Dashboard › opencode › Session 11qIXHPNH6kw
11qIXHPNH6kwizEpWPerform a substantive independent READ-ONLY correctness review of the exact current files under /home/byk/.local/share/opencode-v2-pilot/supervisor, /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts, /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts, /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service, and /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md. This is a fresh review after a major revision. Inspect every changed source/test/unit/doc and all three binaries; verify hashes and reproducible source builds. Verify pinned go-systemd/godbus and Node APIs when needed. Focus on actual end-to-end plugin/helper/supervisor protocol, Node socket fd inheritance and helper semantics, SCM_RIGHTS framing, exact protocol parity and limits, authentication lifetime/rechecks, correct Unit vs Service interfaces, ambiguous start cleanup, bounded lifecycle/disconnect/backpressure handling, output ordering and structured exit, launcher PTY/interactive argv behavior, systemd property types/effective semantics, cleanup failure behavior, tests' realism, and whether direct-spawn fallback is truly absent. Do not edit files, install/start services, or perform privileged operations. You may run unprivileged tests. Cite current file:line evidence, classify PASS/CONCERN/MUST-FIX, name exact blockers, and end exactly MERGE or DO-NOT-MERGE.
I’ll freeze the review target by inventorying files and hashing all artifacts first, then trace the protocol and lifecycle end to end against pinned dependency source. I’ll keep the review read-only, run only unprivileged builds/tests, and report evidence from the exact files reviewed.
[
{
"content": "Inventory and hash exact review files, changed artifacts, binaries, and build metadata",
"status": "in_progress",
"priority": "high"
},
{
"content": "Trace plugin, transport, helper, supervisor, systemd unit, and cutover protocol end to end",
"status": "pending",
"priority": "high"
},
{
"content": "Verify pinned Go, godbus, go-systemd, Node APIs, systemd property semantics, and binary provenance",
"status": "pending",
"priority": "high"
},
{
"content": "Run unprivileged tests and reproducible source builds, then compare binary hashes",
"status": "pending",
"priority": "high"
},
{
"content": "Review tests and documents for realism and issue final classified verdict",
"status": "pending",
"priority": "high"
}
]
/home/byk/.local/share/opencode-v2-pilot/supervisor/ROOT-ACCEPTANCE.md /home/byk/.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md /home/byk/.local/share/opencode-v2-pilot/supervisor/bin/opencode-pty-client /home/byk/.local/share/opencode-v2-pilot/supervisor/bin/opencode-pty-launcher /home/byk/.local/share/opencode-v2-pilot/supervisor/bin/opencode-pty-supervisor /home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty.slice /home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service /home/byk/.local/share/opencode-v2-pilot/supervisor/go.sum /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/supervisor/main.go /home/byk/.local/share/opencode-v2-pilot/supervisor/go.mod /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/go.mod</path> <type>file</type> <content> 1: module opencode-pty-supervisor 2: 3: go 1.22 4: 5: require ( 6: github.com/coreos/go-systemd/v22 v22.5.0 7: github.com/godbus/dbus/v5 v5.1.0 8: golang.org/x/sys v0.20.0 9: ) (End of file - total 9 lines) </content>
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame.go</path>
<type>file</type>
<content>
1: package protocol
2:
3: import (
4: "encoding/binary"
5: "errors"
6: "fmt"
7: "io"
8: "strings"
9: "unicode/utf8"
10: )
11:
12: const (
13: HeaderSize = 12
14: MaxFrameSize = 70 * 1024
15: MaxIOPayloadSize = 32 * 1024
16: Version = 1
17:
18: TypeStart = 1
19: TypeInput = 2
20: TypeOutput = 3
21: TypeExit = 4
22: TypeError = 5
23: TypeStarted = 6
24: TypeStop = 7
25: TypeStopped = 8
26:
27: MaxArgs = 128
28: MaxCommandSize = 4096
29: MaxArgSize = 16384
30: MaxArgsSize = 65536
31: MaxRuntimeSec = 3600
32: )
33:
34: var (
35: magic = [4]byte{'O', 'P', 'T', 'Y'}
36: ErrInvalidFrame = errors.New("invalid frame")
37: ErrFrameTooLarge = errors.New("frame too large")
38: )
39:
40: type Frame struct {
41: Type byte
42: Payload []byte
43: }
44:
45: type Start struct {
46: Device ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "bytes"
5: "context"
6: "errors"
7: "fmt"
8: "net"
9:
10: "golang.org/x/sys/unix"
11: )
12:
13: type authenticatedPeer struct {
14: credential *unix.Ucred
15: pidfd int
16: identity clientIdentity
17: }
18:
19: func authenticate(ctx context.Context, connection *net.UnixConn, manager unitManager, expectedUID uint32, expectedGID uint32) (*authenticatedPeer, error) {
20: credential, pidfd, err := peerIdentity(connection)
21: if err != nil {
22: return nil, err
23: }
24: peer := &authenticatedPeer{credential: credential, pidfd: pidfd}
25: if err := peer.validateCredentials(expectedUID, expectedGID); err != nil {
26: peer.Close()
27: return nil, err
28: }
29: identity, err := manager.ClientState(ctx)
30: if err != nil {
31: peer.Close()
32: return nil, fmt.Errorf("query client service: %w", ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go</path> <type>file</type> <content> 1: package supervisor 2: 3: import ( 4: "context" 5: "encoding/base64" 6: "errors" 7: "fmt" 8: "net" 9: "os" 10: "regexp" 11: "time" 12: 13: systemddbus "github.com/coreos/go-systemd/v22/dbus" 14: "github.com/godbus/dbus/v5" 15: ) 16: 17: const ( 18: clientService = "opencode-v2.service" 19: supervisorService = "opencode-pty-supervisor.service" 20: ptySlice = "opencode-pty.slice" 21: expectedClientCgroup = "/system.slice/opencode-v2.service" 22: launcherPath = "/usr/local/libexec/opencode-pty-launcher" 23: unitPrefix = "opencode-pty-" 24: unitSuffix = ".service" 25: operationTimeout = 5 * time.Second 26: stopTimeout = 15 * time.Second 27: outputDrainTimeout = 2 * time.Second 28: defaultRuntimeSec = 3600 29: perSessionMemoryMax = 512 * 1024 * 1024 30: ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "crypto/rand"
6: "encoding/binary"
7: "errors"
8: "fmt"
9: "io"
10: "log"
11: "net"
12: "os"
13: "os/user"
14: "strconv"
15: "sync"
16: "syscall"
17: "time"
18: "unicode/utf8"
19:
20: "opencode-pty-supervisor/internal/protocol"
21:
22: "golang.org/x/sys/unix"
23: )
24:
25: const (
26: socketPath = "/run/opencode-pty/supervisor.sock"
27: maxSessions = 16
28: maxUnauthenticated = 32
29: maxAdmissionsPerMinute = 120
30: socketBufferSize = 128 * 1024
31: handshakeTimeout = 5 * time.Second
32: )
33:
34: var errStopRequested = errors.New("client requested stop")
35:
36: type Server struct {
37: manager unitManager
38: listener *net.UnixListener
39: sessions chan struct{}
40: unauthenticated chan struct{}
41: connections ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "encoding/base64"
5: "errors"
6: "fmt"
7: "os"
8: "strconv"
9: "strings"
10: "syscall"
11:
12: "opencode-pty-supervisor/internal/protocol"
13:
14: "golang.org/x/sys/unix"
15: )
16:
17: const (
18: socketFD = 3
19: cwdFD = 4
20: )
21:
22: func main() {
23: if err := sendStart(socketFD, cwdFD, os.Args[1:]); err != nil {
24: fmt.Fprintln(os.Stderr, err)
25: os.Exit(1)
26: }
27: }
28:
29: func sendStart(socket, cwd int, values []string) error {
30: unix.CloseOnExec(socket)
31: unix.CloseOnExec(cwd)
32: if _, err := unix.Getpeername(socket); err != nil {
33: return fmt.Errorf("validate inherited connected socket: %w", err)
34: }
35: var stat unix.Stat_t
36: if err := unix.Fstat(cwd, &stat); err != nil {
37: return fmt.Errorf("inspect inherited cwd: %w", err)
38: }
39: if stat.Mode&unix.S_IFMT != unix.S_IFDIR ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "encoding/base64"
5: "errors"
6: "fmt"
7: "os"
8: "strings"
9: "syscall"
10:
11: "opencode-pty-supervisor/internal/protocol"
12:
13: "golang.org/x/sys/unix"
14: )
15:
16: const encodedArgumentsEnvironment = "OPENCODE_PTY_ARGV"
17:
18: const launcherFD = 3
19:
20: func main() {
21: if err := run(os.Args[1:]); err != nil {
22: fmt.Fprintln(os.Stderr, err)
23: os.Exit(1)
24: }
25: }
26:
27: func run(values []string) error {
28: if len(values) == 1 && values[0] == "--exec" {
29: return execCommand()
30: }
31: if _, err := decodeArguments(values); err != nil {
32: return err
33: }
34: if err := syscall.Fchdir(2); err != nil {
35: return fmt.Errorf("fchdir approved cwd: %w", err)
36: }
37: if err := syscall.Dup2(1, 2); err != nil {
38: return fmt.Errorf("replace cwd descriptor: %w", err)
39: }
40: if err := ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/supervisor/main.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "context"
5: "fmt"
6: "os"
7: "os/signal"
8: "syscall"
9:
10: "opencode-pty-supervisor/internal/supervisor"
11: )
12:
13: func main() {
14: ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
15: defer cancel()
16: manager, err := supervisor.NewSystemdManager(ctx)
17: if err != nil {
18: fmt.Fprintln(os.Stderr, err)
19: os.Exit(1)
20: }
21: defer manager.Close()
22: server, err := supervisor.NewServer(manager)
23: if err != nil {
24: fmt.Fprintln(os.Stderr, err)
25: os.Exit(1)
26: }
27: if err := server.Serve(ctx); err != nil {
28: fmt.Fprintln(os.Stderr, err)
29: os.Exit(1)
30: }
31: }
(End of file - total 31 lines)
</content>
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts</path>
<type>file</type>
<content>
1: import { spawn } from "node:child_process"
2: import type { ChildProcess } from "node:child_process"
3: import { isUtf8 } from "node:buffer"
4: import { fstatSync } from "node:fs"
5: import { stat } from "node:fs/promises"
6: import type { FileHandle } from "node:fs/promises"
7: import { createConnection } from "node:net"
8: import type { Socket } from "node:net"
9:
10: const MAGIC = Buffer.from("OPTY")
11: const VERSION = 1
12: const HEADER_SIZE = 12
13: const MAX_FRAME_SIZE = 70 * 1024
14: const MAX_IO_PAYLOAD_SIZE = 32 * 1024
15: const TYPE_INPUT = 2
16: const TYPE_OUTPUT = 3
17: const TYPE_EXIT = 4
18: const TYPE_ERROR = 5
19: const TYPE_STARTED = 6
20: const TYPE_STOP = 7
21: const TYPE_STOPPED = 8
22: const DEFAULT_SOCKET_PATH = "/run/opencode-pty/supervisor.sock"
23: const DEFAULT_HELPER_PATH = "/usr/local/libexec/opencode-pty-client"
24: const ...
