.local/share/opencode-v2-pilot/opencode-v2.service. Unit configuration: description OpenCode V2 Server; After=network.target opencode-pty-supervisor.service; Requires=opencode-pty-supervisor.service. Service configuration: Type=simple; environment files /home/byk/.opencode/env and /home/byk/.local/share/opencode-v2-pilot/server.env; OPENCODE_CONFIG_DIR=/home/byk/.local/share/opencode-v2-pilot/config/opencode; OPENCODE_DB=/home/byk/.local/share/opencode-v2-pilot/data/opencode/opencode.db; XDG_DATA_HOME=/home/byk/.local/share/opencode-v2-pilot/data; XDG_CACHE_HOME=/home/byk/.local/share/opencode-v2-pilot/cache; XDG_CONFIG_HOME=/home/byk/.local/share/opencode-v2-pilot/config; XDG_STATE_HOME=/home/byk/.local/share/opencode-v2-pilot/state; User=byk; WorkingDirectory=/home/byk; ExecCondition=/usr/local/libexec/opencode-pty-verify-readiness; ExecStart=/home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node serve --hostname=0.0.0.0 --port=4096; Restart=always; RestartSec=5; Nice=-5; LimitNOFILE=65535; LimitNPROC=4096; MemoryMax=13G; MemoryHigh=12G; NoNewPrivileges=true; ProtectSystem=strict; ProtectHome=read-only; ReadWritePaths=/home/byk; PrivateTmp=yes; empty SupplementaryGroups; and WantedBy=multi-user.target./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go lines 430–504. TestUnauthenticatedAdmissionHasSeparateBoundedQuotaAndRate verifies maxAdmissionsPerMinute, bounded admission history, maxUnauthenticated, and exactly one reserved MainPID admission beyond ordinary capacity. TestOnlyCachedMainPIDReceivesReservedAdmission verifies the current process receives reserved admission, os.Getpid()+1 does not, and cached identity causes exactly 1 D-Bus-equivalent query. TestWatchDisconnectHonorsCancellation requires context.Canceled; TestCopyOutputPreservesDataBeforeEOF begins at line 498./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go failed because the expected text for TestWaitForUnitSignalRejectsClosedChannelAndHonorsTimeout did not match the file; the actual assertion text was closed signal channel was accepted, not accepted a closed signal channel./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go lines 25–59. TestWaitForUnitSignalRejectsClosedChannelAndHonorsTimeout rejects a closed chan *dbus.Signal and expects context.DeadlineExceeded for a 1ms timeout. TestWaitForJobResultRejectsClosedNonDoneAndTimeout rejects a closed channel, rejects result "canceled" for operation "start", and expects context.DeadlineExceeded under a 1ms timeout./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go.133b0c3e7509f578edcbddb728d6b774492e93f3fbf027954c007c1d370eefe9./home/byk/.local/share/opencode-v2-pilot/supervisor/verify-readiness.cmd/client in 0.213s, cmd/supervisor had no test files, cmd/launcher in 1.101s, internal/protocol in 0.003s, and internal/supervisor in 3.696s. Second run: cmd/supervisor had no test files, cmd/client in 2.182s, cmd/launcher in 2.018s, internal/protocol in 1.020s, and internal/supervisor in 4.773s. Output confirmed hash 133b0c3e7509f578edcbddb728d6b774492e93f3fbf027954c007c1d370eefe9.