Dashboard › opencode › Session 1KBRG449CKsl
1KBRG449CKslSp5mXPerform a final substantive independent READ-ONLY correctness review of the exact current source and artifacts under /home/byk/.local/share/opencode-v2-pilot/supervisor, plugin files /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts and pty-transport.ts, canonical config tsconfig/package files, candidate unit, CUTOVER, and persistent/temp PTY tests. Immutable claimed source manifest: fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f. Claimed artifact hashes: supervisor ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2; launcher d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd; client fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde. Verify all prior correctness blockers: bounded STOP write; helper docs truthful; canonical exact tsgo passes without hiding files; exact Node 26 SEA test correctly remains root acceptance or is proven; persistent test evidence; plus all end-to-end framing, limits, cwd fd, helper inheritance, lifecycle, output queue, cleanup, systemd interfaces, signal proof, admission reservation, readiness verifier, build reproducibility. Inspect every changed file, relevant pinned APIs, and tests. Run unprivileged checks if useful. Never edit/install/start/stop services or perform privileged actions. Distinguish source approval from root host acceptance. Cite current file:line evidence, classify PASS/CONCERN/MUST-FIX, and end exactly MERGE or DO-NOT-MERGE.
I will freeze the review against the claimed manifest and artifact hashes, enumerate every in-scope file and pinned contract, then run only unprivileged read-only checks. I will keep source approval separate from the remaining root-host acceptance gate.
[
{
"content": "Inventory exact review scope and verify immutable source/artifact hashes",
"status": "in_progress",
"priority": "high"
},
{
"content": "Inspect every source, config, unit, CUTOVER, and PTY test file with pinned APIs",
"status": "pending",
"priority": "high"
},
{
"content": "Run canonical unprivileged typecheck, tests, reproducibility, and artifact checks",
"status": "pending",
"priority": "high"
},
{
"content": "Trace each prior blocker and end-to-end correctness invariant to evidence",
"status": "pending",
"priority": "high"
},
{
"content": "Deliver classified independent verdict with root acceptance separated",
"status": "pending",
"priority": "high"
}
]
/home/byk/.local/share/opencode-v2-pilot/supervisor/review-source-hash /home/byk/.local/share/opencode-v2-pilot/supervisor/verify-readiness /home/byk/.local/share/opencode-v2-pilot/supervisor/ROOT-ACCEPTANCE.md /home/byk/.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md /home/byk/.local/share/opencode-v2-pilot/supervisor/bin/opencode-pty-client /home/byk/.local/share/opencode-v2-pilot/supervisor/bin/opencode-pty-launcher /home/byk/.local/share/opencode-v2-pilot/supervisor/bin/opencode-pty-supervisor /home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty.slice /home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service /home/byk/.local/share/opencode-v2-pilot/supervisor/go.sum /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/supervisor/main.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd...
/home/byk/.local/share/opencode-v2-pilot/config/opencode/bun.lock /home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/test/followup.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/index.d.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/README.md /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/LICENSE /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/lib/process.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/lib/filesystem.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/lib/elf.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/lib/detect-libc.js /home/byk/.local/share/...
/home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty.slice /home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service /home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/detect-libc/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/fast-check/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/node-gyp-build-optional-packages/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/csstype/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/msgpackr-extract/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/fast-check/lib/cjs/package.json /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_m...
/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go /home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame_test.go /home/byk/.local/share/opencode-v2-pilot/config/opencode/test/followup.test.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/node-gyp-build-optional-packages/build-test.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/protobufjs/ext/descriptor/test.js /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/fast-uri/types/index.test-d.ts /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/fast-uri/test/websocket-query-p...
f231f9f8c57fbcadda3a32c7559cd3e45421647312269e04a6798187566584f6 review-source-hash ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2 bin/opencode-pty-supervisor d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd bin/opencode-pty-launcher fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde bin/opencode-pty-client
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/review-source-hash</path> <type>file</type> <content> 1: #!/bin/sh 2: 3: set -eu 4: 5: ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) 6: ( 7: /usr/bin/find "$ROOT/supervisor/cmd" "$ROOT/supervisor/internal" -type f \( -name '*.go' -o -name '*_test.go' \) -print 8: /usr/bin/find /home/byk/Code/opencode-v2-pilot/packages/plugin/src -type f -name '*.ts' -print 9: printf '%s\n' \ 10: "$ROOT/supervisor/go.mod" \ 11: "$ROOT/supervisor/go.sum" \ 12: "$ROOT/supervisor/opencode-pty.slice" \ 13: "$ROOT/supervisor/opencode-pty-supervisor.service" \ 14: "$ROOT/config/opencode/plugins/pty.ts" \ 15: "$ROOT/config/opencode/plugins/pty-transport.ts" \ 16: "$ROOT/config/opencode/tsconfig.json" \ 17: "$ROOT/config/opencode/package.json" \ 18: "$ROOT/config/opencode/bun.lock" \ 19: "$ROOT/opencode-v2.service" \ 20: /home/byk/Code/opencode-v2-pilot/packages/plugin/package.json \ 21: ...
fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f
/home/byk/Code/opencode-v2-pilot/packages/plugin/src/worktree.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/storage.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/source.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/source.node.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/source.bun.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/rpc.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/host.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/context.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/solid.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/plugin.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/tui/index.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/worktree.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/websearch.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/vcs.ts /home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/tool.ts /...