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts</path>
<type>file</type>
<content>
1: import { Plugin } from "@opencode/plugin"
2: import type { Context } from "@opencode/plugin/plugin"
3: import type { ToolContext } from "@opencode/plugin/tool"
4: import { Schema } from "effect"
5: import { spawn } from "node:child_process"
6: import { open, realpath } from "node:fs/promises"
7: import type { FileHandle } from "node:fs/promises"
8: import { constants } from "node:fs"
9: import { assertSupervisorAvailable, openSupervisorTransport } from "./pty-transport"
10: import type { SupervisorOptions, SupervisorTransport } from "./pty-transport"
11:
12: type PtyPluginOptions = SupervisorOptions & {
13: assertAvailable?: typeof assertSupervisorAvailable
14: openTransport?: typeof openSupervisorTransport
15: }
16:
17: const MAX_BUFFER_SIZE = 1_000_000
18: const MAX_SESSIONS = 16
19: const MAX_SESSIONS_PER_OWNER = 5
20: const DEFAULT_READ_LIMIT = 500
21: const ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame_test.go</path>
<type>file</type>
<content>
1: package protocol
2:
3: import (
4: "bytes"
5: "errors"
6: "strings"
7: "testing"
8: )
9:
10: func TestStartRoundTrip(t *testing.T) {
11: want := Start{Device: 12, Inode: 34, RuntimeSec: 60, Command: "printf", Args: []string{"%s", "hello world"}}
12: payload, err := EncodeStart(want)
13: if err != nil {
14: t.Fatal(err)
15: }
16: got, err := DecodeStart(payload)
17: if err != nil {
18: t.Fatal(err)
19: }
20: if got.Device != want.Device || got.Inode != want.Inode || got.RuntimeSec != want.RuntimeSec || got.Command != want.Command || strings.Join(got.Args, "\x00") != strings.Join(want.Args, "\x00") {
21: t.Fatalf("got %#v, want %#v", got, want)
22: }
23: }
24:
25: func TestFrameRoundTrip(t *testing.T) {
26: var buffer bytes.Buffer
27: want := Frame{Type: TypeInput, Payload: []byte("hello")}
28: if err := WriteFrame(&buffer, want); err ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main_test.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "bytes"
5: "encoding/base64"
6: "encoding/json"
7: "fmt"
8: "net"
9: "os"
10: "os/exec"
11: "path/filepath"
12: "strings"
13: "testing"
14:
15: "opencode-pty-supervisor/internal/protocol"
16:
17: "golang.org/x/sys/unix"
18: )
19:
20: func TestNodePassesConnectedSocketWithoutChangingPeerMainPID(t *testing.T) {
21: if os.Getenv("OPENCODE_CLIENT_HELPER_TEST") == "1" {
22: encoded := func(value string) string { return "a" + base64.RawURLEncoding.EncodeToString([]byte(value)) }
23: if err := sendStart(socketFD, cwdFD, []string{"60", encoded("/bin/true")}); err != nil {
24: t.Fatal(err)
25: }
26: return
27: }
28: node, err := exec.Command("node", "-p", "process.execPath").Output()
29: if err != nil {
30: t.Skip("node runtime is unavailable")
31: }
32: socketPath := filepath.Join(t.TempDir(), ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "bytes"
5: "encoding/base64"
6: "errors"
7: "os"
8: "os/exec"
9: "strings"
10: "testing"
11: )
12:
13: func TestDecodeArgumentsPreservesEveryArgument(t *testing.T) {
14: encoded := []string{
15: "a" + base64.RawURLEncoding.EncodeToString([]byte("printf")),
16: "a" + base64.RawURLEncoding.EncodeToString([]byte("%s\\n")),
17: "a" + base64.RawURLEncoding.EncodeToString([]byte("a'b; $(id)")),
18: "a",
19: }
20: got, err := decodeArguments(encoded)
21: if err != nil {
22: t.Fatal(err)
23: }
24: want := []string{"printf", "%s\\n", "a'b; $(id)", ""}
25: if strings.Join(got, "\x00") != strings.Join(want, "\x00") {
26: t.Fatalf("got %#v, want %#v", got, want)
27: }
28: }
29:
30: func TestDecodeArgumentsRejectsInvalidGrammar(t *testing.T) {
31: if _, err := decodeArguments([]string{"bad="}); err == nil {
32: ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth_test.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "os"
6: "testing"
7: )
8:
9: type authenticationManager struct {
10: identity clientIdentity
11: }
12:
13: func (manager *authenticationManager) ClientState(context.Context) (clientIdentity, error) {
14: return manager.identity, nil
15: }
16:
17: func (*authenticationManager) Start(context.Context, string, protocolCommand, *os.File, *os.File, uint32) error {
18: return nil
19: }
20:
21: func (*authenticationManager) StopAndWait(context.Context, string) error { return nil }
22: func (*authenticationManager) Wait(context.Context, string) (unitResult, error) {
23: return unitResult{}, nil
24: }
25: func (*authenticationManager) CleanupOrphans(context.Context) error { return nil }
26: func (*authenticationManager) Close() {}
27:
28: func currentIdentity() clientIdentity ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "errors"
6: "os"
7: "testing"
8: "time"
9:
10: "github.com/godbus/dbus/v5"
11: )
12:
13: func TestUnitNameGrammar(t *testing.T) {
14: valid := "opencode-pty-0123456789abcdef0123456789abcdef.service"
15: if !validUnitName(valid) {
16: t.Fatalf("rejected %q", valid)
17: }
18: for _, invalid := range []string{
19: "opencode-pty-.service",
20: "opencode-pty-0123456789ABCDEF0123456789ABCDEF.service",
21: "opencode-pty-0123456789abcdef0123456789abcdef.scope",
22: "opencode-pty-0123456789abcdef0123456789abcdef.service/../x",
23: } {
24: if validUnitName(invalid) {
25: t.Fatalf("accepted %q", invalid)
26: }
27: }
28: }
29:
30: func TestWaitForUnitSignalRejectsClosedChannelAndHonorsTimeout(t *testing.T) {
31: closed := make(chan *dbus.Signal)
32: close(closed)
33: if err := ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "bytes"
5: "context"
6: "encoding/binary"
7: "encoding/json"
8: "errors"
9: "fmt"
10: "io"
11: "net"
12: "os"
13: "os/exec"
14: "path/filepath"
15: "sync"
16: "syscall"
17: "testing"
18: "time"
19:
20: "opencode-pty-supervisor/internal/protocol"
21:
22: "golang.org/x/sys/unix"
23: )
24:
25: type sessionManager struct {
26: startErr error
27: wait chan unitResult
28: stop func() error
29: stopped chan struct{}
30: once sync.Once
31: }
32:
33: func (*sessionManager) ClientState(context.Context) (clientIdentity, error) {
34: return currentIdentity(), nil
35: }
36:
37: func (manager *sessionManager) Start(context.Context, string, protocolCommand, *os.File, *os.File, uint32) error {
38: return manager.startErr
39: }
40:
41: func (manager *sessionManager) ...
/home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/src/NonEmptyIterable.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/dist/NonEmptyIterable.d.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/dist/NonEmptyIterable.js.map /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/dist/NonEmptyIterable.d.ts.map /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/dist/NonEmptyIterable.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-pty/rust-pty/target/release/librust_pty.so /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-pty/rust-pty/target/release/librust_pty_musl.so /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-pty/rust-pty...
