Distillation

Date: Sep 8, 2026

• 🟢 (08:16) A file-search tool returned No files found.
• 🟡 (08:16) Assistant confirmed the source manifest and all three artifact hashes matched exactly, and classified the host’s Node v24.16.0 versus required Node 26.4 as a deployment-acceptance blocker rather than a source defect.
• 🟡 (08:16) Reviewed /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go (704 lines). Server constants at lines 25-33 are: socket /run/opencode-pty/supervisor.sock; maxSessions=16; maxUnauthenticated=32; maxAdmissionsPerMinute=120; maxStartDescriptors=8; socketBufferSize=128 * 1024; and handshakeTimeout=5 * time.Second.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:54-75 resolves fixed account byk, parses its UID/GID, allocates a 16-slot authenticated-session channel, a maxUnauthenticated+1 (33-slot) unauthenticated channel reserving capacity for the likely real MainPID, a connection map, and a one-entry fatal-error channel.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:78-128 requires effective UID 0, performs CleanupOrphans(ctx) before listening, closes listener/connections when context ends, authenticates Unix peers by exact expected UID/GID, and admits unauthenticated connections only through admitUnauthenticated(server.likelyMainPID(ctx, credential.Pid)).
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:131-235 applies 128-KiB socket read/write buffers and a five-second handshake deadline; calls authenticate; reserves one of 16 session slots only after authentication; receives one START plus cwd descriptor; generates a random unit name; rechecks peer identity immediately before manager.Start; transfers a socketpair endpoint and cwd into the transient unit; sends TypeStarted; and uses sync.Once cleanup via manager.StopAndWait(ctx, unitName), escalating cleanup failure to a fatal server error.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:237-343 runs concurrent PTY input, PTY output, client-disconnect monitoring, and manager.Wait. Context cancellation, disconnect, input closure, protocol/input error, output error, wait error, STOP, and normal unit completion all return through cleanup logic; STOP and normal completion drain PTY output with outputDrainTimeout, call unix.Shutdown(..., unix.SHUT_RDWR) on drain timeout, and respectively emit TypeStopped or TypeExit.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:346-377 accepts only nonempty TypeInput frames no larger than protocol.MaxIOPayloadSize or an empty TypeStop; copyOutput reads chunks of exactly protocol.MaxIOPayloadSize maximum and emits TypeOutput through the mutex-protected frameWriter.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:379-409 implements disconnect detection by duplicating the client socket with unix.F_DUPFD_CLOEXEC, polling every 250 ms for POLLRDHUP|POLLHUP|POLLERR, and closing the duplicate on return.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:411-481 receives the START header and payload incrementally with ancillary data, rejects payload lengths above protocol.MaxFrameSize, requires exactly one descriptor and TypeStart, validates the descriptor is a directory whose device/inode exactly match START metadata, and closes accumulated descriptors on every receiveStart error path. receiveExact allocates ancillary space for maxStartDescriptors+1, parses and accumulates SCM_RIGHTS, rejects residual malformed control data or more than one fd, and rejects zero-byte receives plus MSG_TRUNC or MSG_CTRUNC.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:484-499 calls unix.Recvmsg with unix.MSG_CMSG_CLOEXEC through SyscallConn.Read, retrying only for EAGAIN/EWOULDBLOCK.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:502-539 refuses a preexisting non-socket at /run/opencode-pty/supervisor.sock, removes a preexisting socket, creates a Unix listener, applies mode 0660, and creates PTY transport using AF_UNIX SOCK_STREAM|SOCK_CLOEXEC with 128-KiB send and receive buffers on both endpoints.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:542-556 generates unit names from 16 cryptographically random bytes formatted between unitPrefix and unitSuffix; exit payload encoding contains one byte for ExecMainCode, four bytes for ExecMainStatus, four bytes for result-string length, then Result.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:559-607 bounds error payloads to protocol.MaxIOPayloadSize without cutting invalid UTF-8, implements full writes with io.ErrShortWrite on zero progress, closes fd lists via unix.Close, serializes frame writes with a mutex, and sets each supported write deadline to time.Now().Add(operationTimeout).
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:610-655 reserves the 33rd unauthenticated slot for a likely real MainPID; ordinary peers are limited to 32 concurrent unauthenticated connections and 120 admissions per rolling minute. likelyMainPID caches identity for one second and recognizes a PID only when ClientState reports ActiveState=="active", SubState=="running", ControlGroup==expectedClientCgroup, and a 16-byte InvocationID.
• 🟡 (08:16) /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go:658-704 obtains peer identity using SO_PEERCRED, tracks active connections under a mutex, closes the listener and all tracked connections on shutdown/fatal failure, logs fatal errors, and publishes only the first fatal error through sync.Once.