Dashboard › opencode › Distillation
a3f5a6b9-e28d-478e-8f67-f42608aef394["lore_tm_v1_iA5Ft__YIexQmmVU2Dlvc2wEUjqD0aTLQ9Ncu1iC5ts","lore_tm_v1_HUarRGe0SCe6pNx6jzSlfCcDuabE78vFaE7p_5wdB8Q","lore_tm_v1_369i-u_JJFZWPZuoyjTm_ctDgc6EkO3_wbvXXPlM9Xs","lore_tm_v1_PRv7gZxj-C_5gxkcwExip-sJju-wn60ncX4zrWlyfwo","lore_tm_v1_Sd8c8Xo03e48hgWm6y1yrUdhBNTZEouTla0Pmp1xxE8","lore_tm_v1_dRm5nL1ArHk95jYP0qwOM_TsmaImey42vB02QmSm5Yw","lore_tm_v1_iq4QB3H6zyWQi3zOvp-LtvRvAd6ZQe6J1QAoy3gOjgI","lore_tm_v1_j0PWqdZOvW_swb7aSshB-R4HRrN0cZdSC61DI8Ruib0","lore_tm_v1_1PqeQBvg9_YJLJmR-Asf9jkWAOIS-n_wf91OarPh5Ic","lore_tm_v1_cEXsgo6DKl4vccWoWYQaIIsFQy9-JP12hPU2PeVfMMw","lore_tm_v1_aiaUCx1Le-moIeEaEMCFdCskE-HumkDuK_LXadimDEQ","lore_tm_v1_GEwlPeZPWlS-WazAm6LhFLzwAYWc6BNr--UTY5Q0g-o","lore_tm_v1_nlJuN24jDt7kOBh6LNRVJ6Bw8Y2RGNyyKvA_fhWmKg8","lore_tm_v1_f7RHyxBOZFb7I8DxhVEQ6GSlQieM3xl274ZgFja-gQg","lore_tm_v1_7by1lJVId0nt9FitHaUo-X0c9XOQB4neLx4L9L5bjVc"]
Date: September 8, 2026
internal/protocol/frame_test.go contains 5 tests plus 1 fuzz target: TestStartRoundTrip, TestFrameRoundTrip, TestRejectsOversizedFrame, TestRejectsNULArgument, FuzzParsePacket.TestStartRoundTrip verifies EncodeStart/DecodeStart preserve Start{Device: 12, Inode: 34, RuntimeSec: 60, Args: []string{"printf", "%s", "hello world"}}; argument equality is checked by joining with "\x00".TestFrameRoundTrip verifies WriteFrame/ReadFrame preserve Frame{Type: TypeInput, Payload: []byte("hello")}.TestRejectsOversizedFrame requires MarshalFrame(Frame{Type: TypeInput, Payload: make([]byte, MaxFrameSize+1)}) to return ErrFrameTooLarge.TestRejectsNULArgument encodes Start{Args: []string{"a\x00b"}} and requires DecodeStart to return ErrInvalidFrame.FuzzParsePacket seeds fuzzing with a marshaled TypeInput frame whose payload is "seed", then calls ParsePacket(value) for arbitrary []byte.cmd/launcher/main.go defines maxArgs = 128 and maxArgSize = 4096; decodeCommand rejects zero arguments, more than 128 arguments, malformed grammar, noncanonical URL-safe unpadded base64, decoded arguments over 4096 bytes, and decoded NUL bytes.cmd/launcher/main.go requires each encoded argument to use grammar a[A-Za-z0-9_-]*; it decodes the suffix with base64.RawURLEncoding, verifies canonical re-encoding, wraps every decoded argument in single quotes, escapes embedded ' as '\'', and joins arguments with spaces.cmd/launcher/main.go function run decodes the command, calls syscall.Fchdir(2) to enter the approved cwd, calls syscall.Dup2(1, 2) to replace the cwd descriptor with stdout, clears the environment, and executes /usr/bin/script using []string{"script", "-qefc", command, "/dev/null"}.HOME=/home/byk, LANG=C.UTF-8, LOGNAME=byk, PATH=/usr/local/bin:/usr/bin:/bin, TERM=xterm-256color, and USER=byk.cmd/launcher/main_test.go contains 3 tests: TestDecodeCommandQuotesEveryArgument, TestDecodeCommandRejectsInvalidGrammar, and TestLauncherExecutesInDescriptorDirectory.TestDecodeCommandQuotesEveryArgument encodes "printf", "%s\\n", "a'b; $(id)", and "", then expects the exact decoded command 'printf' '%s\n' 'a'\''b; $(id)' '', preserving the shell metacharacters as quoted data.TestDecodeCommandRejectsInvalidGrammar requires decodeCommand([]string{"bad="}) to fail.TestLauncherExecutesInDescriptorDirectory opens t.TempDir(), passes its descriptor as child stderr, sets OPENCODE_LAUNCHER_HELPER=1, launches encoded /usr/bin/pwd, and verifies output contains the temporary directory followed by "\n" after stripping "\r".cmd/supervisor/main.go creates a context canceled by SIGINT or SIGTERM, initializes supervisor.NewSystemdManager(ctx), defers manager.Close(), and serves with supervisor.NewServer(manager).Serve(ctx); initialization