/home/byk/.local/share/opencode-v2-pilot/config/opencode/test/followup.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-types/test.d.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-types/test-globals.d.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-pty/src/terminal.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-pty/src/terminal.integration.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-pty/src/interfaces.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/bun-pty/src/index.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/@types/node/test.d.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/ai-docs/src/09_testing/20_layer-tests.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/ai-docs/src/09_testing/10_effect-tests....
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md</path> <type>file</type> <content> 1: # PTY supervisor protocol 2: 3: The protocol uses one Unix `SOCK_STREAM` connection for one PTY. The Node SEA process opens and retains the connection. The supervisor authenticates that connection's immutable peer credentials against the exact `opencode-v2.service` MainPID. The client helper never opens the socket. Node starts the fixed root-owned helper with duplicates of the connected socket at fd 3 and the approved directory at fd 4. The helper sends the start frame and fd 4, then exits. All other Node child processes inherit neither descriptor. 4: 5: Every frame has a 12-byte header: 6: 7: - bytes 0–3: ASCII `OPTY` 8: - byte 4: version `1` 9: - byte 5: type 10: - bytes 6–7: zero 11: - bytes 8–11: unsigned big-endian payload length 12: 13: The largest frame payload is 71,680 bytes. Input and output payloads never exceed 32,768 bytes. ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/ROOT-ACCEPTANCE.md</path> <type>file</type> <content> 1: # Root-only acceptance 2: 3: Do not install, start, enable, or mark the candidate ready until every check below passes on the exact target host. Source tests never substitute for these checks. 4: 5: 1. Rebuild all three binaries reproducibly from the reviewed source. Record the source revision, Go version, dependency sums, build commands, and SHA-256 hashes. Install only those hashes in the root-controlled path: 6: 7: ```sh 8: sudo install -d -o root -g root -m 0755 /usr/local/libexec 9: sudo install -o root -g root -m 0755 bin/opencode-pty-supervisor /usr/local/libexec/opencode-pty-supervisor 10: sudo install -o root -g root -m 0755 bin/opencode-pty-launcher /usr/local/libexec/opencode-pty-launcher 11: sudo install -o root -g root -m 0755 bin/opencode-pty-client /usr/local/libexec/opencode-pty-client 12: ``` 13: 14: 2. ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service</path> <type>file</type> <content> 1: [Unit] 2: Description=OpenCode PTY supervisor 3: After=dbus.service 4: Requires=dbus.service 5: 6: [Service] 7: Type=exec 8: User=root 9: Group=byk 10: SupplementaryGroups= 11: ExecStart=/usr/local/libexec/opencode-pty-supervisor 12: RuntimeDirectory=opencode-pty 13: RuntimeDirectoryMode=0750 14: RuntimeDirectoryPreserve=no 15: NoNewPrivileges=yes 16: CapabilityBoundingSet= 17: AmbientCapabilities= 18: UMask=0077 19: KillMode=control-group 20: KillSignal=SIGTERM 21: FinalKillSignal=SIGKILL 22: SendSIGKILL=yes 23: TimeoutStopSec=20s 24: OOMPolicy=kill 25: Delegate=no 26: RestrictAddressFamilies=AF_UNIX 27: PrivateTmp=yes 28: PrivateDevices=yes 29: PrivateMounts=yes 30: PrivateNetwork=yes 31: ProtectSystem=strict 32: ProtectHome=yes 33: ProtectKernelTunables=yes 34: ProtectKernelModules=yes 35: ProtectKernelLogs=yes 36: ProtectControlGroups=yes 37: ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty.slice</path> <type>file</type> <content> 1: [Unit] 2: Description=OpenCode isolated PTY sessions 3: Before=slices.target 4: 5: [Slice] 6: CPUAccounting=yes 7: MemoryAccounting=yes 8: TasksAccounting=yes 9: IOAccounting=yes 10: CPUQuota=800% 11: IOWeight=100 12: MemoryHigh=1536M 13: MemoryMax=2G 14: TasksMax=512 (End of file - total 14 lines) </content>
<path>/home/byk/.local/share/opencode-v2-pilot/opencode-v2.service</path> <type>file</type> <content> 1: [Unit] 2: Description=OpenCode V2 Server 3: After=network.target opencode-pty-supervisor.service 4: Requires=opencode-pty-supervisor.service 5: 6: [Service] 7: Type=simple 8: EnvironmentFile=/home/byk/.opencode/env 9: EnvironmentFile=/home/byk/.local/share/opencode-v2-pilot/server.env 10: Environment=OPENCODE_CONFIG_DIR=/home/byk/.local/share/opencode-v2-pilot/config/opencode 11: Environment=OPENCODE_DB=/home/byk/.local/share/opencode-v2-pilot/data/opencode/opencode.db 12: Environment=XDG_DATA_HOME=/home/byk/.local/share/opencode-v2-pilot/data 13: Environment=XDG_CACHE_HOME=/home/byk/.local/share/opencode-v2-pilot/cache 14: Environment=XDG_CONFIG_HOME=/home/byk/.local/share/opencode-v2-pilot/config 15: Environment=XDG_STATE_HOME=/home/byk/.local/share/opencode-v2-pilot/state 16: User=byk 17: WorkingDirectory=/home/byk 18: ExecCondition=/bin/sh -c 'test -f ...
<path>/home/byk/.local/share/opencode-v2-pilot/CUTOVER.md</path> <type>file</type> <content> 1: # OpenCode V2 cutover 2: 3: The V2 executable serves the API and web UI from one origin. Do not add nginx. 4: 5: ## Preflight 6: 7: 1. Confirm production is still healthy on port 4096. 8: 2. Confirm the candidate revision and smoke build: 9: `git -C /home/byk/Code/opencode-v2-pilot rev-parse HEAD` 10: `/home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node --version` 11: 3. Confirm the isolated candidate on port 14102: 12: `curl --fail --user opencode:$OPENCODE_PASSWORD http://127.0.0.1:14102/api/health` 13: `curl --fail http://127.0.0.1:14102/ >/dev/null` 14: 4. Confirm both local plugins are active after calling `POST /api/plugin/await-activation`. 15: 5. Create `/home/byk/.local/share/opencode-v2-pilot/server.env` with mode `0600` and one line: `OPENCODE_PASSWORD=<password>`. 16: 6. ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor</path> <type>directory</type> <entries> bin/ cmd/ go.mod go.sum internal/ opencode-pty-supervisor.service opencode-pty.slice PROTOCOL.md ROOT-ACCEPTANCE.md (9 entries) </entries>
<path>/home/byk/.local/share/opencode-v2-pilot</path> <type>directory</type> <entries> cache/ config/ CUTOVER.md data/ opencode-v2.service state/ supervisor/ (7 entries) </entries>
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/go.sum</path> <type>file</type> <content> 1: github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs= 2: github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= 3: github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= 4: github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= 5: github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= 6: golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= 7: golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= (End of file - total 7 lines) </content>
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/package.json</path>
<type>file</type>
<content>
1: {
2: "private": true,
3: "type": "module",
4: "dependencies": {
5: "effect": "4.0.0-rc.112"
6: },
7: "devDependencies": {
8: "@types/bun": "1.2.21"
9: }
10: }
(End of file - total 10 lines)
</content>
No files found
Found 41 matches
/home/byk/Code/opencode-v2-pilot/packages/sdk/src/tool.ts:
Line 3: export type { ToolContext as Context, Info } from "@opencode/plugin/promise/tool"
/home/byk/Code/opencode-v2-pilot/packages/sdk/src/effect/tool.ts:
Line 3: export type { Context, Info } from "@opencode/schema/tool"
/home/byk/Code/opencode-v2-pilot/packages/schema/src/tool.ts:
Line 14: export interface Context {
/home/byk/Code/opencode-v2-pilot/packages/schema/src/rpc.ts:
Line 54: export function define<const D extends Definition>(definition: D) {
/home/byk/Code/opencode-v2-pilot/packages/theme/src/tui/types.ts:
Line 71: export type ContextName = "elevated" | "overlay"
/home/byk/Code/opencode-v2-pilot/packages/theme/src/tui/schema.ts:
Line 44: export type ContextKey = Schema.Schema.Type<typeof ContextKey>
/home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/context.ts:
Line 501: export interface Context ...
File not found: /home/byk/Code/opencode-v2-pilot/packages/plugin/src/index.ts
/home/byk/Code/opencode-v2-pilot/packages/plugin/src/worktree.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/storage.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/source.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/source.node.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/source.bun.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/rpc.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/host.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/README.md /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/context.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/solid.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/plugin.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/index.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/worktree.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/websearch.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/vcs.ts /home/b...
