Dashboard › opencode › Distillation
9697dcf5-ae1f-4e18-9979-1b24e60f8405["lore_tm_v1_feThVSapWcHBoDY2LKYjqhoMwZxwfby5FHu0xLePLdA","lore_tm_v1_WQG2ox2682OLQe-rOPk0CowQDdKnNU858O6J6YOhbHU","lore_tm_v1_HhdPF9FPMvVD89mtflHJVnHWKKDg5EtqNMntUdh52k4","lore_tm_v1_cEqA6YUGwQ3UNEZRm5dyHjXBTSMWg1z3BBD0VCMDXMs","lore_tm_v1_Sr2ptIJN5OY_Ic4j5mBi49djDB1Sy42Sk2UC7m9qDSI","lore_tm_v1_I0-kOSxo6-x6H1Z7H5tZdqs04uOUiTRmmmfqSCMm_qo","lore_tm_v1_QH5Bhmft5KHPTGYFBrJUe_vy3iEOiRAstYLene91Yqg","lore_tm_v1_bM7OygNrvZBmiGrX_P0do_p8AKuePvvJXtLzB-SBzpM","lore_tm_v1_uxj6LSPg7AJPWsooMywrEYeyBjsLLNq6jNdvJwCjhV0","lore_tm_v1_kt2g_zaJCJBoGNu-UHOE6Sfj01i2Sj1LD5E9DPacUdA","lore_tm_v1_yvYT5LZeIXYK53TVKDuSHp3-IxQ-jIFHWCWrV7K23W0","lore_tm_v1_H_jQGT-662bKc6xfoxizpdtE_IDOs-iyGvd1YPwMdOI"]
Date: Sep 17, 2026
packages/client/src/generated/types.ts generated event union defines "session.next.prompt.admitted" data with timestamp, sessionID, messageID, a prompt containing text plus optional files (uri, mime, optional name, description, source) and agents (name, optional source), delivery: "steer" | "queue", and optional requestExecution.packages/client/src/generated/types.ts also defines generated events: "session.next.prompt.execution_requested" (timestamp, sessionID, messageID); "session.next.context.updated" and "session.next.synthetic" (each adds text); "session.next.shell.started" (messageID, callID, command); and "session.next.shell.ended" (callID, output).packages/client/src/generated/types.ts: "session.next.step.started" includes assistantMessageID, agent, model { id, providerID, variant? }, and optional snapshot; "session.next.step.ended" includes assistantMessageID, finish, cost, token counts for input, output, reasoning, and cache read/write, plus optional snapshot and files; "session.next.step.failed" and "session.next.step.interrupted" include unknown errors with message; "session.next.step.recovered" includes executionID, optional assistantMessageID, and phase: "ready" | "unknown" | "continue".packages/server/src/middleware/session-location.ts defines SessionLocationMiddleware, which provides LocationServices and can fail with InvalidRequestError or SessionNotFoundError. It decodes route.params.sessionID using SessionV2.ID; malformed IDs map to InvalidRequestError({ message: "Invalid session ID", field: "sessionID" }).sessionLocationLayer reads SessionTable.directory and SessionTable.workspace_id by session ID. Database defects die via Effect.orDie; a missing row produces SessionNotFoundError({ sessionID, message: \Session not found: ${sessionID}` }); otherwise it provides locations.get(Location.Ref.make({ directory: AbsolutePath.make(row.directory), workspaceID: row.workspaceID ? WorkspaceV2.ID.make(row.workspaceID) : undefined }))`.packages/core/src/session/execution.ts defines SessionExecution.Interface: active snapshots process-owned active SessionSchema.IDs; resume(sessionID) starts idle execution or joins active execution and may fail with SessionRunner.RunError; wake(sessionID) registers newly recorded work with possible wake coalescing; interrupt(sessionID) interrupts process-owned active work and is a no-op while idle.SessionExecution.Service is tagged "@opencode/v2/SessionExecution" and routed through LayerNode.unbound(Service, Node.tags.values.global). Its low-level compatibility noopLayer reports an empty active set and makes resume, wake, and interrupt no-ops.packages/server/src/handlers/sync.ts did not exist and a follow-up search found no files; the sync handler was subsequently located at packages/opencode/src/server/routes/instance/httpapi/handlers/sync.ts.packages/opencode/src/server/routes/instance/httpapi/handlers/sync.ts defines start, replay, steal, and history handlers. start calls workspace.startWorkspaceSyncing((yield* InstanceState.context).project.id), ignores its result, forks it in the request scope, and returns true.SyncHttpApi.replay maps incoming events to EventV2.SerializedEvent[] with id, aggregateID, seq, type, and copied data; takes source from payload[0].aggregateID; logs request/completion metadata (sessionID, event count, first/last sequence, and initially directory); calls events.replayAll(payload, { ownerID, strictOwner: true }); and returns { sessionID: source }.SyncHttpApi.steal obtains InstanceState.workspaceID, returns HttpApiError.BadRequest if absent, calls session.setWorkspace({ sessionID: ctx.payload.sessionID, workspaceID }), logs "sync session stolen", and returns the stolen session ID.SyncHttpApi.history treats ctx.payload as aggregate-ID/sequence exclusions, selects from EventTable, excludes each aggregate’s events through its supplied sequence via not(or(...and(eq(EventTable.aggregate_id, id), lte(EventTable.seq, seq)))), applies