Distillation

Date: Sep 17, 2026

• 🔴 [requested-review] (09:20) User requested a strict READ-ONLY security/pentest review of frozen v22 in /tmp/opencode/session-recovery-v22-review; prohibited editing, running tests/builds/services, mutating VCS/index/refs, and using recall.
• 🔴 (09:20) User specified immutable review inputs: base commit ab9408c81cc9916177641ae8e9f08624fc27b5b9; patch /tmp/opencode/session-recovery-final-v22.patch with SHA-256 5af96209cef23e735f09dbf2f4b2f5b0f51b208ece9e5b325e4e217b46003643; SEA /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server with SHA-256 10a3698a5e3b009f811a1b27eefab9e1083b560e24efee5f537f003d7edd7384; expected scope 34 paths.
• 🔴 (09:20) User required immutable inputs to be verified before reviewing all changed files and relevant context.
• 🔴 (09:20) User required adversarial inspection of cancellation/finalizers, terminal failed-Step tool reconciliation, publication rollback, concurrent interrupt single-flight, stale-owner takeover, cross-Session/corrupt rows, replay and wake duplication, DoS/fairness, external side effects/snapshots, migrations, generated clients, and auth/layering.
• 🔴 (09:20) User required verification that the real trigger test aborts session.next.step.interrupted.1 and leaves the session in cancelling with a running tool.
• 🔴 (09:20) User required verification that completed Step.Failed cleanup publishes Tool.Failed after join, then clears state with the final atomic commit while retaining the original failure.
• 🔴 (09:20) User stated the startup equivalent never creates continue.
• 🔴 (09:20) User required verification of schema prevIds and explicit resume.
• 🔴 (09:20) User designated final check-call, process-local routing, and bounded clock skew as disclosed residuals.
• 🔴 (09:20) User required findings first, each with exact file:line and a MUST-FIX or CONCERN classification, and required the final response to end exactly with MERGE or DO-NOT-MERGE.
• 🟡 (09:20) Immutable hash verification matched the requested values: /tmp/opencode/session-recovery-final-v22.patch SHA-256 was 5af96209cef23e735f09dbf2f4b2f5b0f51b208ece9e5b325e4e217b46003643, and /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server SHA-256 was 10a3698a5e3b009f811a1b27eefab9e1083b560e24efee5f537f003d7edd7384.
• 🟡 (09:21) Repository verification found HEAD/base ab9408c81cc9916177641ae8e9f08624fc27b5b9, another reported revision 2e9407768d1401a25b69febb36657638a779053a, 29 tracked modified paths, 5 untracked paths, and therefore 34 changed paths total. A generated digest over the changed-path data was b1cb5991342a77eea7ded7b8369d827606ff6e9dc808a080490cc336d2d52117.
• 🟡 (09:21) The 34 changed paths were: packages/client/src/generated/types.ts; packages/core/schema.json; packages/core/src/database/migration.gen.ts; packages/core/src/database/migration/20260914170650_session-recovery.ts; packages/core/src/database/schema.gen.ts; packages/core/src/session.ts; packages/core/src/session/compaction.ts; packages/core/src/session/context-epoch.ts; packages/core/src/session/execution/claim.ts; packages/core/src/session/execution/local.ts; packages/core/src/session/input.ts; packages/core/src/session/message-updater.ts; packages/core/src/session/projector.ts; packages/core/src/session/recovery-id.ts; packages/core/src/session/recovery.ts; packages/core/src/session/run-coordinator.ts; packages/core/src/session/runner/index.ts; packages/core/src/session/runner/llm.ts; packages/core/src/session/runner/publish-llm-event.ts; packages/core/src/session/sql.ts; packages/core/test/database-migration.test.ts; packages/core/test/session-execution-local.test.ts; packages/core/test/session-projector.test.ts; packages/core/test/session-prompt.test.ts; packages/core/test/session-run-coordinator.test.ts; packages/core/test/session-runner-recorded.test.ts; packages/core/test/session-runner-tool-events.test.ts; packages/core/test/session-runner.test.ts; packages/opencode/src/server/routes/instance/httpapi/server.ts; packages/schema/src/session-event.ts; packages/schema/test/event-manifest.test.ts; packages/sdk/js/src/v2/gen/types.gen.ts; packages/sdk/openapi.json; packages/server/src/routes.ts.
• 🔴 (09:21) User’s repository rules require generated public API changes to be produced with bun run generate from packages/client; src/generated and src/generated-effect must never be edited directly. The legacy JavaScript SDK is regenerated with ./packages/sdk/js/script/build.ts.
• 🔴 (09:21) User’s dependency-layering rule is Schema → Core and Protocol, then Core and Protocol → Server; Client runtime code may depend on Schema and Protocol but never Core or Server; sdk-next composes Client, Core, and Server.
• 🔴 (09:21) User stated: Always run bun typecheck from package directories, such as packages/opencode, and never run tsc directly.
• 🔴 (09:21) User stated: Never alias imports; forbidden examples include import { foo as bar } from "..." and resolve as pathResolve.
• 🔴 (09:21) User stated: Never use star imports; forbidden examples include import * as Foo from "..." and import type * as Foo from "...".
• 🔴 (09:21) User’s import convention is to import a module’s own exported namespace by name, such as import { Project } from "@opencode-ai/core/project", then reference Project.ID; heavy branch-specific modules should use dynamic imports scoped to the narrowest needed branch.