<path>/home/byk/Code/opencode-v2-pilot/packages/plugin/package.json</path>
<type>file</type>
<content>
1: {
2: "$schema": "https://json.schemastore.org/package.json",
3: "name": "@opencode/plugin",
4: "version": "1.18.15",
5: "type": "module",
6: "license": "MIT",
7: "scripts": {
8: "test": "bun test --only-failures",
9: "typecheck": "tsgo --noEmit",
10: "build": "tsc -p tsconfig.build.json"
11: },
12: "exports": {
13: ".": "./src/promise/index.ts",
14: "./effect": "./src/effect/index.ts",
15: "./host": "./src/host.ts",
16: "./tui": "./src/tui/index.ts",
17: "./*": "./src/*.ts"
18: },
19: "imports": {
20: "#plugin-source": {
21: "bun": "./src/source.bun.ts",
22: "node": "./src/source.node.ts",
23: "default": "./src/source.node.ts"
24: }
25: },
26: "files": [
27: "dist"
28: ],
29: "dependencies": {
30: "@ai-sdk/provider": "3.0.8",
31: "@opencode/ai": "workspace:*",
32: ...
c5c09ece21c802868721dfc3e2610496ad9630c1b3a4c258104bc92b2bd9aca1 bin/opencode-pty-supervisor d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd bin/opencode-pty-launcher fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde bin/opencode-pty-client bin/opencode-pty-supervisor regular file byk:byk 755 4407495 2026-09-08 06:38:38.491406077 +0000 bin/opencode-pty-launcher regular file byk:byk 755 2098942 2026-09-08 06:38:38.512405908 +0000 bin/opencode-pty-client regular file byk:byk 755 2109912 2026-09-08 06:38:38.524405811 +0000 bin/opencode-pty-supervisor: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, with debug_info, not stripped bin/opencode-pty-launcher: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, with debug_info, not stripped bin/opencode-pty-client: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, with debug_info, not stripped
go version go1.22.2 linux/amd64 bin/opencode-pty-supervisor: go1.22.2 path opencode-pty-supervisor/cmd/supervisor mod opencode-pty-supervisor (devel) dep github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs= dep github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= dep golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= build -buildmode=exe build -compiler=gc build -trimpath=true build CGO_ENABLED=0 build GOARCH=amd64 build GOOS=linux build GOAMD64=v1 bin/opencode-pty-launcher: go1.22.2 path opencode-pty-supervisor/cmd/launcher mod opencode-pty-supervisor (devel) dep golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= build -buildmode=exe build -compiler=gc build -trimpath=true build CGO_ENABLED=0 build GOARCH=amd64 build GOOS=linux build GOAMD64=v1 bin/opencode-pty-client: ...
d1d088bdd65f99056657717658d3336ae233acd2ad39fa998ebe8a773f68348e go.mod dad6a6773121326ee41a6a081cf310444b6fcd3540f28f4b3f31de559d31726b go.sum 83ef89be747e6c1bd51ba1474307980dd4e9d4c1d17360be1c02538c990f832d internal/protocol/frame.go c7c45eeaf44411bd6fe87998fce153cb8decda5df7d7e805fad9dc6f6cdfd591 internal/protocol/frame_test.go 7e87448cedd42966156ecd3a17e654ccec15e11d276ccdcf014c0fa66b49a974 internal/supervisor/auth.go 9fc722a3e84e6a445c66a031882fc40ae6fc1f0216c21cd0e50770621bd6c7eb internal/supervisor/auth_test.go 6e4230fcd20b8f5cdc6d417776ba1ea0bd6032882f358352ba1fd46bd71b6589 internal/supervisor/server.go 7ef99b1f2cb77bf573327688d7ac734e712c4560154eee504a72203676a0285b internal/supervisor/server_test.go 7e1c6de7d917b584e207788899d9af5a96b262a5a7b52fcf8f1196dcfc0188cf internal/supervisor/systemd.go eede59ca6e0927c9ab8524b7a10cc59a32b0332250d7d45210f5c22f114ce4e1 internal/supervisor/systemd_test.go 9471c8c9dd2a8c00274e1e6ecc89983377c3810e2a7ad47b962df19ce6d2995b ...
The artifact set is now fixed by SHA-256. The three shipped binaries report Go 1.22.2, -trimpath, CGO_ENABLED=0, and the exact module sums in go.sum; I’m now checking whether the implementation matches those dependency and runtime contracts before rebuilding.
/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/subscription_test.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/subscription_set_test.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/subscription_set.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/subscription.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/set_test.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/set.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/properties.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods_test.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/dbus_test.go /home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/dbus.go
Found 10 matches
/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/properties.go:
Line 57: func PropExecStart(command []string, uncleanIsFailure bool) Property {
Line 83: func PropType(t string) Property {
Line 138: func PropBindsTo(units ...string) Property {
Line 186: func PropAfter(units ...string) Property {
Line 222: func PropSlice(slice string) Property {
/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods.go:
Line 122: func (c *Conn) StopUnitContext(ctx context.Context, name string, mode string, ch chan<- string) (int, error) {
Line 191: func (c *Conn) StartTransientUnitContext(ctx context.Context, name string, mode string, properties []Property, ch chan<- string) (int, error) {
Line 272: func (c *Conn) GetUnitPropertiesContext(ctx context.Context, unit string) (map[string]interface{}, error) {
Line 347: func (c *Conn) GetUnitTypePropertiesContext(ctx context.Context, unit string, unitType string) ...
<path>/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods.go</path>
<type>file</type>
<content>
100: // job timeout was reached. failed indicates that the job failed. dependency
101: // indicates that a job this job has been depending on failed and the job hence
102: // has been removed too. skipped indicates that a job was skipped because it
103: // didn't apply to the units current state.
104: //
105: // If no error occurs, the ID of the underlying systemd job will be returned. There
106: // does exist the possibility for no error to be returned, but for the returned job
107: // ID to be 0. In this case, the actual underlying ID is not 0 and this datapoint
108: // should not be considered authoritative.
109: //
110: // If an error does occur, it will be returned to the user alongside a job ID of 0.
111: func (c *Conn) StartUnitContext(ctx context.Context, name string, mode string, ch chan<- string) (int, error) {
112: return c.startJob(ctx, ch, ...
<path>/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods.go</path>
<type>file</type>
<content>
250:
251: obj := c.sysconn.Object("org.freedesktop.systemd1", path)
252: err = obj.CallWithContext(ctx, "org.freedesktop.DBus.Properties.GetAll", 0, dbusInterface).Store(&props)
253: if err != nil {
254: return nil, err
255: }
256:
257: out := make(map[string]interface{}, len(props))
258: for k, v := range props {
259: out[k] = v.Value()
260: }
261:
262: return out, nil
263: }
264:
265: // Deprecated: use GetUnitPropertiesContext instead.
266: func (c *Conn) GetUnitProperties(unit string) (map[string]interface{}, error) {
267: return c.GetUnitPropertiesContext(context.Background(), unit)
268: }
269:
270: // GetUnitPropertiesContext takes the (unescaped) unit name and returns all of
271: // its dbus object properties.
272: func (c *Conn) GetUnitPropertiesContext(ctx context.Context, unit string) (map[string]interface{}, error) {
273: path := ...
<path>/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/properties.go</path>
<type>file</type>
<content>
40: }
41:
42: type PropertyCollection struct {
43: Name string
44: Properties []Property
45: }
46:
47: type execStart struct {
48: Path string // the binary path to execute
49: Args []string // an array with all arguments to pass to the executed command, starting with argument 0
50: UncleanIsFailure bool // a boolean whether it should be considered a failure if the process exits uncleanly
51: }
52:
53: // PropExecStart sets the ExecStart service property. The first argument is a
54: // slice with the binary path to execute followed by the arguments to pass to
55: // the executed command. See
56: // http://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
57: func PropExecStart(command []string, uncleanIsFailure bool) Property {
58: execStarts := []execStart{
59: {
60: Path: ...
Found 77 matches
/home/byk/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.13.linux-amd64/src/vendor/golang.org/x/net/dns/dnsmessage/message.go:
Line 772: func (p *Parser) AuthorityHeader() (ResourceHeader, error) {
Line 777: func (p *Parser) Authority() (Resource, error) {
/home/byk/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.13.linux-amd64/src/net/textproto/textproto.go:
Line 68: func NewConn(conn io.ReadWriteCloser) *Conn {
/home/byk/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.13.linux-amd64/src/net/smtp/smtp.go:
Line 98: func (c *Client) Hello(localName string) error {
Line 197: func (c *Client) Auth(a Auth) error {
/home/byk/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.13.linux-amd64/src/net/http/socks_bundle.go:
Line 443: func (up *socksUsernamePassword) Authenticate(ctx context.Context, rw io.ReadWriter, auth socksAuthMethod) error ...
