Dashboard › opencode › Distillation
df4315ba-85d9-4bc0-8107-da751a40369b["lore_tm_v1_Zy4T6mJFFNWi9uiAfK0_29KuvVgmFUBqSvu_W9F16tY","lore_tm_v1_jTcticROZi5k1Iqp6sB7TlQ0TZUhFpIL6VtbMRUCcH8","lore_tm_v1_GpKfD2AfkRRznr3n43M-pntQaO-_imfpDA-vVl7k2-g","lore_tm_v1_X5qUEj-zzuKc_C4A4j4ahbAQqGKrM9viMW_6Rjg6gcs","lore_tm_v1_Yhkz1D_eBvKIJe6r3O2E9q5MWsAFCKRbuemHIJE-QVk","lore_tm_v1_TPLE3KTvHpCUrBx2ReHb0XumT9ZU2oH9A5mUbXrzcdY"]
Date: Sep 8, 2026
/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main.go defines encodedArgumentsEnvironment = "OPENCODE_PTY_ARGV" and launcherFD = 3; main() calls run(os.Args[1:]), prints errors to stderr, and exits with status 1 on failure.run(values) enters execCommand() only for the exact argument list ["--exec"]; otherwise it validates values with decodeArguments(), changes cwd using syscall.Fchdir(2), replaces fd 2 with stdout via syscall.Dup2(1, 2), installs a fixed environment, stores dot-joined encoded arguments in OPENCODE_PTY_ARGV, calls bindLauncher(), then execs /usr/bin/script.scriptArguments() returns ["script", "-q", "-e", "-f", "-c", "/bin/sh -i -c 'exec /proc/self/fd/3 --exec'", "/dev/null"], causing the interactive shell to re-exec the launcher through inherited fd 3.execCommand() requires nonempty OPENCODE_PTY_ARGV, splits it on ., decodes the command through decodeArguments(), resets the fixed environment, closes launcherFD 3, and calls syscall.Exec(command[0], command, os.Environ()).bindLauncher() opens /proc/self/exe with unix.O_RDONLY|unix.O_CLOEXEC; if the returned fd is not 3, it uses unix.Dup3(fd, launcherFD, 0), while an fd already equal to 3 has FD_CLOEXEC cleared using unix.FcntlInt(..., unix.F_SETFD, 0).decodeArguments(encoded) accepts 1 through protocol.MaxArgs+1 items. Each item must begin with literal a, use canonical raw URL-safe Base64 grammar [A-Za-z0-9_-], contain no NUL, and fit protocol.MaxCommandSize for index 0 or protocol.MaxArgSize thereafter; aggregate argument bytes excluding the command cannot exceed protocol.MaxArgsSize, and the decoded command cannot be empty.setFixedEnvironment() clears the inherited environment and sets exactly HOME=/home/byk, LANG=C.UTF-8, LOGNAME=byk, PATH=/usr/local/bin:/usr/bin:/bin, SHELL=/bin/sh, TERM=xterm-256color, and USER=byk./home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/supervisor/main.go creates a context canceled by SIGINT or SIGTERM, initializes supervisor.NewSystemdManager(ctx) and supervisor.NewServer(manager), defers manager.Close(), and runs server.Serve(ctx); initialization or serving errors are printed to stderr and exit with status 1./home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts defines protocol values MAGIC="OPTY", VERSION=1, HEADER_SIZE=12, MAX_FRAME_SIZE=70*1024, MAX_IO_PAYLOAD_SIZE=32*1024, frame types TYPE_INPUT=2, TYPE_OUTPUT=3, TYPE_EXIT=4, TYPE_ERROR=5, TYPE_STARTED=6, TYPE_STOP=7, and TYPE_STOPPED=8.pty-transport.ts defaults to socket /run/opencode-pty/supervisor.sock and helper /usr/local/libexec/opencode-pty-client; timing and size limits are HELPER_TIMEOUT_MS=5_000, STOP_TIMEOUT_MS=25_000, and MAX_HELPER_ERROR_BYTES=2_000; transient unit names must match /^opencode-pty-[0-9a-f]{32}\.service$/.assertSupervisorAvailable(options) can skip helper verification only when verifyRootHelper === false; otherwise the helper must be a root-owned regular executable file with no group/world write bits, after which the function connects to the supervisor socket, validates that Node exposes a connected socket descriptor, and destroys the socket.openSupervisorTransport(binding, command, args, runtimeSeconds, options) connects to the Unix socket and spawns the client helper with metadata [String(runtimeSeconds), a<Base64URL(command)>, ...a<Base64URL(arg)>]; child