no where condition when exclusions are empty, orders by asc(EventTable.seq), and converts database failures to defects with Effect.orDie.packages/opencode/src/server/routes/instance/httpapi/middleware/authorization.ts sets AUTH_TOKEN_QUERY = "auth_token", UNAUTHORIZED = 401, and WWW_AUTHENTICATE = 'Basic realm="Secure Area"'. A comment rejects HttpApiSecurity alternatives because downstream failures can trigger the next security alternative and remap an authorized NotFound into Unauthorized.Authorization and PtyConnectAuthorization, each failing with HttpApiError.UnauthorizedNoContent. Credentials come first from the auth_token query parameter, otherwise from a case-insensitive Basic authorization header; base64 decode failure or decoded text without : yields empty username/password, while valid text splits only at the first :.validateCredential bypasses checks when ServerAuth.required(config) is false; unauthorized API credentials append a pre-response www-authenticate header and fail with HttpApiError.Unauthorized. validateRawCredential instead returns an empty HTTP 401 response with that header.authorizationRouterMiddleware bypasses auth when not required and for isPublicUIPath(request.method, url.pathname); otherwise it validates query/header credentials. authorizationLayer validates all requests when required. ptyConnectAuthorizationLayer additionally allows URLs accepted by hasPtyConnectTicketURL(url) before credential validation.PRAGMA busy_timeout = 5000 in packages/core/src/database/database.ts:29, plus optional timeout?: number and timeout: config.timeout in packages/core/src/database/sqlite.node.ts at lines 36 and 153.packages/core/src/database/database.ts initializes SQLite with, in order: PRAGMA journal_mode = WAL, PRAGMA synchronous = NORMAL, PRAGMA busy_timeout = 5000, PRAGMA cache_size = -64000, PRAGMA foreign_keys = ON, PRAGMA wal_checkpoint(PASSIVE), then DatabaseMigration.apply(db); initialization failures die through Effect.orDie.Flag.OPENCODE_DB uses ":memory:" or an absolute path verbatim, otherwise resolves relative to Global.Path.data; channels "latest", "beta", and "prod" or OPENCODE_DISABLE_CHANNEL_DB equal to "1"/"true" use opencode.db; other channels use opencode-${InstallationChannel.replace(/[^a-zA-Z0-9._-]/g, "-")}.db.settle declarations/uses in packages/core/src/tool/tool.ts and packages/core/src/tool/registry.ts, including ToolRegistry.settle, the call to settle(registration.tool, ...), and the materialized settle closure.packages/core/src/tool/registry.ts defines ExecuteInput with sessionID, agent, assistantMessageID, and call; Materialization with definitions and settle; and Settlement with mandatory result, optional output, and optional outputPaths.ToolRegistry.settleWith resolves the newest scoped local registration first, then ApplicationTools. A missing registration returns Stale tool call: ${input.call.name} when an advertised identity exists, otherwise Unknown tool: ${input.call.name}; an advertised identity mismatch also returns a stale-tool error.{ sessionID, agent, assistantMessageID, toolCallID: input.call.id } to settle. LLM.ToolFailure is converted to an error result containing failure.message; successful output is bounded through ToolOutputStore.Service.bound, converted with ToolOutput.toResultValue, and includes outputPaths only when nonempty. Error result values omit output but may retain nonempty outputPaths; non-error results retain bounded output.ToolRegistry.register validates every tool name, then uninterruptibly pushes scoped registrations using a shared token and distinct identity objects. Its scope finalizer removes only registrations carrying that token and deletes a tool’s map entry when no registrations remain.ToolRegistry.materialize starts with application registrations, overlays each local tool’s newest registration, and removes tools for which whollyDisabled(...) finds the last wildcard-matching permission rule with resource === "*" and effect === "deny". Materialized settlement is identity-fenced: registered names call settleWith(input, registration.identity), while absent names return Unknown tool: ${input.call.name}.node provides ToolRegistry.Service and toolsNode provides Tools.Service; both use the same layer and depend on ApplicationTools.node and ToolOutputStore.node.resume: false in packages/core/test/session-runner.test.ts returned at least 100 matches and was truncated, showing broad admit-without-auto-resume coverage across provider fencing, publication fencing, local tools, context ordering, failure/defect handling, interruption, steering, recovery, correlated/child requests, and multi-session execution.