No files found
M packages/core/src/plugin/host.ts M packages/core/test/plugin.test.ts M packages/core/test/plugin/fixture.ts M packages/core/test/plugin/host.ts M packages/plugin/src/effect/permission.ts M packages/plugin/src/promise/adapter.ts M packages/plugin/src/promise/permission.ts ?? packages/cli/dist-v2-pilot-final/ ?? packages/cli/dist-v2-pilot-next/ ?? packages/cli/dist-v2-pilot/
The immutable source manifest recomputes exactly to fff146df…4286f, and all three binaries match their claimed hashes. The checkout also has relevant uncommitted plugin/core API changes, so I am including those diffs and their tests in the contract review rather than trusting only the staged pilot copies.
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts</path>
<type>file</type>
<content>
1: import { Plugin } from "@opencode/plugin"
2: import type { Context } from "@opencode/plugin/plugin"
3: import type { ToolContext } from "@opencode/plugin/tool"
4: import { Schema } from "effect"
5: import { spawn } from "node:child_process"
6: import { open, realpath } from "node:fs/promises"
7: import type { FileHandle } from "node:fs/promises"
8: import { constants } from "node:fs"
9: import { assertSupervisorAvailable, MAX_BUFFER_SIZE, openSupervisorTransport } from "./pty-transport"
10: import type { SupervisorOptions, SupervisorTransport } from "./pty-transport"
11:
12: type PtyPluginOptions = SupervisorOptions & {
13: assertAvailable?: typeof assertSupervisorAvailable
14: openTransport?: typeof openSupervisorTransport
15: }
16:
17: const MAX_SESSIONS = 16
18: const MAX_SESSIONS_PER_OWNER = 5
19: const DEFAULT_READ_LIMIT = 500
20: const MAX_READ_LIMIT = ...
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts</path>
<type>file</type>
<content>
1: import { spawn } from "node:child_process"
2: import type { ChildProcess } from "node:child_process"
3: import { isUtf8 } from "node:buffer"
4: import { fstatSync } from "node:fs"
5: import { stat } from "node:fs/promises"
6: import type { FileHandle } from "node:fs/promises"
7: import { createConnection } from "node:net"
8: import type { Socket } from "node:net"
9:
10: const MAGIC = Buffer.from("OPTY")
11: const VERSION = 1
12: const HEADER_SIZE = 12
13: const MAX_FRAME_SIZE = 70 * 1024
14: const MAX_IO_PAYLOAD_SIZE = 32 * 1024
15: const TYPE_INPUT = 2
16: const TYPE_OUTPUT = 3
17: const TYPE_EXIT = 4
18: const TYPE_ERROR = 5
19: const TYPE_STARTED = 6
20: const TYPE_STOP = 7
21: const TYPE_STOPPED = 8
22: const DEFAULT_SOCKET_PATH = "/run/opencode-pty/supervisor.sock"
23: const DEFAULT_HELPER_PATH = "/usr/local/libexec/opencode-pty-client"
24: const ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame.go</path>
<type>file</type>
<content>
1: package protocol
2:
3: import (
4: "encoding/binary"
5: "errors"
6: "fmt"
7: "io"
8: "strings"
9: "unicode/utf8"
10: )
11:
12: const (
13: HeaderSize = 12
14: MaxFrameSize = 70 * 1024
15: MaxIOPayloadSize = 32 * 1024
16: Version = 1
17:
18: TypeStart = 1
19: TypeInput = 2
20: TypeOutput = 3
21: TypeExit = 4
22: TypeError = 5
23: TypeStarted = 6
24: TypeStop = 7
25: TypeStopped = 8
26:
27: MaxArgs = 128
28: MaxCommandSize = 4096
29: MaxArgSize = 16384
30: MaxArgsSize = 65536
31: MaxRuntimeSec = 3600
32: )
33:
34: var (
35: magic = [4]byte{'O', 'P', 'T', 'Y'}
36: ErrInvalidFrame = errors.New("invalid frame")
37: ErrFrameTooLarge = errors.New("frame too large")
38: )
39:
40: type Frame struct {
41: Type byte
42: Payload []byte
43: }
44:
45: type Start struct {
46: Device ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "bytes"
5: "context"
6: "errors"
7: "fmt"
8: "net"
9:
10: "golang.org/x/sys/unix"
11: )
12:
13: type authenticatedPeer struct {
14: credential *unix.Ucred
15: pidfd int
16: identity clientIdentity
17: }
18:
19: func authenticate(ctx context.Context, connection *net.UnixConn, manager unitManager, expectedUID uint32, expectedGID uint32) (*authenticatedPeer, error) {
20: credential, pidfd, err := peerIdentity(connection)
21: if err != nil {
22: return nil, err
23: }
24: peer := &authenticatedPeer{credential: credential, pidfd: pidfd}
25: if err := peer.validateCredentials(expectedUID, expectedGID); err != nil {
26: peer.Close()
27: return nil, err
28: }
29: identity, err := manager.ClientState(ctx)
30: if err != nil {
31: peer.Close()
32: return nil, fmt.Errorf("query client service: %w", ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd.go</path> <type>file</type> <content> 1: package supervisor 2: 3: import ( 4: "context" 5: "encoding/base64" 6: "errors" 7: "fmt" 8: "net" 9: "os" 10: "regexp" 11: "sync" 12: "time" 13: 14: systemddbus "github.com/coreos/go-systemd/v22/dbus" 15: "github.com/godbus/dbus/v5" 16: ) 17: 18: const ( 19: clientService = "opencode-v2.service" 20: supervisorService = "opencode-pty-supervisor.service" 21: ptySlice = "opencode-pty.slice" 22: expectedClientCgroup = "/system.slice/opencode-v2.service" 23: launcherPath = "/usr/local/libexec/opencode-pty-launcher" 24: unitPrefix = "opencode-pty-" 25: unitSuffix = ".service" 26: operationTimeout = 5 * time.Second 27: stopTimeout = 15 * time.Second 28: outputDrainTimeout = 2 * time.Second 29: stateQueryInterval = 100 * time.Millisecond 30: defaultRuntimeSec = 3600 31: ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "crypto/rand"
6: "encoding/binary"
7: "errors"
8: "fmt"
9: "io"
10: "log"
11: "net"
12: "os"
13: "os/user"
14: "strconv"
15: "sync"
16: "syscall"
17: "time"
18: "unicode/utf8"
19:
20: "opencode-pty-supervisor/internal/protocol"
21:
22: "golang.org/x/sys/unix"