<path>/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods.go</path>
<type>file</type>
<content>
40: var id uint32
41: var job dbus.ObjectPath
42: var unit string
43: var result string
44: dbus.Store(signal.Body, &id, &job, &unit, &result)
45: c.jobListener.Lock()
46: out, ok := c.jobListener.jobs[job]
47: if ok {
48: out <- result
49: delete(c.jobListener.jobs, job)
50: }
51: c.jobListener.Unlock()
52: }
53:
54: func (c *Conn) startJob(ctx context.Context, ch chan<- string, job string, args ...interface{}) (int, error) {
55: if ch != nil {
56: c.jobListener.Lock()
57: defer c.jobListener.Unlock()
58: }
59:
60: var p dbus.ObjectPath
61: err := c.sysobj.CallWithContext(ctx, job, 0, args...).Store(&p)
62: if err != nil {
63: return 0, err
64: }
65:
66: if ch != nil {
67: c.jobListener.jobs[p] = ch
68: }
69:
70: // ignore error since 0 is fine if conversion fails
71: jobID, _ := strconv.Atoi(path.Base(string(p)))
72:
73: return ...
drwxr-xr-x 6 byk byk 4096 Sep 8 06:47 /tmp/opencode
? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/cmd/client 0.220s ok opencode-pty-supervisor/cmd/launcher 1.067s ok opencode-pty-supervisor/internal/protocol 0.007s ok opencode-pty-supervisor/internal/supervisor 2.595s
? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/cmd/client 2.241s ok opencode-pty-supervisor/cmd/launcher 2.097s ok opencode-pty-supervisor/internal/protocol 1.031s ok opencode-pty-supervisor/internal/supervisor 3.614s
b8f1914dfea234ec86c74cc9d4c087c3b6db4a8f333d1f1d2624238745db366a /tmp/opencode/pty-review.DL0iOT/opencode-pty-supervisor d4f483d2f5824137da5a11c798f4ef7b2b13261954236488eaf6fa4d290d8d0c /tmp/opencode/pty-review.DL0iOT/opencode-pty-launcher b6cd329200d5dae973f6a53a486d0ae90e938ee26703ed39c2f11eebf385ace3 /tmp/opencode/pty-review.DL0iOT/opencode-pty-client builddir=/tmp/opencode/pty-review.DL0iOT
The current source builds are not byte-identical to the three shipped binaries; all three comparisons failed despite matching Go/module metadata. I’m separating a stale-binary problem from a nondeterministic-build problem by rebuilding a second time and comparing build IDs and bytes.
b8f1914dfea234ec86c74cc9d4c087c3b6db4a8f333d1f1d2624238745db366a /tmp/opencode/pty-review.tzR3OV/opencode-pty-supervisor d4f483d2f5824137da5a11c798f4ef7b2b13261954236488eaf6fa4d290d8d0c /tmp/opencode/pty-review.tzR3OV/opencode-pty-launcher b6cd329200d5dae973f6a53a486d0ae90e938ee26703ed39c2f11eebf385ace3 /tmp/opencode/pty-review.tzR3OV/opencode-pty-client second=/tmp/opencode/pty-review.tzR3OV opencode-pty-supervisor shipped= opencode-pty-supervisor rebuilt=X7uuC5VQs-Pi-CM5KkWZ/kkhua8CfrFuCgWTs5SIN/ooGNSymP4_kEy3kieQO8/u-09TBWm-qCHm6OuWF0g opencode-pty-supervisor rebuilds=identical opencode-pty-launcher shipped= opencode-pty-launcher rebuilt=VWY-fgfTf2y2Get3IcVr/LdudBBCNOyYpTUXtFrXm/7lnZocARUX26Z8ZDflb3/KJMRsdPNiEq9OM7-6vAp opencode-pty-launcher rebuilds=identical opencode-pty-client shipped= opencode-pty-client rebuilt=FmYup255hQfTyKyM0npi/FXLWPxcEl0Lalgu7xkay/CJz4EzsssM_mihTcrsGt/2rrPRVzHq3ixsrtHJZHw opencode-pty-client rebuilds=identical
c5c09ece21c802868721dfc3e2610496ad9630c1b3a4c258104bc92b2bd9aca1 /tmp/opencode/pty-review.pS9Xqv/opencode-pty-supervisor d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd /tmp/opencode/pty-review.pS9Xqv/opencode-pty-launcher fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde /tmp/opencode/pty-review.pS9Xqv/opencode-pty-client third=/tmp/opencode/pty-review.pS9Xqv opencode-pty-supervisor=identical opencode-pty-launcher=identical opencode-pty-client=identical
/home/byk/.local/share/opencode-v2-pilot/config/opencode/bun.lock /home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/test/followup.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/index.d.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/README.md /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/LICENSE /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/lib/process.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/lib/filesystem.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/lib/elf.js /home/byk/.local/share/opencode-v2-pilot/config/openco...
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json</path>
<type>file</type>
<content>
1: {
2: "compilerOptions": {
3: "allowImportingTsExtensions": true,
4: "lib": ["ESNext", "DOM", "DOM.Iterable"],
5: "module": "Preserve",
6: "moduleResolution": "Bundler",
7: "noEmit": true,
8: "paths": {
9: "@opencode/plugin": ["/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/index.ts"],
10: "@opencode/plugin/*": ["/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/*.ts"]
11: },
12: "skipLibCheck": true,
13: "strict": true,
14: "target": "ESNext",
15: "types": ["bun"]
16: },
17: "include": ["plugins/**/*.ts", "test/**/*.ts"]
18: }
(End of file - total 18 lines)
</content>
No files found
No files found
<path>/home/byk/Code/opencode-v2-pilot/node_modules/.bin</path> <type>directory</type> <entries> ast-grep husky oxlint prettier semver sg sst tsc tsgo tsgolint tsserver turbo (12 entries) </entries>
...output truncated...
Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_07fcc7839001lRWIOYs75XKcYg
Types of property 'encoding' are incompatible.
Type 'readonly [import("/home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/dist/SchemaAST").Link, ...import("/home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/effect/dist/SchemaAST").Link[]] | undefined' is not assignable to type 'readonly [import("/home/byk/Code/opencode-v2-pilot/node_modules/.bun/effect@4.0.0-rc.112/node_modules/effect/dist/SchemaAST").Link, ...import("/home/byk/Code/opencode-v2-pilot/node_modules/.bun/effect@4.0.0-rc.112/node_modules/effect/dist/SchemaAST").Link[]] | undefined'.
Type 'readonly ...
<path>/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/tool.ts</path>
<type>file</type>
<content>
1: export { CallID, Error } from "@opencode/schema/tool"
2: export type { Metadata, Options, Result } from "@opencode/schema/tool"
3:
4: import { Tool } from "@opencode/schema/tool"
5: import type { Agent } from "@opencode/schema/agent"
6: import type { Session } from "@opencode/schema/session"
7: import type { SessionMessage } from "@opencode/schema/session-message"
8: import type { Types } from "effect"
9: import type { Hooks, Transform } from "./registration.js"
10:
11: export interface ToolContext extends Omit<Tool.Context, "progress"> {
12: readonly progress: (update: Tool.Metadata) => Promise<void>
13: }
14:
15: export type Info<
16: Input extends Tool.ValueSchema<any> = Tool.ValueSchema<any>,
17: Output extends Tool.ValueSchema<any> | undefined = Tool.ValueSchema<any> | undefined,
18: > = Omit<Tool.Info<Input, Output>, "execute"> & {
19: readonly execute: ...
v24.16.0 1.3.14 opencode2-node v0.0.0-v2-pilot-202609080301 /home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=01ed129fb51ffd798127b17978435ef452e72ad4, for GNU/Linux 3.2.0, with debug_info, not stripped 67ecda49fa5be3ddb8f7fcb20a33f008a88dea093f0b8c8b10144afa0130f7cf /home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node
/home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/package.json /home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node
<path>/home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "@opencode/cli-node-linux-x64",
3: "version": "0.0.0-v2-pilot-202609080301",
4: "license": "MIT",
5: "repository": {
6: "type": "git",
7: "url": "git+https://github.com/anomalyco/opencode.git"
8: },
9: "os": [
10: "linux"
11: ],
12: "cpu": [
13: "x64"
14: ]
15: }
(End of file - total 15 lines)
</content>
<system-reminder>
Instructions from: /home/byk/Code/opencode-v2-pilot/packages/cli/AGENTS.md
# CLI and TUI development guide
- Use `@opencode/client` and the location-scoped data in `packages/tui/src/context/data.tsx` instead of adding dependencies on legacy sync state.
- Preserve established TUI behavior unless the task intentionally changes it.
</system-reminder>
Found 11 matches
/home/byk/Code/opencode-v2-pilot/packages/cli/vite.node.config.ts:
Line 269: OPENCODE_CLI_NAME: JSON.stringify("opencode2-node"),
/home/byk/Code/opencode-v2-pilot/packages/cli/test/updater-install.test.ts:
Line 219: 'OPENCODE_CLI_NAME="opencode2-node"',
Line 236: if (typeof OPENCODE_CLI_NAME === "string" && OPENCODE_CLI_NAME === "opencode2-node") {
/home/byk/Code/opencode-v2-pilot/packages/cli/script/publish.ts:
Line 131: binary: "opencode2-node",
/home/byk/Code/opencode-v2-pilot/packages/cli/script/build-node.ts:
Line 17: const NODE_VERSION = "26.4.0"
Line 114: const binary = target.platform === "win32" ? "opencode2-node.exe" : "opencode2-node"
Line 168: if (info.version === NODE_VERSION) return realpath(info.path)
Line 177: const archiveName = `node-v${NODE_VERSION}-${platform}-${target.arch}`
Line 195: const base = `https://nodejs.org/dist/v${NODE_VERSION}`
Line 197: if (!response.ok) throw new ...
NODE_MODULE_VERSION %d. This version of Node.js requires NODE_MODULE_VERSION %d. Please try re-compiling or re-installing 26.4.0
systemd 255 (255.4-1ubuntu8.17) +PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified opencode-pty-supervisor.service: Command /usr/local/libexec/opencode-pty-supervisor is not executable: No such file or directory
Child process | Node.js v26.4.0 Documentation[Skip to content](#apicontent) [Node.js](/ "Go back to the home page") --- - [About this documentation](documentation.html) - [Usage and example](synopsis.html) - [Assertion testing](assert.html) - [Asynchronous context tracking](async_context.html) - [Async hooks](async_hooks.html) - [Buffer](buffer.html) - [C++ addons](addons.html) - [C/C++ addons with Node-API](n-api.html) - [C++ embedder API](embedding.html) - [Child processes](child_process.html) - [Cluster](cluster.html) - [Command-line options](cli.html) - [Console](console.html) - [Crypto](crypto.html) - [Debugger](debugger.html) - [Deprecated APIs](deprecations.html) - [Diagnostics Channel](diagnostics_channel.html) - [DNS](dns.html) - [Domain](domain.html) - [Environment Variables](environment_variables.html) - [Errors](errors.html) - [Events](events.html) - [File system](fs.html) - [FFI](ffi.html) - [Globals](globals.html) - ...
