Dashboard › opencode › Session 0wonhmULf2Uj
0wonhmULf2UjWGuOaImplement a minimal secure Go PTY supervisor and fixed launcher under /home/byk/.local/share/opencode-v2-pilot/supervisor only. Do not edit repository files, current plugin, system units outside that directory, or start/install services. Use tabs/go fmt. You may fetch pinned Go modules. Requirements from independent design: root-owned Unix socket server intended at /run/opencode-pty/supervisor.sock; authenticate each connection with SO_PEERCRED plus SO_PEERPIDFD if available and exact equality to systemd's current MainPID for fixed opencode-v2.service, exact expected cgroup, ActiveState active; fail closed without pidfd. One SOCK_STREAM connection per PTY with bounded binary framing. Secure SCM_RIGHTS transfer of approved cwd descriptor from authenticated client, compare st_dev/st_ino metadata, and a fixed launcher that receives cwd fd, fchdir, clearenv/set fixed env, then exec /usr/bin/script with strictly encoded argv. Use maintained Go D-Bus/systemd library and direct StartTransientUnit if its API can pass stdio fds and properties; monitor structured Result/ExecMainCode/ExecMainStatus and unit removal. Generated random 128-bit fixed-grammar unit names only. Every unit User/Group=byk, NoNewPrivileges, UMask, KillMode=control-group, TERM/KILL/TimeoutStopSec, RuntimeMaxSec optional, OOMPolicy kill, Delegate no, BindsTo/After supervisor, mask Docker and system/user DBus sockets, use dedicated opencode-pty.slice; never inherit environment or accept systemd property names/unit names/paths from client. Bound sessions/frames/input/output/backpressure. On client disconnect/protocol error/supervisor shutdown stop unit by name and await inactivity. Startup orphan cleanup by strict unit grammar and BindsTo verification. Include service/slice files in this isolated directory and unit/protocol tests that don't require root. ...
<path>/home/byk/.local/share/opencode-v2-pilot</path> <type>directory</type> <entries> cache/ config/ CUTOVER.md data/ opencode-v2.service state/ supervisor/ (7 entries) </entries>
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor</path> <type>directory</type> <entries> (0 entries) </entries>
go version go1.22.2 linux/amd64 /home/byk/go linux amd64 6.8.0-117-generic
systemd 255 (255.4-1ubuntu8.17) +PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified go: loading module retractions for github.com/coreos/go-systemd/v22@v22.0.0: module github.com/coreos/go-systemd/v22@v22.7.0 requires go >= 1.23 (running go 1.22.2)
StatusCode: non 2xx status code (418 GET https://www.freedesktop.org/software/systemd/man/latest/org.freedesktop.systemd1.html)
...output truncated...
Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_07f3d20dd001KuT5ZrRbGlPJIB
process is directly invoked by the service manager or indirectly as
a child of another process by comparing this value with the current
PID (similarly to the scheme used in sd_listen_fds(3) with
$LISTEN_PID and $LISTEN_FDS).
Added in version 248.
$TERM
Terminal type, set only for units connected to a terminal
(StandardInput=tty, StandardOutput=tty, or StandardError=tty). See
termcap(5).
Added in version 209.
$LOG_NAMESPACE
Contains the name of the selected logging namespace when the
LogNamespace= service setting is used.
Added in version 246. ...
No files found
troff:<standard input>:1149: warning [p 14, 8.7i, div '3tbd3,3', 2.0i]: cannot break line <standard input>:1099: warning: table wider than line length minus indentation troff:<standard input>:1641: warning [p 16, 17.2i, div '3tbd1,0', 0.0i]: cannot break line troff:<standard input>:1647: warning [p 16, 17.2i, div '3tbd1,3', 0.0i]: cannot break line troff:<standard input>:1672: warning [p 16, 17.2i, div '3tbd4,2', 0.0i]: cannot break line troff:<standard input>:1677: warning [p 16, 17.2i, div '3tbd5,0', 0.0i]: cannot break line troff:<standard input>:1683: warning [p 16, 17.2i, div '3tbd5,3', 0.0i]: cannot break line <standard input>:1626: warning: table wider than line length minus indentation troff:<standard input>:4009: warning [p 26, 0.2i]: cannot break line troff:<standard input>:4893: warning [p 28, 6.8i, div '3tbd1,1', 0.0i]: cannot break line troff:<standard input>:5071: warning [p 28, 11.7i, div '3tbd11,2', 0.5i]: cannot break line troff:<standard input>:5078: warning [p 28, ...