23: )
24:
25: const (
26: socketPath = "/run/opencode-pty/supervisor.sock"
27: maxSessions = 16
28: maxUnauthenticated = 32
29: maxAdmissionsPerMinute = 120
30: maxStartDescriptors = 8
31: socketBufferSize = 128 * 1024
32: handshakeTimeout = 5 * time.Second
33: )
34:
35: var errStopRequested = errors.New("client requested stop")
36:
37: type Server struct {
38: manager unitManager
39: listener *net.UnixListener
40: sessions chan struct{}
41: unauthenticated ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "encoding/base64"
5: "errors"
6: "fmt"
7: "os"
8: "strconv"
9: "strings"
10: "syscall"
11:
12: "opencode-pty-supervisor/internal/protocol"
13:
14: "golang.org/x/sys/unix"
15: )
16:
17: const (
18: socketFD = 3
19: cwdFD = 4
20: )
21:
22: func main() {
23: if err := sendStart(socketFD, cwdFD, os.Args[1:]); err != nil {
24: fmt.Fprintln(os.Stderr, err)
25: os.Exit(1)
26: }
27: }
28:
29: func sendStart(socket, cwd int, values []string) error {
30: unix.CloseOnExec(socket)
31: unix.CloseOnExec(cwd)
32: if _, err := unix.Getpeername(socket); err != nil {
33: return fmt.Errorf("validate inherited connected socket: %w", err)
34: }
35: var stat unix.Stat_t
36: if err := unix.Fstat(cwd, &stat); err != nil {
37: return fmt.Errorf("inspect inherited cwd: %w", err)
38: }
39: if stat.Mode&unix.S_IFMT != unix.S_IFDIR ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "encoding/base64"
5: "errors"
6: "fmt"
7: "os"
8: "strings"
9: "syscall"
10:
11: "opencode-pty-supervisor/internal/protocol"
12:
13: "golang.org/x/sys/unix"
14: )
15:
16: const encodedArgumentsEnvironment = "OPENCODE_PTY_ARGV"
17:
18: const launcherFD = 3
19:
20: func main() {
21: if err := run(os.Args[1:]); err != nil {
22: fmt.Fprintln(os.Stderr, err)
23: os.Exit(1)
24: }
25: }
26:
27: func run(values []string) error {
28: if len(values) == 1 && values[0] == "--exec" {
29: return execCommand()
30: }
31: if _, err := decodeArguments(values); err != nil {
32: return err
33: }
34: if err := syscall.Fchdir(2); err != nil {
35: return fmt.Errorf("fchdir approved cwd: %w", err)
36: }
37: if err := syscall.Dup2(1, 2); err != nil {
38: return fmt.Errorf("replace cwd descriptor: %w", err)
39: }
40: if err := ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/supervisor/main.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "context"
5: "fmt"
6: "os"
7: "os/signal"
8: "syscall"
9:
10: "opencode-pty-supervisor/internal/supervisor"
11: )
12:
13: func main() {
14: ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
15: defer cancel()
16: manager, err := supervisor.NewSystemdManager(ctx)
17: if err != nil {
18: fmt.Fprintln(os.Stderr, err)
19: os.Exit(1)
20: }
21: defer manager.Close()
22: server, err := supervisor.NewServer(manager)
23: if err != nil {
24: fmt.Fprintln(os.Stderr, err)
25: os.Exit(1)
26: }
27: if err := server.Serve(ctx); err != nil {
28: fmt.Fprintln(os.Stderr, err)
29: os.Exit(1)
30: }
31: }
(End of file - total 31 lines)
</content>
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md</path> <type>file</type> <content> 1: # PTY supervisor protocol 2: 3: The protocol uses one Unix `SOCK_STREAM` connection for one PTY. The Node SEA process opens and retains the connection. The supervisor authenticates that connection's immutable peer credentials against the exact `opencode-v2.service` MainPID. The client helper never initiates a socket connection, resolves a caller path, or opens an application-selected path. The Go runtime may read reviewed host metadata such as `/sys/kernel/mm/transparent_hugepage/hpage_pmd_size`. Node starts the fixed root-owned helper with duplicates of the connected socket at fd 3 and the approved directory at fd 4. The helper sends the start frame and fd 4, then exits. Exact Node 26.4 SEA descriptor inheritance and same-UID delegation remain target-host acceptance blockers; source behavior never proves that all other Node child processes inherit neither descriptor. ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/ROOT-ACCEPTANCE.md</path> <type>file</type> <content> 1: # Root-only acceptance 2: 3: Do not install, start, enable, or mark the candidate ready until every check below passes on the exact target host. Source tests never substitute for these checks. 4: 5: 1. Rebuild all three binaries twice from the reviewed source with `CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags=-buildid=`. Require both build sets to match. Record the content-bound source revision, Go version, dependency sums, complete build commands, and SHA-256 hashes. ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/verify-readiness</path>
<type>file</type>
<content>
1: #!/bin/sh
2:
3: set -eu
4:
5: MARKER=/etc/opencode/pty-supervisor-verified
6: EXPECTED_REVISION='revision=opencode-v2-pilot:git:2ac698d65aa4690a694307e9cbdf44537ea9a4fb;pty-source:sha256:fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f'
7:
8: fail() {
9: printf '%s\n' "$1" >&2
10: exit 1
11: }
12:
13: [ -f "$MARKER" ] && [ ! -L "$MARKER" ] || fail 'PTY readiness marker is not a regular file'
14: [ "$(/usr/bin/stat -c '%u:%g:%a' "$MARKER")" = '0:0:644' ] || fail 'PTY readiness marker ownership or mode is invalid'
15: exec 3<"$MARKER"
16: IFS= read -r revision <&3 || fail 'PTY readiness marker is missing revision'
17: IFS= read -r supervisor <&3 || fail 'PTY readiness marker is missing supervisor hash'
18: IFS= read -r launcher <&3 || fail 'PTY readiness marker is missing launcher hash'
19: IFS= read -r client <&3 || fail 'PTY readiness marker is missing ...