• 🔴 (09:21) User’s testing rule says tests cannot run from the repository root because of the do-not-run-tests-from-root guard; tests must run from package directories such as packages/opencode.
• 🔴 (09:21) User’s V2 Session Core rules state that SessionV2.prompt(...) durably admits one session_input row before advisory SessionExecution.wake(sessionID), unless resume: false requests admit-only behavior; prompt message ID reuse reconciles only exact retries matching Session, prompt, and delivery mode.
• 🔴 (09:21) User’s V2 Session Core rules require SessionExecution to remain process-global and Session-ID based; its local implementation owns the process-local Session coordinator, and V2 interruption targets the active process-local ownership chain, with idle or missing interruption being a no-op.
• 🔴 (09:21) User’s V2 Session Core rules require one explicit llm.stream(request) call per provider turn, projected-history reload before durable continuation, and prohibit bridging through legacy SessionPrompt.loop(...) or delegating orchestration to an in-memory tool loop.
• 🔴 (09:21) User’s V2 Session Core rules state that SessionRunCoordinator joins explicit same-Session resumes, coalesces prompt wakeups, permits different Sessions concurrently, and that advisory wakes drain only eligible durable inbox rows; post-crash provider-work continuation requires a separate explicit design.
• 🔴 (09:21) User’s delivery semantics state that prompts steer by default at the next safe provider-turn boundary, explicit queue inputs stay pending until the Session would otherwise become idle, one queued input is promoted at that boundary, and new user input resets the selected agent’s provider-turn allowance.
• 🔴 (09:21) User’s schema-layer rules require @opencode-ai/schema to contain browser-safe serializable wire/storage contracts only, preserve @opencode-ai/schema <- @opencode-ai/protocol <- @opencode-ai/server, avoid runtime services and host-local details, keep V1-only events such as message.updated and message.part.* out of current Protocol/SDK Next unless explicitly required, and preserve a single canonical event definition.
• 🔴 (09:21) User’s schema conventions require public contracts to be readonly by default, prohibit Schema.mutable(...) for runtime convenience, prefer Schema.Json for JSON-serializable values and Schema.Unknown for opaque values, avoid Schema.Any outside documented unsafe compatibility boundaries, and require focused contract/generated-surface tests.
• 🔴 (09:21) User’s OpenCode module rule prohibits export namespace Foo { ... }; modules should expose flat top-level exports plus a namespace projection such as export * as Foo from "./foo" or export * as Foo from "." for index.ts.
• 🟡 (09:22) Inspection of packages/core/src/session/execution/claim.ts found claim fencing by session_id, execution id, owner_id, and expires_at > now; the file documents node wall-clock leases and requires the lease interval to exceed maximum deployment clock skew plus one renewal interval.
• 🟡 (09:22) SessionExecutionClaim.update() in packages/core/src/session/execution/claim.ts:40-65 renews expires_at to now + SESSION_EXECUTION_LEASE_MS; transition to cancelled requires current phase cancelling, transition to cancelling excludes only current cancelled, and other updates exclude cancelling and cancelled. Missing updates die with SessionExecutionClaim.Lost.
• 🟡 (09:22) SessionExecutionClaim.renew() in packages/core/src/session/execution/claim.ts:67-82 renews only an unexpired fully matching claim; settleCancellation() at lines 84-98 requires phase cancelling; clear() at lines 100-109 deletes only an unexpired fully matching claim; all missing-row cases die with Lost.
• 🟡 (09:22) SessionExecutionClaim.transaction() in packages/core/src/session/execution/claim.ts:111-112 starts an immediate database transaction and performs update(db, claim) before the supplied effect.
• 🟡 (09:22) packages/core/src/session/recovery-id.ts deterministically creates fallback assistant IDs as msg_recovery_${executionID} and continuation IDs as msg_recovery_continue_${executionID}.
• 🟡 (09:22) Migration packages/core/src/database/migration/20260914170650_session-recovery.ts has ID 20260914170650_session-recovery; it adds session_input.wake_pending defaulting to false and non-null, adds session.wake_attempts defaulting to 0 with range 0..9007199254740991, and creates session_execution and session_recovery.
• 🟡 (09:22) The migration’s session_execution table uses primary key id, a unique index on session_id, fields owner_id, nullable assistant_message_id, phase, assistant_seq default -1, time_created, expires_at, and nullable recovery_error; valid phases are ready, safe, unknown, continue, cancelling, and cancelled; session_id references session(id) with ON DELETE CASCADE.
• 🟡 (09:22) The migration’s session_recovery table uses primary key execution_id, fields session_id, nullable assistant_message_id, unique continuation_message_id, phase, wake_pending default true, wake_attempts default 0 with range 0..9007199254740991, nullable recovery_error, and time_created; foreign keys cascade from session, session_message, and session_input.
• 🟡 (09:22) The migration creates indexes session_execution_session_idx, session_execution_owner_idx, session_execution_recovery_scan_idx, session_input_wake_pending_promoted_session_idx, session_recovery_continuation_message_idx, and session_recovery_wake_pending_error_attempts_created_execution_idx.
• 🔴 (09:22) User’s HTTP API route rules require normal and SSE endpoints to use HttpApiBuilder.group(...); declared raw/WebSocket endpoints use handleRaw(...); raw HttpRouter.use(...) is reserved for routes outside the declared API surface; stable services/layers must be provided at application/layer construction rather than inside request handlers.