<?xml version='1.0'?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" >
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
<refentry id="org.freedesktop.systemd1" xmlns:xi="http://www.w3.org/2001/XInclude">
<refentryinfo>
<title>org.freedesktop.systemd1</title>
<productname>systemd</productname>
</refentryinfo>
<refmeta>
<refentrytitle>org.freedesktop.systemd1</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>org.freedesktop.systemd1</refname>
<refpurpose>The D-Bus interface of systemd</refpurpose>
</refnamediv>
<refsect1>
<title>Introduction</title>
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> and its
auxiliary daemons expose a number of APIs over D-Bus. This page only describes the various APIs exposed by the
system and service manager itself. ...
/* SPDX-License-Identifier: LGPL-2.1-or-later */ #include <sys/mount.h> #include <sys/prctl.h> #include "af-list.h" #include "alloc-util.h" #include "bus-get-properties.h" #include "bus-util.h" #include "cap-list.h" #include "capability-util.h" #include "cpu-set-util.h" #include "creds-util.h" #include "dbus-execute.h" #include "dbus-util.h" #include "env-util.h" #include "errno-list.h" #include "escape.h" #include "exec-credential.h" #include "execute.h" #include "fd-util.h" #include "fileio.h" #include "hexdecoct.h" #include "iovec-util.h" #include "ioprio-util.h" #include "journal-file.h" #include "load-fragment.h" #include "memstream-util.h" #include "missing_ioprio.h" #include "mountpoint-util.h" #include "namespace.h" #include "parse-util.h" #include "path-util.h" #include "pcre2-util.h" #include "process-util.h" #include "rlimit-util.h" #include "seccomp-util.h" #include "securebits-util.h" #include "specifier.h" #include "stat-util.h" #include "strv.h" #include ...
384- const char *property,
385- sd_bus_message *reply,
386- void *userdata,
387- sd_bus_error *error) {
388-
389- ExecContext *c = ASSERT_PTR(userdata);
390- int fileno;
391-
392- assert(bus);
393- assert(property);
394- assert(reply);
395-
396: if (streq(property, "StandardInputFileDescriptorName"))
397- fileno = STDIN_FILENO;
398- else if (streq(property, "StandardOutputFileDescriptorName"))
399- fileno = STDOUT_FILENO;
400- else {
401- assert(streq(property, "StandardErrorFileDescriptorName"));
402- fileno = STDERR_FILENO;
403- }
404-
405- return sd_bus_message_append(reply, "s", exec_context_fdname(c, fileno));
406-}
407-
408-static int property_get_input_data(
--
1000- SD_BUS_PROPERTY("IOSchedulingClass", "i", property_get_ioprio_class, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1001- ...