<path>/home/byk/.local/share/opencode-v2-pilot/CUTOVER.md</path> <type>file</type> <content> 1: # OpenCode V2 cutover 2: 3: The V2 executable serves the API and web UI from one origin. Do not add nginx. 4: 5: ## Preflight 6: 7: 1. Confirm production is still healthy on port 4096. 8: 2. Confirm the candidate revision and smoke build: 9: `git -C /home/byk/Code/opencode-v2-pilot rev-parse HEAD` 10: `/home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node --version` 11: 3. Confirm the isolated candidate on port 14102: 12: `curl --fail --user opencode:$OPENCODE_PASSWORD http://127.0.0.1:14102/api/health` 13: `curl --fail http://127.0.0.1:14102/ >/dev/null` 14: 4. Confirm both local plugins are active after calling `POST /api/plugin/await-activation`. 15: 5. Create `/home/byk/.local/share/opencode-v2-pilot/server.env` with mode `0600` and one line: `OPENCODE_PASSWORD=<password>`. 16: 6. ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty-supervisor.service</path> <type>file</type> <content> 1: [Unit] 2: Description=OpenCode PTY supervisor 3: After=dbus.service 4: Requires=dbus.service 5: 6: [Service] 7: Type=exec 8: User=root 9: Group=byk 10: SupplementaryGroups= 11: ExecStart=/usr/local/libexec/opencode-pty-supervisor 12: RuntimeDirectory=opencode-pty 13: RuntimeDirectoryMode=0750 14: RuntimeDirectoryPreserve=no 15: NoNewPrivileges=yes 16: CapabilityBoundingSet= 17: AmbientCapabilities= 18: UMask=0077 19: KillMode=control-group 20: KillSignal=SIGTERM 21: FinalKillSignal=SIGKILL 22: SendSIGKILL=yes 23: TimeoutStopSec=20s 24: OOMPolicy=kill 25: Delegate=no 26: RestrictAddressFamilies=AF_UNIX 27: PrivateTmp=yes 28: PrivateDevices=yes 29: PrivateMounts=yes 30: PrivateNetwork=yes 31: ProtectSystem=strict 32: ProtectHome=yes 33: ProtectKernelTunables=yes 34: ProtectKernelModules=yes 35: ProtectKernelLogs=yes 36: ProtectControlGroups=yes 37: ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/opencode-pty.slice</path> <type>file</type> <content> 1: [Unit] 2: Description=OpenCode isolated PTY sessions 3: Before=slices.target 4: 5: [Slice] 6: CPUAccounting=yes 7: MemoryAccounting=yes 8: TasksAccounting=yes 9: IOAccounting=yes 10: CPUQuota=800% 11: IOWeight=100 12: MemoryHigh=1536M 13: MemoryMax=2G 14: TasksMax=512 (End of file - total 14 lines) </content>
<path>/home/byk/.local/share/opencode-v2-pilot/opencode-v2.service</path> <type>file</type> <content> 1: [Unit] 2: Description=OpenCode V2 Server 3: After=network.target opencode-pty-supervisor.service 4: Requires=opencode-pty-supervisor.service 5: 6: [Service] 7: Type=simple 8: EnvironmentFile=/home/byk/.opencode/env 9: EnvironmentFile=/home/byk/.local/share/opencode-v2-pilot/server.env 10: Environment=OPENCODE_CONFIG_DIR=/home/byk/.local/share/opencode-v2-pilot/config/opencode 11: Environment=OPENCODE_DB=/home/byk/.local/share/opencode-v2-pilot/data/opencode/opencode.db 12: Environment=XDG_DATA_HOME=/home/byk/.local/share/opencode-v2-pilot/data 13: Environment=XDG_CACHE_HOME=/home/byk/.local/share/opencode-v2-pilot/cache 14: Environment=XDG_CONFIG_HOME=/home/byk/.local/share/opencode-v2-pilot/config 15: Environment=XDG_STATE_HOME=/home/byk/.local/share/opencode-v2-pilot/state 16: User=byk 17: WorkingDirectory=/home/byk 18: ...