Net | Node.js v26.4.0 Documentation[Skip to content](#apicontent) [Node.js](/ "Go back to the home page") --- - [About this documentation](documentation.html) - [Usage and example](synopsis.html) - [Assertion testing](assert.html) - [Asynchronous context tracking](async_context.html) - [Async hooks](async_hooks.html) - [Buffer](buffer.html) - [C++ addons](addons.html) - [C/C++ addons with Node-API](n-api.html) - [C++ embedder API](embedding.html) - [Child processes](child_process.html) - [Cluster](cluster.html) - [Command-line options](cli.html) - [Console](console.html) - [Crypto](crypto.html) - [Debugger](debugger.html) - [Deprecated APIs](deprecations.html) - [Diagnostics Channel](diagnostics_channel.html) - [DNS](dns.html) - [Domain](domain.html) - [Environment Variables](environment_variables.html) - [Errors](errors.html) - [Events](events.html) - [File system](fs.html) - [FFI](ffi.html) - [Globals](globals.html) - ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "crypto/rand"
6: "encoding/binary"
7: "errors"
8: "fmt"
9: "io"
10: "log"
11: "net"
12: "os"
13: "os/user"
14: "strconv"
15: "sync"
16: "syscall"
17: "time"
18: "unicode/utf8"
19:
20: "opencode-pty-supervisor/internal/protocol"
21:
22: "golang.org/x/sys/unix"
23: )
24:
25: const (
26: socketPath = "/run/opencode-pty/supervisor.sock"
27: maxSessions = 16
28: maxUnauthenticated = 32
29: maxAdmissionsPerMinute = 120
30: socketBufferSize = 128 * 1024
31: handshakeTimeout = 5 * time.Second
32: )
33:
34: var errStopRequested = errors.New("client requested stop")
35:
36: type Server struct {
37: manager unitManager
38: listener *net.UnixListener
39: sessions chan struct{}
40: unauthenticated chan struct{}
41: connections ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go</path> <type>file</type> <content> 1: package supervisor 2: 3: import ( 4: "context" 5: "encoding/base64" 6: "errors" 7: "fmt" 8: "net" 9: "os" 10: "regexp" 11: "time" 12: 13: systemddbus "github.com/coreos/go-systemd/v22/dbus" 14: "github.com/godbus/dbus/v5" 15: ) 16: 17: const ( 18: clientService = "opencode-v2.service" 19: supervisorService = "opencode-pty-supervisor.service" 20: ptySlice = "opencode-pty.slice" 21: expectedClientCgroup = "/system.slice/opencode-v2.service" 22: launcherPath = "/usr/local/libexec/opencode-pty-launcher" 23: unitPrefix = "opencode-pty-" 24: unitSuffix = ".service" 25: operationTimeout = 5 * time.Second 26: stopTimeout = 15 * time.Second 27: outputDrainTimeout = 2 * time.Second 28: defaultRuntimeSec = 3600 29: perSessionMemoryMax = 512 * 1024 * 1024 30: ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "bytes"
5: "context"
6: "errors"
7: "fmt"
8: "net"
9:
10: "golang.org/x/sys/unix"
11: )
12:
13: type authenticatedPeer struct {
14: credential *unix.Ucred
15: pidfd int
16: identity clientIdentity
17: }
18:
19: func authenticate(ctx context.Context, connection *net.UnixConn, manager unitManager, expectedUID uint32, expectedGID uint32) (*authenticatedPeer, error) {
20: credential, pidfd, err := peerIdentity(connection)
21: if err != nil {
22: return nil, err
23: }
24: peer := &authenticatedPeer{credential: credential, pidfd: pidfd}
25: if err := peer.validateCredentials(expectedUID, expectedGID); err != nil {
26: peer.Close()
27: return nil, err
28: }
29: identity, err := manager.ClientState(ctx)
30: if err != nil {
31: peer.Close()
32: return nil, fmt.Errorf("query client service: %w", ...
Failed to connect to bus: No medium found
NAME DESCRIPTION EXPOSURE ✓ SystemCallFilter=~@swap System call deny list defined for service, and @swap is included ✓ SystemCallFilter=~@resources System call deny list defined for service, and @resources is included ✓ SystemCallFilter=~@reboot System call deny list defined for service, and @reboot is included ✓ SystemCallFilter=~@raw-io System call deny list defined for service, and @raw-io is included ✓ SystemCallFilter=~@privileged System call deny list defined for service, and @privileged is included ✓ SystemCallFilter=~@obsolete System call deny list defined for service, and @obsolete is included ✓ ...
2980699 openat(AT_FDCWD, "/sys/kernel/mm/transparent_hugepage/hpage_pmd_size", O_RDONLY) = 3
Found 5 matches
/home/byk/Code/opencode-v2-pilot/packages/cli/src/session-target.ts:
Line 115: .fork({ sessionID: explicit.id, boundary: { type: "through" } }, ...requestOptions(input.signal))
Line 129: .fork({ sessionID: selected.id, boundary: { type: "through" } }, ...requestOptions(input.signal))
/home/byk/Code/opencode-v2-pilot/packages/cli/src/services/standalone.ts:
Line 40: const proc = yield* spawner.spawn(command(password, options))
/home/byk/Code/opencode-v2-pilot/packages/cli/src/commands/handlers/session/list.ts:
Line 68: .spawn(
/home/byk/Code/opencode-v2-pilot/packages/cli/src/acp/service.ts:
Line 265: const forked = await input.client.session.fork({
Found 80 matches
/home/byk/Code/opencode-v2-pilot/packages/sdk/test/import-boundaries.test.ts:
Line 26: const child = Bun.spawn(
/home/byk/Code/opencode-v2-pilot/packages/desktop/test/browser-native.test.ts:
Line 37: const server = Bun.spawn([process.execPath, path.join(import.meta.dir, "browser/server.ts")], {
Line 47: let native: ReturnType<typeof Bun.spawn> | undefined
Line 82: native = Bun.spawn([electron, path.join(output, "native.mjs")], {
/home/byk/Code/opencode-v2-pilot/packages/desktop/electron-builder.config.ts:
Line 1: import { execFile } from "node:child_process"
/home/byk/Code/opencode-v2-pilot/packages/desktop/src/main/service/shell-env.ts:
Line 1: import { spawnSync } from "node:child_process"
/home/byk/Code/opencode-v2-pilot/packages/desktop/src/main/service/desktop-cli.ts:
Line 3: import { execFile, spawn } from "node:child_process"
/home/byk/Code/opencode-v2-pilot/packages/desktop/src/main/files/index.ts:
Line 3: import { ...
Found 81 matches
/home/byk/Code/opencode-v2-pilot/packages/util/src/process.ts:
Line 4: import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner"
Line 5: import { CrossSpawnSpawner } from "./cross-spawn-spawner.js"
Line 49: export type Interface = ChildProcessSpawner["Service"] & {
Line 142: const spawner = yield* ChildProcessSpawner
Line 268: export const node = makeGlobalNode({ service: Service, layer: layer, deps: [CrossSpawnSpawner.node] })
/home/byk/Code/opencode-v2-pilot/packages/util/src/cross-spawn-spawner.ts:
Line 8: ChildProcessSpawner,
Line 14: } from "effect/unstable/process/ChildProcessSpawner"
Line 18: import launch from "cross-spawn"
Line 91: const makeCrossSpawnSpawner = Effect.gen(function* () {
Line 545: const layer: Layer.Layer<ChildProcessSpawner, never, FileSystem.FileSystem | Path.Path> = Layer.effect(
Line 546: ChildProcessSpawner,
Line 547: makeCrossSpawnSpawner,
Line 550: export const ...
<path>/home/byk/Code/opencode-v2-pilot/packages/util/src/cross-spawn-spawner.ts</path>
<type>file</type>
<content>
1: import { isArrayNonEmpty } from "effect/Array"
2: import * as NodeSink from "@effect/platform-node/NodeSink"
3: import * as NodeStream from "@effect/platform-node/NodeStream"
4: import { Deferred, Effect, Exit, FileSystem, Layer, Path, PlatformError, Predicate, Sink, Stream } from "effect"
5: import type { Scope } from "effect"
6: import { ChildProcess } from "effect/unstable/process"
7: import {
8: ChildProcessSpawner,
9: ExitCode,
10: make,
11: makeHandle,
12: ProcessId,
13: type ChildProcessHandle,
14: } from "effect/unstable/process/ChildProcessSpawner"
15: // ast-grep-ignore: no-star-import
16: import * as NodeChildProcess from "node:child_process"
17: import { PassThrough } from "node:stream"
18: import launch from "cross-spawn"
19: import { makeGlobalNode } from "./effect/app-node.js"
20: import { filesystem, path } from ...