bun-1.4.2 bun-linux-x64-1.4.2.zip followup-tsconfig.json opencode-pty-0.3.6 opencode-pty-0.3.6.tgz pty-plugin-preload.ts pty-plugin-smoke.ts pty-plugin-stub.ts pty-project pty-tsconfig.json v2-pilot-html-headers v2-pilot-index.html v2-plugin-final-list.json v2-plugin-final.log v2-plugin-final-permission-list.json v2-plugin-final-permission.log v2-plugin-node-safe-list.json v2-plugin-node-safe.log v2-plugin-reviewed-list.json v2-plugin-reviewed.log v2-plugin-test-2.log v2-plugin-test-3.log v2-plugin-test.log v2-pty-server.log v2-pty-smoke
Cloning into '/tmp/opencode/systemd-v255'... Note: switching to 'db11bab38ccf1ed257f310d29070843d4c58ea01'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by switching back to a branch. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -c with the switch command. Example: git switch -c <new-branch-name> Or undo this operation with: git switch - Turn off this advice by setting config variable advice.detachedHead to false
Found 8 matches
/tmp/opencode/systemd-v255/src/run/run.c:
Line 825: "StandardInputFileDescriptor", "h", STDIN_FILENO,
/tmp/opencode/systemd-v255/src/core/dbus-execute.c:
Line 396: if (streq(property, "StandardInputFileDescriptorName"))
Line 1012: SD_BUS_PROPERTY("StandardInputFileDescriptorName", "s", property_get_stdio_fdname, 0, SD_BUS_VTABLE_PROPERTY_CONST),
Line 2758: "StandardInputFileDescriptorName", "StandardOutputFileDescriptorName", "StandardErrorFileDescriptorName")) {
Line 2770: if (streq(name, "StandardInputFileDescriptorName")) {
/tmp/opencode/systemd-v255/src/core/execute.c:
Line 1102: fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
/tmp/opencode/systemd-v255/src/core/dbus-service.c:
Line 683: if (streq(name, ...
<path>/tmp/opencode/systemd-v255/src/core/dbus-service.c</path> <type>file</type> <content> 650: return 1; 651: } 652: 653: if (streq(name, "USBFunctionDescriptors")) 654: return bus_set_transient_path(u, name, &s->usb_function_descriptors, message, flags, error); 655: 656: if (streq(name, "USBFunctionStrings")) 657: return bus_set_transient_path(u, name, &s->usb_function_strings, message, flags, error); 658: 659: if (streq(name, "BusName")) 660: return bus_set_transient_bus_name(u, name, &s->bus_name, message, flags, error); 661: 662: if (streq(name, "Restart")) 663: return bus_set_transient_service_restart(u, name, &s->restart, message, flags, error); 664: 665: if (streq(name, "RestartMode")) 666: return bus_set_transient_service_restart_mode(u, name, &s->restart_mode, message, flags, error); 667: 668: if (streq(name, ...
I’ll first prove the pinned systemd client can send Unix file descriptors through StartTransientUnit. The host runs systemd 255, whose transient service API accepts StandardInputFileDescriptor, StandardOutputFileDescriptor, and StandardErrorFileDescriptor as D-Bus h values. This lets the supervisor pass one duplex I/O socket and the approved cwd descriptor without inventing an FD transport.
Success. Updated the following files: A ../../.local/share/opencode-v2-pilot/supervisor/go.mod A ../../.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame.go A ../../.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame_test.go A ../../.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main.go A ../../.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go
doc: missing go.sum entry for module providing package golang.org/x/sys/unix.SO_PEERPIDFD; to add: go mod download golang.org/x/sys exit status 1
package unix // import "golang.org/x/sys/unix" const ( B1000000 = 0x1008 B115200 = 0x1002 B1152000 = 0x1009 B1500000 = 0x100a B2000000 = 0x100b B230400 = 0x1003 B2500000 = 0x100c B3000000 = 0x100d B3500000 = 0x100e B4000000 = 0x100f B460800 = 0x1004 B500000 = 0x1005 B57600 = 0x1001 B576000 = 0x1006 B921600 = 0x1007 BLKALIGNOFF = 0x127a BLKBSZGET = 0x80081270 BLKBSZSET = 0x40081271 BLKDISCARD = 0x1277 BLKDISCARDZEROES = 0x127c BLKFLSBUF = 0x1261 BLKFRAGET ...
package dbus // import "github.com/coreos/go-systemd/v22/dbus"
func (c *Conn) SubscribeUnitsCustom(interval time.Duration, buffer int, isChanged func(*UnitStatus, *UnitStatus) bool, filterUnit func(string) bool) (<-chan map[string]*UnitStatus, <-chan error)
SubscribeUnitsCustom is like SubscribeUnits but lets you specify the buffer
size of the channels, the comparison function for detecting changes and a
filter function for cutting down on the noise that your channel receives.