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json</path>
<type>file</type>
<content>
1: {
2: "compilerOptions": {
3: "allowImportingTsExtensions": true,
4: "lib": ["ESNext", "DOM", "DOM.Iterable"],
5: "module": "Preserve",
6: "moduleResolution": "Bundler",
7: "noEmit": true,
8: "paths": {
9: "@opencode/plugin": ["/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/index.ts"],
10: "@opencode/plugin/*": ["/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/*.ts"]
11: },
12: "skipLibCheck": true,
13: "strict": true,
14: "target": "ESNext",
15: "types": ["bun"]
16: },
17: "include": ["plugins/**/*.ts", "test/**/*.ts"]
18: }
(End of file - total 18 lines)
</content>
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/package.json</path>
<type>file</type>
<content>
1: {
2: "private": true,
3: "type": "module",
4: "dependencies": {
5: "effect": "file:/home/byk/Code/opencode-v2-pilot/node_modules/.bun/effect@4.0.0-rc.112/node_modules/effect"
6: },
7: "devDependencies": {
8: "@types/bun": "1.2.21"
9: }
10: }
(End of file - total 10 lines)
</content>
Found 36 matches /home/byk/.local/share/opencode-v2-pilot/supervisor/ROOT-ACCEPTANCE.md: Line 5: 1. Rebuild all three binaries twice from the reviewed source with `CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags=-buildid=`. Require both build sets to match. Record the content-bound source revision, Go version, dependency sums, complete build commands, and SHA-256 hashes. Install only those hashes in the root-controlled path: Line 15: 2. Confirm `/usr/local/libexec`, every parent directory, and all three binaries are root-owned and never writable by `byk` or a group. Confirm the Node SEA service uses the reviewed fixed helper path and cannot replace it. Line 19: 4. Prove the client connection peer is the Node SEA MainPID, never the helper. Confirm exact UID, GID, MainPID, `active/running`, `/system.slice/opencode-v2.service`, and the 16-byte InvocationID. Confirm mandatory `SO_PEERPIDFD`; kernels without it fail closed. ...
/tmp/opencode/pty-plugin-smoke-final-10.json /tmp/opencode/pty-plugin-smoke-review-6.json /tmp/opencode/pty-smoke-tsconfig.json /tmp/opencode/pty-plugin-smoke-current-9.json /tmp/opencode/pty-plugin-smoke-fixes-proof-3.json /tmp/opencode/pty-plugin-smoke-fixes-final-9.json /tmp/opencode/pty-tsconfig.json /tmp/opencode/pty-plugin-smoke-final-proof-9.json /tmp/opencode/review-opencode-pty-supervisor /tmp/opencode/opencode-pty-supervisor-b /tmp/opencode/pty-review-fresh-a/opencode-pty-client /tmp/opencode/pty-review-fresh-a/opencode-pty-supervisor /tmp/opencode/pty-review-fresh-a/opencode-pty-launcher /tmp/opencode/pty-plugin-smoke-review-4.json /tmp/opencode/pty-plugin-smoke-fixes-proof-10.json /tmp/opencode/pty-plugin-smoke-fixes-final-3.json /tmp/opencode/pty-plugin-smoke-fixes-proof-8.json /tmp/opencode/opencode-pty-launcher-final-b /tmp/opencode/pty-plugin-smoke-fixes-1.json /tmp/opencode/opencode-pty-client-b /tmp/opencode/pty-plugin-smoke-fixes-4.json /tmp/opencode/pty-plugin-smoke...
/tmp/opencode/pty-plugin-smoke-final-10.json /tmp/opencode/pty-plugin-smoke-review-6.json /tmp/opencode/pty-smoke-tsconfig.json /tmp/opencode/pty-plugin-smoke-current-9.json /tmp/opencode/pty-plugin-smoke-fixes-proof-3.json /tmp/opencode/pty-plugin-smoke-fixes-final-9.json /tmp/opencode/pty-tsconfig.json /tmp/opencode/pty-plugin-smoke-final-proof-9.json /tmp/opencode/pty-plugin-smoke-review-4.json /tmp/opencode/pty-plugin-smoke-fixes-proof-10.json /tmp/opencode/v2-plugin-node-safe-list.json /tmp/opencode/pty-plugin-smoke-fixes-final-3.json /tmp/opencode/pty-plugin-smoke-fixes-proof-8.json /tmp/opencode/pty-plugin-smoke-fixes-1.json /tmp/opencode/pty-plugin-smoke-fixes-4.json /tmp/opencode/pty-plugin-smoke-6.json /tmp/opencode/pty-plugin-smoke-fixes-proof-5.json /tmp/opencode/pty-plugin-smoke-fixes-final-5.json /tmp/opencode/pty-plugin-smoke-final-proof-8.json /tmp/opencode/pty-plugin-smoke-9.json /tmp/opencode/pty-plugin-smoke-7.json /tmp/opencode/pty-plugin-smoke-review-2.json /tmp/op...
Found 64 matches /home/byk/.local/share/opencode-v2-pilot/supervisor/PROTOCOL.md: Line 48: The transient launcher receives the PTY stream as stdin/stdout and the approved cwd descriptor as stderr. It calls `fchdir(2)`, replaces stderr with stdout, validates only canonical `a[A-Za-z0-9_-]*` URL-safe unpadded base64 arguments, clears the environment, and binds its own reviewed executable to fd 3. It passes the bounded encoded argv through one temporary environment value and executes `/usr/bin/script -q -e -f -c "/bin/sh -i -c 'exec /proc/self/fd/3 --exec'" /dev/null`. The inner launcher decodes argv, clears the temporary value, restores the fixed environment, closes fd 3, and directly calls `execve` with the original argv vector. The fixed inner shell is interactive, `script -e` preserves normal command status, shell syntax never evaluates command arguments, and all argument bytes retain their argv ...
<path>/tmp/opencode/pty-plugin-smoke.ts</path>
<type>file</type>
<content>
1: import { createPtyPlugin } from "/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts"
2: import { assertSupervisorAvailable } from "/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts"
3: import type { SupervisorExit, SupervisorTransport } from "/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts"
4: import { mkdir, symlink } from "node:fs/promises"
5:
6: const plugin = createPtyPlugin({
7: async assertAvailable() {},
8: async openTransport(_, command, args, runtimeSeconds) {
9: let listener: ((data: Buffer) => void) | undefined
10: const queued: Buffer[] = []
11: let done = (_: SupervisorExit) => {}
12: let settled = false
13: const exited = new Promise<SupervisorExit>((resolve) => {
14: done = resolve
15: })
16: const finish = (exit: SupervisorExit) => {
17: if (settled) return
18: settled = true
19: ...