or serving errors are printed to stderr and exit with status 1.opencode-pty-supervisor.service defines After=dbus.service, Requires=dbus.service, Type=exec, User=root, Group=byk, ExecStart=/usr/local/libexec/opencode-pty-supervisor, RuntimeDirectory=opencode-pty, RuntimeDirectoryMode=0750, and RuntimeDirectoryPreserve=no.opencode-pty-supervisor.service hardening and lifecycle settings are NoNewPrivileges=yes, UMask=0077, KillMode=control-group, KillSignal=SIGTERM, FinalKillSignal=SIGKILL, SendSIGKILL=yes, TimeoutStopSec=20s, OOMPolicy=kill, Delegate=no, RestrictAddressFamilies=AF_UNIX, PrivateTmp=yes, ProtectSystem=strict, ProtectKernelTunables=yes, ProtectKernelModules=yes, ProtectKernelLogs=yes, ProtectControlGroups=yes, ProtectClock=yes, RestrictSUIDSGID=yes, LockPersonality=yes, and MemoryDenyWriteExecute=yes; installation target is multi-user.target.opencode-pty.slice is described as OpenCode isolated PTY sessions, is ordered Before=slices.target, enables CPU, memory, and task accounting, and sets MemoryMax=2G and TasksMax=512.PROTOCOL.md specifies one Unix SOCK_STREAM connection per PTY and a 12-byte frame header: bytes 0–3 OPTY, byte 4 version 1, byte 5 frame type, bytes 6–7 zero, and bytes 8–11 an unsigned big-endian payload length capped at 65536.1 with exactly one SCM_RIGHTS directory descriptor; the payload carries unsigned big-endian st_dev and st_ino, optional runtime seconds, argument count, and length-prefixed argument bytes.2 and are capped at 32768 bytes; supervisor frames are output type 3, exit type 4, or error type 5.ExecMainCode, 4 bytes of ExecMainStatus, 4 bytes of result-string length, and the structured systemd Result string.ROOT-ACCEPTANCE.md states the service must not be started or enabled until all 10 checks pass./usr/local/libexec; never execute the root supervisor or transient launcher from the user-writable source tree. Commands use sudo install -d -o root -g root -m 0755 /usr/local/libexec, then install bin/opencode-pty-supervisor and bin/opencode-pty-launcher as root:root mode 0755./etc/systemd/system as root-owned mode 0644, run systemd-analyze verify on the installed files, and do not yet enable or start either unit./usr/local/libexec, both binaries, and every parent directory are root-controlled; neither byk nor any group may have write access.opencode-v2.service is inactive, run a disposable root-started supervisor, verify every connection fails authentication, and verify kernels lacking SO_PEERPIDFD fail closed.st_dev/st_ino.opencode-pty-[0-9a-f]{32}.service, runs as byk:byk in opencode-pty.slice, receives the fixed environment, starts in the descriptor-selected directory, and preserves spaces, quotes, shell metacharacters, and newlines in arguments without evaluation.unitProperties property is effective; from inside the command, verify Docker, system D-Bus, and user D-Bus sockets are inaccessible.RuntimeMaxSec, TERM-to-KILL escalation, nonzero exit, signal exit, protocol failure, client disconnect, and supervisor shutdown.UnitRemoved; restart only the disposable supervisor and verify strict-name, exact-BindsTo orphan cleanup removes owned orphans while preserving lookalike and foreign units./home/byk/.local/share/opfinder failed because the path was not found.go.mod declares module opencode-pty-supervisor, Go 1.22, and dependencies github.com/coreos/go-systemd/v22 v22.5.0, github.com/godbus/dbus/v5 v5.1.0, and golang.org/x/sys v0.20.0./home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json, test/followup.test.ts, opencode.json, service-v2-pilot.json, package.json, plugins/pty.ts, and plugins/followup.ts; the broader search was truncated after the first 100 results.