package dbus // import "github.com/coreos/go-systemd/v22/dbus"
func (c *Conn) StopUnitContext(ctx context.Context, name string, mode string, ch chan<- string) (int, error)
StopUnitContext is similar to StartUnitContext, but stops the specified unit
rather than starting it.
package dbus // import "github.com/coreos/go-systemd/v22/dbus"
func (c *Conn) ListUnitsByPatternsContext(ctx context.Context, states []string, patterns []string) ([]UnitStatus, error)
ListUnitsByPatternsContext ...
func (c *Conn) DisableUnitFiles(files []string, runtime bool) ([]DisableUnitFileChange, error)
func (c *Conn) DisableUnitFilesContext(ctx context.Context, files []string, runtime bool) ([]DisableUnitFileChange, error)
func (c *Conn) EnableUnitFiles(files []string, runtime bool, force bool) (bool, []EnableUnitFileChange, error)
func (c *Conn) EnableUnitFilesContext(ctx context.Context, files []string, runtime bool, force bool) (bool, []EnableUnitFileChange, error)
func (c *Conn) FreezeUnit(ctx context.Context, unit string) error
func (c *Conn) GetAllProperties(unit string) (map[string]interface{}, error)
func (c *Conn) GetAllPropertiesContext(ctx context.Context, unit string) (map[string]interface{}, error)
func (c *Conn) GetUnitByPID(ctx context.Context, pid uint32) (dbus.ObjectPath, error)
func (c *Conn) GetUnitNameByPID(ctx context.Context, pid uint32) (string, error)
func (c *Conn) GetUnitPathProperties(path dbus.ObjectPath) (map[string]interface{}, error)
func (c *Conn) ...
package dbus // import "github.com/coreos/go-systemd/v22/dbus"
type PropertiesUpdate struct {
UnitName string
Changed map[string]dbus.Variant
}
PropertiesUpdate holds a map of a unit's changed properties
package dbus // import "github.com/coreos/go-systemd/v22/dbus"
type SubStateUpdate struct {
UnitName string
SubState string
}
package dbus // import "github.com/coreos/go-systemd/v22/dbus"
func (c *Conn) Close()
Close closes an established connection.
Success. Updated the following files: A ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go A ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go
package dbus // import "github.com/coreos/go-systemd/v22/dbus"
func PathBusEscape(path string) string
PathBusEscape sanitizes a constituent string of a dbus ObjectPath using the
rules that systemd uses for serializing special characters.
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go
Success. Updated the following files: A ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth.go A ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go A ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go A ../../.local/share/opencode-v2-pilot/supervisor/cmd/supervisor/main.go M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go A ../../.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service A ../../.local/share/opencode-v2-pilot/supervisor/opencode-pty.slice A ../../.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go A ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth_test.go
internal/supervisor/server.go:215:6: expected '(', found receiveStart
internal/supervisor/server.go:256:6: expected '(', found receiveExact
internal/supervisor/server.go:288:6: expected '(', found listen
internal/supervisor/server.go:324:6: expected '(', found socketPair
internal/supervisor/server.go:342:6: expected '(', found randomUnitName
internal/supervisor/server.go:350:6: expected '(', found writeError
internal/supervisor/server.go:358:6: expected '(', found writeAll
internal/supervisor/server.go:372:6: expected '(', found closeFDs
internal/supervisor/server.go:383:42: expected operand, found ']'
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go</path>
<type>file</type>
<content>
160: if err != nil && !errors.Is(err, io.EOF) {
161: return
162: }
163: outputDone = nil
164: case completed := <-unitDone:
165: if completed.err != nil {
166: writeError(writer, completed.err)
167: return
168: }
169: if outputDone != nil {
170: if err := <-outputDone; err != nil && !errors.Is(err, io.EOF) {
171: return
172: }
173: }
174: payload := make([]byte, 9+len(completed.result.Result))
175: payload[0] = byte(completed.result.ExecMainCode)
176: binary.BigEndian.PutUint32(payload[1:5], uint32(completed.result.ExecMainStatus))
177: binary.BigEndian.PutUint32(payload[5:9], uint32(len(completed.result.Result)))
178: copy(payload[9:], completed.result.Result)
179: _ = protocol.WriteFrame(writer, protocol.Frame{Type: protocol.TypeExit, Payload: payload})
180: return
181: }
182: }
183: }
184: ...