Ripgrep JSON record exceeded 65536 bytes
Ripgrep JSON record exceeded 65536 bytes
Ripgrep JSON record exceeded 65536 bytes
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame_test.go</path>
<type>file</type>
<content>
1: package protocol
2:
3: import (
4: "bytes"
5: "errors"
6: "strings"
7: "testing"
8: )
9:
10: func TestStartRoundTrip(t *testing.T) {
11: want := Start{Device: 12, Inode: 34, RuntimeSec: 60, Command: "printf", Args: []string{"%s", "hello world"}}
12: payload, err := EncodeStart(want)
13: if err != nil {
14: t.Fatal(err)
15: }
16: got, err := DecodeStart(payload)
17: if err != nil {
18: t.Fatal(err)
19: }
20: if got.Device != want.Device || got.Inode != want.Inode || got.RuntimeSec != want.RuntimeSec || got.Command != want.Command || strings.Join(got.Args, "\x00") != strings.Join(want.Args, "\x00") {
21: t.Fatalf("got %#v, want %#v", got, want)
22: }
23: }
24:
25: func TestFrameRoundTrip(t *testing.T) {
26: var buffer bytes.Buffer
27: want := Frame{Type: TypeInput, Payload: []byte("hello")}
28: if err := WriteFrame(&buffer, want); err ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main_test.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "bytes"
5: "encoding/base64"
6: "encoding/json"
7: "fmt"
8: "net"
9: "os"
10: "os/exec"
11: "path/filepath"
12: "strings"
13: "testing"
14:
15: "opencode-pty-supervisor/internal/protocol"
16:
17: "golang.org/x/sys/unix"
18: )
19:
20: func TestNodePassesConnectedSocketWithoutChangingPeerMainPID(t *testing.T) {
21: if os.Getenv("OPENCODE_CLIENT_HELPER_TEST") == "1" {
22: encoded := func(value string) string { return "a" + base64.RawURLEncoding.EncodeToString([]byte(value)) }
23: if err := sendStart(socketFD, cwdFD, []string{"60", encoded("/bin/true")}); err != nil {
24: t.Fatal(err)
25: }
26: return
27: }
28: node, err := exec.Command("node", "-p", "process.execPath").Output()
29: if err != nil {
30: t.Skip("node runtime is unavailable")
31: }
32: socketPath := filepath.Join(t.TempDir(), ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/launcher/main_test.go</path>
<type>file</type>
<content>
1: package main
2:
3: import (
4: "bytes"
5: "encoding/base64"
6: "errors"
7: "os"
8: "os/exec"
9: "strings"
10: "testing"
11: )
12:
13: func TestDecodeArgumentsPreservesEveryArgument(t *testing.T) {
14: encoded := []string{
15: "a" + base64.RawURLEncoding.EncodeToString([]byte("printf")),
16: "a" + base64.RawURLEncoding.EncodeToString([]byte("%s\\n")),
17: "a" + base64.RawURLEncoding.EncodeToString([]byte("a'b; $(id)")),
18: "a",
19: }
20: got, err := decodeArguments(encoded)
21: if err != nil {
22: t.Fatal(err)
23: }
24: want := []string{"printf", "%s\\n", "a'b; $(id)", ""}
25: if strings.Join(got, "\x00") != strings.Join(want, "\x00") {
26: t.Fatalf("got %#v, want %#v", got, want)
27: }
28: }
29:
30: func TestDecodeArgumentsRejectsInvalidGrammar(t *testing.T) {
31: if _, err := decodeArguments([]string{"bad="}); err == nil {
32: ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/auth_test.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "os"
6: "testing"
7: )
8:
9: type authenticationManager struct {
10: identity clientIdentity
11: }
12:
13: func (manager *authenticationManager) ClientState(context.Context) (clientIdentity, error) {
14: return manager.identity, nil
15: }
16:
17: func (*authenticationManager) Start(context.Context, string, protocolCommand, *os.File, *os.File, uint32) error {
18: return nil
19: }
20:
21: func (*authenticationManager) StopAndWait(context.Context, string) error { return nil }
22: func (*authenticationManager) Wait(context.Context, string) (unitResult, error) {
23: return unitResult{}, nil
24: }
25: func (*authenticationManager) CleanupOrphans(context.Context) error { return nil }
26: func (*authenticationManager) Close() {}
27:
28: func currentIdentity() clientIdentity ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "bytes"
5: "context"
6: "encoding/binary"
7: "encoding/json"
8: "errors"
9: "fmt"
10: "io"
11: "net"
12: "os"
13: "os/exec"
14: "path/filepath"
15: "sync"
16: "syscall"
17: "testing"
18: "time"
19:
20: "opencode-pty-supervisor/internal/protocol"
21:
22: "golang.org/x/sys/unix"
23: )
24:
25: type sessionManager struct {
26: startErr error
27: wait chan unitResult
28: stop func() error
29: stopped chan struct{}
30: once sync.Once
31: identity int
32: }
33:
34: func (manager *sessionManager) ClientState(context.Context) (clientIdentity, error) {
35: manager.identity++
36: return currentIdentity(), nil
37: }
38:
39: func (manager *sessionManager) Start(context.Context, string, protocolCommand, *os.File, *os.File, uint32) error {
40: return manager.startErr
41: }
42:
43: func ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/systemd_test.go</path>
<type>file</type>
<content>
1: package supervisor
2:
3: import (
4: "context"
5: "errors"
6: "os"
7: "os/exec"
8: "strings"
9: "testing"
10: "time"
11:
12: systemddbus "github.com/coreos/go-systemd/v22/dbus"
13: "github.com/godbus/dbus/v5"
14: )
15:
16: func TestUnitNameGrammar(t *testing.T) {
17: valid := "opencode-pty-0123456789abcdef0123456789abcdef.service"
18: if !validUnitName(valid) {
19: t.Fatalf("rejected %q", valid)
20: }
21: for _, invalid := range []string{
22: "opencode-pty-.service",
23: "opencode-pty-0123456789ABCDEF0123456789ABCDEF.service",
24: "opencode-pty-0123456789abcdef0123456789abcdef.scope",
25: "opencode-pty-0123456789abcdef0123456789abcdef.service/../x",
26: } {
27: if validUnitName(invalid) {
28: t.Fatalf("accepted %q", invalid)
29: }
30: }
31: }
32:
33: func TestWaitForJobResultRejectsClosedNonDoneAndTimeout(t *testing.T) ...