stdio is ["pipe", "pipe", "pipe", connectedSocketFD(socket), binding.fd], passing the connected socket and approved directory as fds 3 and 4.OPTY magic, version 1, reserved bytes 6 and 7 equal to zero, and payload length at most MAX_FRAME_SIZE; malformed headers, oversized frames, and unexpected frame types destroy the socket with structured errors.TYPE_OUTPUT requires 1–32 KiB and is queued until onOutput() is registered; TYPE_STARTED must occur once with nonempty valid UTF-8 matching UNIT_NAME; TYPE_ERROR requires nonempty valid UTF-8 up to 32 KiB; TYPE_EXIT requires a 9-byte fixed section plus the declared UTF-8 result and resolves {execMainCode, execMainStatus, result}; TYPE_STOPPED is accepted only after stopping, with an empty payload, and resolves {execMainCode: 2, execMainStatus: 15, result: "stopped"}.HELPER_TIMEOUT_MS=5_000 for TYPE_STARTED; helper stderr is retained only through MAX_HELPER_ERROR_BYTES=2_000, the helper is killed with SIGKILL after 5 seconds, and signal termination or nonzero exit becomes an error.SupervisorTransport.write(data) splits input into chunks of at most MAX_IO_PAYLOAD_SIZE=32*1024, frames each as TYPE_INPUT, and applies a 5-second timeout per write. close() sends one empty TYPE_STOP when needed, waits up to STOP_TIMEOUT_MS=25_000 for structured exit, destroys the socket on timeout, and then waits for socket closure.connectedSocketFD(socket) accesses Node’s private socket._handle.fd using Reflect.get() and verifies it is a nonnegative integer whose fstatSync(fd).isSocket() is true; failure destroys the socket. frame(type, payload) constructs the 12-byte big-endian OPTY v1 header and rejects payloads above MAX_FRAME_SIZE./home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts defines plugin local-pty with tools pty_spawn, pty_write, pty_read, pty_list, and pty_kill; setup first calls assertSupervisorAvailable or the injected assertAvailable.pty.ts limits are MAX_BUFFER_SIZE=1_000_000, MAX_SESSIONS=16, MAX_SESSIONS_PER_OWNER=5, DEFAULT_READ_LIMIT=500, MAX_READ_LIMIT=2_000, MAX_READ_OFFSET=10_000, MAX_LINE_LENGTH=2_000, MAX_PATTERN_LENGTH=500, MAX_WRITE_SIZE=65_536, MAX_TIMEOUT_SECONDS=3_600, CLOSE_TIMEOUT_MS=27_000, NOTIFICATION_TIMEOUT_MS=5_000, MAX_COMMAND_LENGTH=4_096, MAX_ARGUMENTS=128, MAX_ARGUMENT_LENGTH=16_384, MAX_ARGUMENT_BYTES=65_536, MAX_PATH_LENGTH=4_096, MAX_TITLE_LENGTH=500, MAX_DESCRIPTION_LENGTH=2_000, and MAX_REGEX_WORKERS=4.pty_spawn validates command and argument byte limits, rejects work during plugin closure or after parent-session deletion, reserves capacity against concurrent spawns, and enforces 5 sessions per owner plus 16 sessions per Location. At an owner’s limit, it evicts one inactive exited or killed session; if none exists it rejects the spawn.pty_spawn authorizes the command and workdir, generates IDs as pty_ plus the first 8 hyphen-free characters of crypto.randomUUID(), opens supervisor transport with timeoutSeconds ?? 0, closes the directory handle, and records title, description, command, args, canonical workdir, status running, notification settings, unit name, ISO creation time, parent session ID, transport, and a 1,000,000-character rolling output buffer.killed when previously killing, otherwise exited; timedOut is true only for result "timeout"; execMainCode === 1 maps execMainStatus to exitCode; codes 2 or 3 map it to exitSignal. Transport rejection sets exitCode=1, appends the error and newline to the rolling buffer, and triggers notification handling.notifyOnExit is true, the plugin is not closing, and the parent session was not deleted. ctx.session.synthetic() sends delivery "steer" with description PTY exited: <description truncated to 100> and JSON fields type:"pty.exit", id, 