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go
ok opencode-pty-supervisor/cmd/launcher 0.010s # opencode-pty-supervisor/internal/supervisor internal/supervisor/server.go:332:13: cannot use fds (variable of type [2]int) as []int value in argument to closeFDs internal/supervisor/server.go:336:13: cannot use fds (variable of type [2]int) as []int value in argument to closeFDs FAIL opencode-pty-supervisor/cmd/supervisor [build failed] FAIL opencode-pty-supervisor/internal/supervisor [build failed] ok opencode-pty-supervisor/internal/protocol 0.002s FAIL
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go
ok opencode-pty-supervisor/cmd/launcher (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor 0.004s
Found 4 matches /tmp/opencode/systemd-v255/src/core/dbus-service.c: Line 480: static int bus_set_transient_std_fd( Line 684: return bus_set_transient_std_fd(u, name, &s->stdin_fd, &s->exec_context.stdio_as_fds, message, flags, error); Line 687: return bus_set_transient_std_fd(u, name, &s->stdout_fd, &s->exec_context.stdio_as_fds, message, flags, error); Line 690: return bus_set_transient_std_fd(u, name, &s->stderr_fd, &s->exec_context.stdio_as_fds, message, flags, error);
<path>/tmp/opencode/systemd-v255/src/core/dbus-service.c</path>
<type>file</type>
<content>
470: if (r < 0)
471: return r;
472:
473: unit_write_settingf(u, flags, name, "%s=%s", name, str);
474: }
475: }
476:
477: return 1;
478: }
479:
480: static int bus_set_transient_std_fd(
481: Unit *u,
482: const char *name,
483: int *p,
484: bool *b,
485: sd_bus_message *message,
486: UnitWriteFlags flags,
487: sd_bus_error *error) {
488:
489: int fd, r;
490:
491: assert(p);
492: assert(b);
493:
494: r = sd_bus_message_read(message, "h", &fd);
495: if (r < 0)
496: return r;
497:
498: if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
499: int copy;
500:
501: copy = fcntl(fd, ...
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth.go M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go M ../../.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service
ok opencode-pty-supervisor/cmd/launcher (cached)
? opencode-pty-supervisor/cmd/supervisor [no test files]
ok opencode-pty-supervisor/internal/protocol (cached)
ok opencode-pty-supervisor/internal/supervisor 0.004s
ok opencode-pty-supervisor/cmd/launcher 1.032s
? opencode-pty-supervisor/cmd/supervisor [no test files]
ok opencode-pty-supervisor/internal/protocol 1.016s
==================
WARNING: DATA RACE
Write at 0x00c00012a490 by goroutine 10:
internal/poll.(*FD).destroy()
/usr/lib/go-1.22/src/internal/poll/fd_unix.go:83 +0xd5
internal/poll.(*FD).decref()
/usr/lib/go-1.22/src/internal/poll/fd_mutex.go:213 +0x36
internal/poll.(*FD).Close()
/usr/lib/go-1.22/src/internal/poll/fd_unix.go:104 +0x7d
os.(*file).close()
/usr/lib/go-1.22/src/os/file_unix.go:315 +0x119
os.(*File).Close()
/usr/lib/go-1.22/src/os/file_posix.go:23 +0x45
opencode-pty-supervisor/internal/supervisor.TestReceiveStartWithDirectoryDescriptor.deferwrap3()
...