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/go.mod</path> <type>file</type> <content> 1: module opencode-pty-supervisor 2: 3: go 1.22 4: 5: require ( 6: github.com/coreos/go-systemd/v22 v22.5.0 7: github.com/godbus/dbus/v5 v5.1.0 8: golang.org/x/sys v0.20.0 9: ) (End of file - total 9 lines) </content>
<path>/home/byk/.local/share/opencode-v2-pilot/supervisor/go.sum</path> <type>file</type> <content> 1: github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs= 2: github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= 3: github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= 4: github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= 5: github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= 6: golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= 7: golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= (End of file - total 7 lines) </content>
<path>/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/permission.ts</path>
<type>file</type>
<content>
1: import type { PermissionApi } from "@opencode/client/promise/api"
2: import type { Agent } from "@opencode/schema/agent"
3: import type { Permission } from "@opencode/schema/permission"
4: import type { Session } from "@opencode/schema/session"
5: import type { Hooks } from "./registration.js"
6:
7: export interface PermissionEvaluation {
8: readonly sessionID: Session.ID
9: readonly agent?: Agent.ID
10: readonly action: string
11: readonly resources: ReadonlyArray<string>
12: readonly metadata?: Record<string, unknown>
13: readonly source?: Permission.Source
14: effect: Permission.Effect
15: message?: string
16: }
17:
18: export interface PermissionHooks {
19: readonly evaluate: PermissionEvaluation
20: }
21:
22: export interface PermissionAssertInput {
23: readonly sessionID: Session.ID
24: readonly action: string
25: readonly resources: ...
<path>/home/byk/Code/opencode-v2-pilot/packages/plugin/src/effect/permission.ts</path>
<type>file</type>
<content>
1: import type { PermissionApi } from "@opencode/client/effect/api"
2: import type { Agent } from "@opencode/schema/agent"
3: import type { Permission } from "@opencode/schema/permission"
4: import type { Session } from "@opencode/schema/session"
5: import type { Effect } from "effect"
6: import type { Hooks } from "./registration.js"
7:
8: export interface PermissionEvaluation {
9: readonly sessionID: Session.ID
10: readonly agent?: Agent.ID
11: readonly action: string
12: readonly resources: ReadonlyArray<string>
13: readonly metadata?: Record<string, unknown>
14: readonly source?: Permission.Source
15: effect: Permission.Effect
16: message?: string
17: }
18:
19: export interface PermissionHooks {
20: readonly evaluate: PermissionEvaluation
21: }
22:
23: export interface PermissionAssertInput {
24: readonly sessionID: Session.ID
25: readonly ...
<path>/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/adapter.ts</path>
<type>file</type>
<content>
1: import { Tool } from "@opencode/schema/tool"
2: import type { Rpc } from "@opencode/schema/rpc"
3: import type { RpcCallOptions, RpcEventPayload } from "@opencode/client/promise/api"
4: import { Effect, Schema, SchemaAST, Stream } from "effect"
5: import type { Scope } from "effect"
6: import { HttpApiEndpoint, HttpApiSchema } from "effect/unstable/httpapi"
7: import { define } from "../effect/plugin.js"
8: import type { Plugin } from "./plugin.js"
9: import type { Info } from "./tool.js"
10: import type { RpcDomain, RpcHandlers } from "./rpc.js"
11:
12: type HostRegistration = { readonly dispose: Effect.Effect<void> }
13: type Registration = { readonly dispose: () => Promise<void> }
14: type PromiseContext = Parameters<Plugin["setup"]>[0]
15: type PromiseEvent = ReturnType<PromiseContext["event"]["subscribe"]> extends AsyncIterable<infer Event> ? ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/plugin/host.ts</path>
<type>file</type>
<content>
1: export * as PluginHost from "./host.js"
2:
3: import { Plugin } from "@opencode/plugin/effect"
4: import type { IntegrationMethodRegistration } from "@opencode/plugin/effect/integration"
5: import { EventManifest } from "@opencode/schema/event-manifest"
6: import type { Event } from "@opencode/schema/event"
7: import { ServerConfig } from "@opencode/schema/mcp"
8: import { App } from "../app.js"
9: import { Effect, Schema, Stream } from "effect"
10: import { Agent } from "../agent.js"
11: import { AISDK } from "../aisdk.js"
12: import { Catalog } from "../catalog.js"
13: import { Command } from "../command.js"
14: import { Credential } from "../credential.js"
15: import { Bus } from "../bus.js"
16: import { Integration } from "../integration.js"
17: import { KV } from "../kv.js"
18: import { Location } from "../location.js"
19: import { LocationServiceMap } from ...