100-character description, exitCode, exitSignal, timeoutSeconds, timedOut, outputLines, and the last nonblank line truncated to 200 characters; timeout is 5 seconds.pty_write requires ownership and status running, decodes \n, \r, \t, \xNN, \uNNNN, and \\, enforces a post-decoding UTF-8 size of at most 65_536 bytes, obtains shell permission including the stdin resource, rechecks ownership/status after permission approval, and writes the resulting buffer.pty_read supports line pagination or extended-regex filtering with zero-based offset default 0, limit default 500, maximum offset 10_000, and maximum limit 2_000; returned lines preserve one-based source line numbers and truncate text to 2_000 characters. It reports totalLines, hasMore, and nextOffset.matchingLines() spawn /usr/bin/grep with ["-a", "-m", String(limit), "-nE", ...(ignoreCase ? ["-i"] : []), "--", pattern]; at most 4 regex workers run concurrently, grep is killed after 250 ms, stdout is limited to MAX_BUFFER_SIZE*2, stderr to MAX_LINE_LENGTH, exit code 1 means no matches, and output is parsed from line:text records.pty_list returns only sessions owned by the requesting parent session. pty_kill rechecks shell permission and ownership; cleanup:true terminates and removes the session plus output, while the default retains it and returns its resulting status.authorize() resolves both the requested workdir and project directory; directories outside the project require external_directory permission, and every spawn requires shell permission for a single-quoted shellCommand(command,args) resource. It then re-resolves the workdir to detect changes, opens it with O_RDONLY|O_DIRECTORY|O_NOFOLLOW, verifies it remains a directory, and confirms /proc/self/fd/<fd> resolves to the previously approved path.session.deleted events mark the parent deleted, await its tracked spawn operations, and remove all owned PTY sessions. Plugin teardown sets closing=true, aborts event subscription, and waits with Promise.allSettled() for pending spawns, session removals, and pending notifications, logging rejected cleanup operations./home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame_test.go tests: TestStartRoundTrip uses device 12, inode 34, runtime 60, command printf, and args ["%s","hello world"]; TestFrameRoundTrip round-trips TypeInput payload "hello"; TestRejectsOversizedFrame checks MaxFrameSize+1; TestRejectsNULArgument checks "a\x00b"; and TestStartLimits rejects oversized command, argument, aggregate arguments, and invalid UTF-8 command byte 0xff.frame_test.go defines FuzzParsePacket, seeded with a marshaled TypeInput frame containing "seed", and passes arbitrary fuzz bytes to ParsePacket()./home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main_test.go test TestNodePassesConnectedSocketWithoutChangingPeerMainPID launches a Node process that passes socket._handle.fd and an opened cwd descriptor to the Go helper as fds 3 and 4; the server verifies SO_PEERCRED.Pid remains the Node process PID, receives exactly one directory descriptor without truncation, parses the START packet, and confirms unrelated child processes do not inherit fds 3 or 4.TestSendStartTransfersExactlyOneCloexecDirectoryDescriptor uses a SOCK_STREAM|SOCK_CLOEXEC Unix socketpair, calls sendStart() with runtime 60, command /bin/printf, and argument ok, receives with MSG_CMSG_CLOEXEC, verifies exactly one rights descriptor with FD_CLOEXEC, then decodes the START frame and checks the command and sole argument.TestDecodeStartEnforcesCommandArgumentAndAggregateLimits verifies rejection of a command sized protocol.MaxCommandSize+1, an argument sized protocol.MaxArgSize+1, and aggregate arguments consisting of four protocol.MaxArgSize strings plus "x".