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go
ok opencode-pty-supervisor/cmd/launcher (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor 1.017s
/home/byk/.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md /home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty.slice /home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service /home/byk/.local/share/opencode-v2-pilot/supervisor/go.sum /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/supervisor/main.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/sy...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "encoding/base64"
6: "errors"
7: "fmt"
8: "os"
9: "regexp"
10: "time"
11:
12: systemddbus "github.com/coreos/go-systemd/v22/dbus"
13: "github.com/godbus/dbus/v5"
14: )
15:
16: const (
17: clientService = "opencode-v2.service"
18: supervisorService = "opencode-pty-supervisor.service"
19: ptySlice = "opencode-pty.slice"
20: expectedClientCgroup = "/system.slice/opencode-v2.service"
21: launcherPath = "/home/byk/.local/share/opencode-v2-pilot/supervisor/bin/opencode-pty-launcher"
22: unitPrefix = "opencode-pty-"
23: unitSuffix = ".service"
24: stopTimeout = 15 * time.Second
25: )
26:
27: var unitPattern = regexp.MustCompile(`^opencode-pty-[0-9a-f]{32}\.service$`)
28:
29: type unitResult struct {
30: Result string
31: ...
1000 1000 script from util-linux 2.39.3
apply_patch verification failed: Error: Failed to find expected lines in /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go:
for {
properties, err := manager.conn.GetUnitPropertiesContext(ctx, name)
if err == nil {
activeState, _ := properties["ActiveState"].(string)
subState, _ := properties["SubState"].(string)
if activeState == "failed" || subState == "exited" || activeState == "inactive" {
return decodeUnitResult(properties)
}
}
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go
/run/dbus/system_bus_socket socket /run/docker.sock socket /run/user/1000/bus socket /var/run/docker.sock socket
cmd go.mod go.sum internal opencode-pty.slice opencode-pty-supervisor.service PROTOCOL.md ok opencode-pty-supervisor/cmd/launcher (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor 0.004s ok opencode-pty-supervisor/cmd/launcher (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor 1.017s
bin/opencode-pty-supervisor: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, Go BuildID=iVKai5rc8nu0X9pud_P2/zmM9fRzqEBKOYzVYx3KC/QrpnXtps_239oqowezC9/H3GQGV9z5kgnl545d-B_, with debug_info, not stripped bin/opencode-pty-launcher: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, Go BuildID=06J_ARucDWUzrq9oVRVS/cQ9ztTszSKKgOZ9nXqfU/le5m0qb9Y0g7GmNm-Y9V/Hp0GpcOVbA-KI3XEClmJ, with debug_info, not stripped bin/opencode-pty-supervisor: ...
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go M ../../.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service A ../../.local/share/opencode-v2-pilot/supervisor/ROOT-ACCEPTANCE.md
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go
ok opencode-pty-supervisor/cmd/launcher (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor 0.004s ok opencode-pty-supervisor/cmd/launcher (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor 1.017s opencode-pty-supervisor.service: Command /usr/local/libexec/opencode-pty-supervisor is not executable: No such file or directory
e83a5beba354533c3bbc9f3680909c0df89bae852b4c9990d14d0f934fa9e9f5 bin/opencode-pty-supervisor d4b83497e2fc02901e5c7a2c83415a76252a137e893ee7f86d6e97f0d9fa8fcb bin/opencode-pty-launcher bin/opencode-pty-supervisor 4354682 bytes mode=755 owner=byk:byk bin/opencode-pty-launcher 1995648 bytes mode=755 owner=byk:byk opencode-pty-supervisor github.com/coreos/go-systemd/v22 v22.5.0 github.com/godbus/dbus/v5 v5.1.0 golang.org/x/sys v0.20.0
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go
? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/cmd/launcher 0.031s ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/cmd/launcher 1.052s ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor (cached)
/tmp/opencode/launcher-smoke.WPfXYw
e83a5beba354533c3bbc9f3680909c0df89bae852b4c9990d14d0f934fa9e9f5 bin/opencode-pty-supervisor d4b83497e2fc02901e5c7a2c83415a76252a137e893ee7f86d6e97f0d9fa8fcb bin/opencode-pty-launcher bin/opencode-pty-supervisor 4354682 bytes bin/opencode-pty-launcher 1995648 bytes
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go M ../../.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main.go M ../../.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go M ../../.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame.go M ../../.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md
Success. Updated the following files: M ../../.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame.go
ok opencode-pty-supervisor/cmd/launcher 0.036s ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol 0.004s ok opencode-pty-supervisor/internal/supervisor 0.004s ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/cmd/launcher 1.072s ok opencode-pty-supervisor/internal/protocol 1.017s ok opencode-pty-supervisor/internal/supervisor 1.017s
65f00b20269806f513f5c6a479a7ca051db6a334ca4549121e5b813bbdf75989 bin/opencode-pty-supervisor f97c546f46b6f2b818638c69ced6e461174549207225cd034ecf65da1017c20d bin/opencode-pty-launcher bin/opencode-pty-supervisor 4354826 bytes mode=755 owner=byk:byk bin/opencode-pty-launcher 1996238 bytes mode=755 owner=byk:byk
(no output)
Implemented entirely under:
/home/byk/.local/share/opencode-v2-pilot/supervisor
No repository files, current plugins, or installed system units changed. No services were installed, started, stopped, or restarted.