Found 1 matches /home/byk/Code/opencode-v2-pilot/packages/util/src/cross-spawn-spawner.ts: Line 274: const proc = launch(command.command, command.args, opts)
<path>/home/byk/Code/opencode-v2-pilot/packages/util/src/cross-spawn-spawner.ts</path>
<type>file</type>
<content>
235: command: ChildProcess.StandardCommand,
236: proc: NodeChildProcess.ChildProcess,
237: out: ChildProcess.StdoutConfig,
238: err: ChildProcess.StderrConfig,
239: stopOutput: Deferred.Deferred<void>,
240: ) => {
241: const capture = (readable: NodeChildProcess.ChildProcess["stdout"], name: string) => {
242: if (!readable) return Stream.empty
243: // Bun resumes stdio on exit; retain bytes before the lazy Effect reader attaches.
244: const buffer = new PassThrough()
245: readable.on("error", (cause) => buffer.destroy(toError(cause)))
246: readable.pipe(buffer)
247: return NodeStream.fromReadable({
248: evaluate: () => buffer,
249: onError: (cause) => toPlatformError(`fromReadable(${name})`, toError(cause), command),
250: }).pipe(
251: ...
...output truncated...
Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_07fd0a72f001viMBROo1U1VLmB
`),cols:Mh.size.cols,rows:Mh.size.rows,cursor:{x:Dh.cursor_x,y:Dh.cursor_y}}}}),fh=fn$1("PersistentPty.remove")(function*(xh){const Eh=yield*th(xh),Ch=yield*request$6(gp,{op:"terminate",id:fromID(xh)});if(Ch.type!=="ok")return yield*unexpected(Ch);Vf.get(Eh.sessionID)===xh&&Vf.delete(Eh.sessionID),yield*An.publish(Removed,{sessionID:Eh.sessionID,ptyID:xh})}),yh=fn$1("PersistentPty.shutdown")(function*(){const xh=yield*gp.shutdown.pipe(mapError$2(unavailable$2));if(Vf.clear(),!!xh&&xh.type!=="ok")return yield*unexpected(xh)}),hh=fn$1("PersistentPty.handoff")(()=>gp.handoff.pipe(mapError$2(unavailable$2))),gh=xh=>{Af.has(xh)||(Af.add(xh),Xd(fh(xh).pipe(catchTags({"PersistentPty.NotFoundError":()=>void_$1,"PersistentPty.UnavailableError":Eh=>logWarning("failed to remove visible exited ...
Found 39 matches
/home/byk/go/pkg/mod/github.com/godbus/dbus/v5@v5.1.0/server_interfaces_test.go:
Line 155: func (t *tester) DeliverSignal(iface, name string, signal *Signal) {
/home/byk/go/pkg/mod/github.com/godbus/dbus/v5@v5.1.0/server_interfaces.go:
Line 84: AddSignal(ch chan<- *Signal)
Line 85: RemoveSignal(ch chan<- *Signal)
/home/byk/go/pkg/mod/github.com/godbus/dbus/v5@v5.1.0/sequential_handler_test.go:
Line 19: handler.(SignalRegistrar).AddSignal(channel)
Line 36: handler.(SignalRegistrar).AddSignal(channel)
Line 59: handler.(SignalRegistrar).AddSignal(channelOne)
Line 62: handler.(SignalRegistrar).AddSignal(channelTwo)
Line 78: handler.(SignalRegistrar).AddSignal(channelOne)
Line 82: handler.(SignalRegistrar).RemoveSignal(channelOne)
Line 100: handler.(SignalRegistrar).AddSignal(channelOne)
Line 103: handler.(SignalRegistrar).AddSignal(channelTwo)
Line 106: handler.(SignalRegistrar).AddSignal(channelThree)
Line 110: ...
<path>/home/byk/go/pkg/mod/github.com/godbus/dbus/v5@v5.1.0/default_handler.go</path>
<type>file</type>
<content>
250: func NewDefaultSignalHandler() *defaultSignalHandler {
251: return &defaultSignalHandler{}
252: }
253:
254: type defaultSignalHandler struct {
255: mu sync.RWMutex
256: closed bool
257: signals []*signalChannelData
258: }
259:
260: func (sh *defaultSignalHandler) DeliverSignal(intf, name string, signal *Signal) {
261: sh.mu.RLock()
262: defer sh.mu.RUnlock()
263: if sh.closed {
264: return
265: }
266: for _, scd := range sh.signals {
267: scd.deliver(signal)
268: }
269: }
270:
271: func (sh *defaultSignalHandler) Terminate() {
272: sh.mu.Lock()
273: defer sh.mu.Unlock()
274: if sh.closed {
275: return
276: }
277:
278: for _, scd := range sh.signals {
279: scd.close()
280: close(scd.ch)
281: }
282: sh.closed = true
283: sh.signals = nil
284: }
285:
286: func (sh *defaultSignalHandler) AddSignal(ch chan<- *Signal) {
287: ...
<path>/home/byk/go/pkg/mod/github.com/godbus/dbus/v5@v5.1.0/default_handler.go</path>
<type>file</type>
<content>
314: type signalChannelData struct {
315: wg sync.WaitGroup
316: ch chan<- *Signal
317: done chan struct{}
318: }
319:
320: func (scd *signalChannelData) deliver(signal *Signal) {
321: select {
322: case scd.ch <- signal:
323: case <-scd.done:
324: return
325: default:
326: scd.wg.Add(1)
327: go scd.deferredDeliver(signal)
328: }
329: }
330:
331: func (scd *signalChannelData) deferredDeliver(signal *Signal) {
332: select {
333: case scd.ch <- signal:
334: case <-scd.done:
335: }
336: scd.wg.Done()
337: }
338:
339: func (scd *signalChannelData) close() {
340: close(scd.done)
341: scd.wg.Wait() // wait until all spawned goroutines return
342: }
(End of file - total 342 lines)
</content>
No files found
@resources
# Alter resource settings
ioprio_set
mbind
migrate_pages
move_pages
nice
sched_setaffinity
sched_setattr
sched_setparam
sched_setscheduler
set_mempolicy
set_mempolicy_home_node
setpriority
setrlimit
/usr/bin/systemd-run /usr/bin/script /usr/bin/sh /usr/bin/grep /usr/bin/sha256sum /usr/bin/stat /usr/bin/sed /usr/bin/wc
[
{
"content": "Inventory and hash exact review files, changed artifacts, binaries, and build metadata",
"status": "completed",
"priority": "high"
},
{
"content": "Trace plugin, transport, helper, supervisor, systemd units, and cutover protocol end to end",
"status": "completed",
"priority": "high"
},
{
"content": "Verify pinned Go, godbus, go-systemd, Node APIs, systemd property semantics, and binary provenance",
"status": "completed",
"priority": "high"
},
{
"content": "Run unprivileged tests and reproducible source builds and compare binary hashes",
"status": "completed",
"priority": "high"
},
{
"content": "Review tests and documents for realism and issue classified correctness verdict",
"status": "completed",
"priority": "high"
}
]
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "encoding/base64"
5: "errors"
6: "fmt"
7: "os"
8: "strconv"
9: "strings"
10: "syscall"
11:
12: "opencode-pty-supervisor/internal/protocol"
13:
14: "golang.org/x/sys/unix"
15: )
16:
17: const (
18: socketFD = 3
19: cwdFD = 4
20: )
21:
22: func main() {
23: if err := sendStart(socketFD, cwdFD, os.Args[1:]); err != nil {
24: fmt.Fprintln(os.Stderr, err)
25: os.Exit(1)
26: }
27: }
28:
29: func sendStart(socket, cwd int, values []string) error {
30: unix.CloseOnExec(socket)
31: unix.CloseOnExec(cwd)
32: if _, err := unix.Getpeername(socket); err != nil {
33: return fmt.Errorf("validate inherited connected socket: %w", err)
34: }
35: var stat unix.Stat_t
36: if err := unix.Fstat(cwd, &stat); err != nil {
37: return fmt.Errorf("inspect inherited cwd: %w", err)
38: }
39: if stat.Mode&unix.S_IFMT != unix.S_IFDIR ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame.go</path>
<type>file</type>
<content>
1: package protocol
2:
3: import (
4: "encoding/binary"
5: "errors"
6: "fmt"
7: "io"
8: "strings"
9: "unicode/utf8"
10: )
11:
12: const (
13: HeaderSize = 12
14: MaxFrameSize = 70 * 1024
15: MaxIOPayloadSize = 32 * 1024
16: Version = 1
17:
18: TypeStart = 1
19: TypeInput = 2
20: TypeOutput = 3
21: TypeExit = 4
22: TypeError = 5
23: TypeStarted = 6
24: TypeStop = 7
25: TypeStopped = 8
26:
27: MaxArgs = 128
28: MaxCommandSize = 4096
29: MaxArgSize = 16384
30: MaxArgsSize = 65536
31: MaxRuntimeSec = 3600
32: )
33:
34: var (
35: magic = [4]byte{'O', 'P', 'T', 'Y'}
36: ErrInvalidFrame = errors.New("invalid frame")
37: ErrFrameTooLarge = errors.New("frame too large")
38: )
39:
40: type Frame struct {
41: Type byte
42: Payload []byte
43: }
44:
45: type Start struct {
46: Device ...
d1d088bdd65f99056657717658d3336ae233acd2ad39fa998ebe8a773f68348e go.mod dad6a6773121326ee41a6a081cf310444b6fcd3540f28f4b3f31de559d31726b go.sum 83ef89be747e6c1bd51ba1474307980dd4e9d4c1d17360be1c02538c990f832d internal/protocol/frame.go c7c45eeaf44411bd6fe87998fce153cb8decda5df7d7e805fad9dc6f6cdfd591 internal/protocol/frame_test.go 7e87448cedd42966156ecd3a17e654ccec15e11d276ccdcf014c0fa66b49a974 internal/supervisor/auth.go 9fc722a3e84e6a445c66a031882fc40ae6fc1f0216c21cd0e50770621bd6c7eb internal/supervisor/auth_test.go 6e4230fcd20b8f5cdc6d417776ba1ea0bd6032882f358352ba1fd46bd71b6589 internal/supervisor/server.go 7ef99b1f2cb77bf573327688d7ac734e712c4560154eee504a72203676a0285b internal/supervisor/server_test.go 7e1c6de7d917b584e207788899d9af5a96b262a5a7b52fcf8f1196dcfc0188cf internal/supervisor/systemd.go eede59ca6e0927c9ab8524b7a10cc59a32b0332250d7d45210f5c22f114ce4e1 internal/supervisor/systemd_test.go 9471c8c9dd2a8c00274e1e6ecc89983377c3810e2a7ad47b962df19ce6d2995b ...
Findings
MUST-FIX: PTY termination can block forever before its timeout starts.
SupervisorTransport.close() awaits the STOP write without a deadline at config/opencode/plugins/pty-transport.ts:197-202. The 25-second timeout starts only after that write completes. If the supervisor stops reading because PTY input is blocked and its receive buffer fills, the write callback never fires. Session deletion, plugin unload, and pty_kill can then hang indefinitely through terminate() at config/opencode/plugins/pty.ts:483-491. Apply the same bounded write handling used for input frames, and test STOP behind saturated input backpressure.
MUST-FIX: the helper violates the documented and required “opens no path” invariant.
PROTOCOL.md:3 and ROOT-ACCEPTANCE.md:20 say the helper never opens a socket or path. An unprivileged syscall trace of the reviewed binary recorded:
openat(AT_FDCWD, "/sys/kernel/mm/transparent_hugepage/hpage_pmd_size", O_RDONLY) = 3
This occurs in the Go runtime before application validation. The helper source itself only uses inherited descriptors at cmd/client/main.go:29-68, and it opens no socket, but the binary cannot pass acceptance check 5 as written. Either constrain the invariant to application-initiated filesystem/socket operations and list permitted runtime reads, or produce a binary that satisfies the absolute claim.
MUST-FIX: the exact plugin source does not typecheck.
The prescribed tsgo --noEmit -p tsconfig.json fails across the tool registrations, including config/opencode/plugins/pty.ts:193-197, 289-294, 310-314, 348-352, and 360-365. pty.ts:4 resolves effect from the pilot config while tsconfig.json:9-10 resolves @opencode/plugin into the repository and therefore another Effect package instance. Their schema AST types are incompatible. No successful exact-source TypeScript validation exists.
...
Date: Sep 8, 2026 * 🔴 (07:01) A search found 39 `DeliverSignal`, `AddSignal`, `RemoveSignal`, and `Signal` references under `github.com/godbus/dbus/v5@v5.1.0`, including `server_interfaces.go`, `sequential_handler.go`, `conn.go`, `default_handler.go`, and their tests. * 🔴 (07:01) In `/home/byk/go/pkg/mod/github.com/godbus/dbus/v5@v5.1.0/default_handler.go:250-312`, `defaultSignalHandler` protec…
Date: Sep 8, 2026 * 🔴 (07:01) A truncated tool result was saved in full at `/home/byk/.local/share/opencode/tool-output/tool_07fd0a72f001viMBROo1U1VLmB`. * 🔴 (07:01) `PersistentPty.remove` resolves the PTY, sends `{ op: "terminate", id: fromID(xh) }`, treats non-`"ok"` responses as unexpected, removes the matching session-to-PTY mapping from `Vf`, and publishes `Removed` with `{ sessionID, ptyI…
* 🔴 (06:59) A repository search found exactly 80 `spawn`/`spawnSync`/`execFile`-related matches. Non-test/runtime or build-script paths included `/home/byk/Code/opencode-v2-pilot/packages/desktop/electron-builder.config.ts:1`, `packages/desktop/src/main/service/shell-env.ts:1`, `packages/desktop/src/main/service/desktop-cli.ts:3`, `packages/desktop/src/main/files/index.ts:3`, `packages/desktop/s…
Date: Sep 8, 2026 * 🔴 (06:58) `/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go` implements a root-only Unix-socket PTY supervisor listening at `/run/opencode-pty/supervisor.sock`; limits are `maxSessions = 16`, `maxUnauthenticated = 32`, `maxAdmissionsPerMinute = 120`, `socketBufferSize = 128 * 1024`, and `handshakeTimeout = 5 * time.Second`. * 🔴 (06:58) `Serve…
Date: Sep 8, 2026 * 🟡 (06:58) Node.js v26.4.0 `net` documentation states Unix domain socket paths are filesystem pathnames limited by `sizeof(sockaddr_un.sun_path)`, typically 107 bytes on Linux and 103 bytes on macOS. * 🟡 (06:58) Unix domain sockets remain visible in the filesystem until unlinked. Node.js abstractions such as `net.createServer()` unlink sockets during `server.close()`, but ext…
Date: Sep 8, 2026 * 🟡 (06:57) Host is running `systemd 255 (255.4-1ubuntu8.17)` with unified cgroup hierarchy; `opencode-pty-supervisor.service` failed validation because command `/usr/local/libexec/opencode-pty-supervisor` is not executable or does not exist. * 🔴 (06:57) User directive: “Never pass unsanitized user input to this function.” Specifically, `child_process.exec()` processes its com…
Date: Sep 8, 2026 * 🟡 (06:55) Version inspection returned `v24.16.0`, `1.3.14`, and `opencode2-node v0.0.0-v2-pilot-202609080301`. * 🟡 (06:55) `/home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node` is an ELF 64-bit LSB x86-64 executable, dynamically linked with interpreter `/lib64/ld-linux-x86-64.so.2`, built for GNU/Linux 3.2.0, containing deb…
Date: Sep 8, 2026 * 🟡 (06:54) A third artifact set under `/tmp/opencode/pty-review.pS9Xqv` had SHA-256 values `opencode-pty-supervisor` = `c5c09ece21c802868721dfc3e2610496ad9630c1b3a4c258104bc92b2bd9aca1`, `opencode-pty-launcher` = `d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd`, and `opencode-pty-client` = `fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde`; co…
Date: Sep 8, 2026 * 🟡 (06:49) Investigation of `github.com/coreos/go-systemd/v22@v22.5.0/dbus` confirmed relevant APIs: `StartTransientUnitContext(...)` at `dbus/methods.go:191`, `StopUnitContext(...)` at line 122, `GetUnitPropertiesContext(...)` at line 272, `GetUnitTypePropertiesContext(...)` at line 347, and property helpers `PropExecStart(...)`, `PropType(...)`, `PropBindsTo(...)`, `PropAfte…
Date: Sep 8, 2026 * 🟡 (06:48) `/home/byk/.local/share/opencode-v2-pilot/supervisor/go.sum` has exactly 7 lines and pins `github.com/coreos/go-systemd/v22 v22.5.0` (`h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=`), its `go.mod` sum (`h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=`), `github.com/godbus/dbus/v5 v5.1.0` (`h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=`), its `go.mod` sum (`h1:xh…
Date: Sep 8, 2026 * 🟡 (06:46) `/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go` contains 5 launcher behaviors under test: `TestDecodeArgumentsPreservesEveryArgument` decodes `["printf","%s\\n","a'b; $(id)",""]`; `TestDecodeArgumentsRejectsInvalidGrammar` rejects `"bad="`; `TestScriptArgumentsRequireInteractiveShellAndExitPropagation` requires `["script","-q","-e","-…
Date: Sep 8, 2026 * 🟡 (06:45) `/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main.go` defines `encodedArgumentsEnvironment = "OPENCODE_PTY_ARGV"` and `launcherFD = 3`; `main()` calls `run(os.Args[1:])`, prints errors to stderr, and exits with status `1` on failure. * 🟡 (06:45) Launcher `run(values)` enters `execCommand()` only for the exact argument list `["--exec"]`; otherwi…
Date: Sep 8, 2026 * 🟡 (06:45) `/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go` defines inherited descriptors `socketFD = 3` and `cwdFD = 4`; `main()` calls `sendStart(socketFD, cwdFD, os.Args[1:])`, prints errors to stderr, and exits with status `1` on failure. * 🟡 (06:45) `sendStart()` marks both inherited descriptors close-on-exec, uses `unix.Getpeername(socket)` to en…
Date: Sep 8, 2026 * 🟡 (06:45) Review task status: “Inventory and hash exact review files, changed artifacts, binaries, and build metadata” was `in_progress`; four high-priority tasks remained `pending`: 1. trace plugin/transport/helper/supervisor/systemd-unit/cutover protocol end to end, 2. verify pinned Go, `godbus`, `go-systemd`, Node APIs, systemd property semantics, and binary provenance, 3.…
Date: Sep 8, 2026 * 🔴 [requested-review] (06:44) User requested a substantive independent READ-ONLY correctness review after a major revision of the exact current files under `/home/byk/.local/share/opencode-v2-pilot/supervisor`, plus `/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts`, `/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts`, `/h…