go.modgo.sumPROTOCOL.mdROOT-ACCEPTANCE.mdopencode-pty-supervisor.serviceopencode-pty.slicecmd/supervisor/main.gocmd/launcher/main.gocmd/launcher/main_test.gointernal/protocol/frame.gointernal/protocol/frame_test.gointernal/supervisor/auth.gointernal/supervisor/auth_test.gointernal/supervisor/server.gointernal/supervisor/server_test.gointernal/supervisor/systemd.gointernal/supervisor/systemd_test.gobin/opencode-pty-supervisorbin/opencode-pty-launcherSO_PEERCRED and mandatory SO_PEERPIDFD authentication.opencode-v2.service MainPID, active state, and cgroup checks.SCM_RIGHTS cwd transfer with descriptor metadata verification.StartTransientUnitContext use with D-Bus Unix FD properties./usr/bin/script execution.BindsTo verification.The service references root-controlled binaries under /usr/local/libexec. It never runs a root service from the user-writable source directory.
Passed:
gofmtgo test ./...go test -race ./...go vet ./...Artifacts:
* 🟡 (04:26) Added systemd transient-unit manager implementation and tests: `../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go` and `../../.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go`. * 🟡 (04:27) Confirmed `github.com/coreos/go-systemd/v22/dbus.PathBusEscape(path string) string` serializes special characters using systemd’s D-Bus ob…
Date: Sep 8, 2026 * 🟡 (04:22) Supervisor architecture decision: use systemd 255’s existing `StartTransientUnit` D-Bus Unix-FD support to pass one duplex I/O socket and the approved cwd descriptor, avoiding a custom FD transport. * 🟡 (04:23) Added Go supervisor module file `../../.local/share/opencode-v2-pilot/supervisor/go.mod`. * 🟡 (04:23) Added framing implementation and tests at `../../.loc…
Date: Sep 8, 2026 * 🔴 (04:19) User switched the systemd source checkout at `/tmp/opencode/systemd-v255` to commit `db11bab38ccf1ed257f310d29070843d4c58ea01`, leaving it in detached `HEAD` state. * 🟡 (04:19) systemd v255 source inspection confirmed named standard-I/O descriptor handling in `/tmp/opencode/systemd-v255/src/core/dbus-execute.c`: `StandardInputFileDescriptorName`, `StandardOutputFil…
Date: Sep 8, 2026 * 🟡 (04:18) Local `org.freedesktop.systemd1` XML documentation confirmed `Manager.StartTransientUnit(in s name, in s mode, in a(sv) properties, in a(sa(sv)) aux, out o job)`. * 🟡 (04:18) Local systemd D-Bus documentation confirmed `Manager.GetUnitByPIDFD(in h pidfd, out o unit, out s unit_id, out ay invocation_id)` is available in the installed API. * 🟡 (04:18) Local systemd …
Date: Sep 8, 2026 * 🟡 (04:17) User asked to implement a minimal secure Go PTY supervisor and fixed launcher exclusively under `/home/byk/.local/share/opencode-v2-pilot/supervisor`. * 🔴 [enforced-scope] (04:17) User prohibited editing repository files, the current plugin, system units outside `/home/byk/.local/share/opencode-v2-pilot/supervisor`, and prohibited starting or installing services. *…