Found 13 matches
/home/byk/Code/opencode-v2-pilot/packages/core/src/permission.ts:
Line 64: export class DeclinedError extends Schema.TaggedError<DeclinedError>()("Permission.DeclinedError", {}) {}
Line 66: export class CorrectedError extends Schema.TaggedError<CorrectedError>()("Permission.CorrectedError", {
Line 85: export type Error = BlockedError | CorrectedError
Line 117: readonly deferred: Deferred.Deferred<void, DeclinedError | CorrectedError>
Line 132: Effect.forEach(pending.values(), (item) => Deferred.fail(item.deferred, new DeclinedError()), {
Line 202: const deferred = yield* Deferred.make<void, DeclinedError | CorrectedError>()
Line 221: const assert = Effect.fn("Permission.assert")((input: AssertInput) =>
Line 240: // WITH feedback (CorrectedError) intentionally stays typed so the leaf can turn
Line 242: Effect.catchTag("Permission.DeclinedError", (error) => Effect.die(error)),
Line 268: ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/permission.ts</path>
<type>file</type>
<content>
200: Effect.uninterruptible(
201: Effect.gen(function* () {
202: const deferred = yield* Deferred.make<void, DeclinedError | CorrectedError>()
203: const item = { request, agent, deferred }
204: if (pending.has(request.id))
205: return yield* Effect.die(new Error(`Duplicate pending permission ID: ${request.id}`))
206: pending.set(request.id, item)
207: yield* bus
208: .publish(Permission.Event.Asked, request)
209: .pipe(Effect.onError(() => Effect.sync(() => pending.delete(request.id))))
210: return item
211: }),
212: )
213:
214: const ask = Effect.fn("Permission.ask")(function* (input: AssertInput) {
215: const result = yield* evaluateInput(input)
216: const value = request(input, result.message)
217: if (result.effect === "ask") ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/test/plugin/host.ts</path>
<type>file</type>
<content>
1: import { Plugin } from "@opencode/plugin/effect"
2: import type { IntegrationMethod } from "@opencode/plugin/effect/integration"
3: import { Agent } from "@opencode/core/agent"
4: import { Catalog } from "@opencode/core/catalog"
5: import { Credential } from "@opencode/core/credential"
6: import { Integration } from "@opencode/core/integration"
7: import { Location } from "@opencode/core/location"
8: import { Model } from "@opencode/core/model"
9: import { Project } from "@opencode/core/project"
10: import { Provider } from "@opencode/core/provider"
11: import { AbsolutePath } from "@opencode/core/schema"
12: import { WebSearch } from "@opencode/core/websearch"
13: import { Effect, Stream } from "effect"
14:
15: type Overrides = Partial<Omit<Plugin.Context, "options" | "session">> & {
16: readonly session?: Partial<Plugin.Context["session"]>
17: }
18: export function ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/test/plugin/fixture.ts</path>
<type>file</type>
<content>
1: import { Agent } from "@opencode/core/agent"
2: import { AISDK } from "@opencode/core/aisdk"
3: import { Catalog } from "@opencode/core/catalog"
4: import { Command } from "@opencode/core/command"
5: import { Config } from "@opencode/core/config"
6: import { Credential } from "@opencode/core/credential"
7: import { LayerNodePlatform } from "@opencode/util/effect/app-node-platform"
8: import { AppProcess } from "@opencode/util/process"
9: import { LayerNode } from "@opencode/util/effect/layer-node"
10: import { Bus } from "@opencode/core/bus"
11: import { FileSystem } from "@opencode/core/filesystem"
12: import { FSUtil } from "@opencode/util/fs-util"
13: import { Form } from "@opencode/core/form"
14: import { Generate } from "@opencode/core/generate"
15: import { Integration } from "@opencode/core/integration"
16: import { KV } from "@opencode/core/kv"
17: import { ...
Found 100 matches (more matches available)
/home/byk/Code/opencode-v2-pilot/packages/core/test/skill/instructions.test.ts:
Line 51: permissions: [{ action: "skill", resource: "denied", effect: "deny" }],
Line 142: permissions: [{ action: "skill", resource: "*", effect: "deny" }],
Line 153: permissions: [
Line 167: permissions: [
Line 183: permissions: [
/home/byk/Code/opencode-v2-pilot/packages/core/test/permission.test.ts:
Line 9: import { Permission } from "@opencode/core/permission"
Line 10: import { PermissionTable } from "@opencode/core/permission/sql"
Line 11: import { PermissionSaved } from "@opencode/core/permission/saved"
Line 66: agent.permissions = [...rules]
Line 122: agent.permissions.push({ action: "read", resource: "*", effect: "deny" })
Line 131: agent.permissions = []
Line 166: it.effect("uses build permissions when the Session agent is omitted", () =>
Line 179: ...
Found 4 matches
/home/byk/Code/opencode-v2-pilot/packages/core/test/plugin.test.ts:
Line 25: if (input.action === "corrected") return Effect.fail(new Permission.CorrectedError({ feedback: correctedFeedback }))
Line 26: if (input.action === "declined") return Effect.die(new Permission.DeclinedError())
Line 472: await ctx.permission.assert({
Line 509: await ctx.permission.assert({
<path>/home/byk/Code/opencode-v2-pilot/packages/core/test/plugin.test.ts</path>
<type>file</type>
<content>
1: import { expect } from "bun:test"
2: import path from "path"
3: import { Cause, Clock, Deferred, Effect, Exit, Schema } from "effect"
4: import { TestClock } from "effect/testing"
5: import { Agent } from "@opencode/core/agent"
6: import { Command } from "@opencode/core/command"
7: import { Bus } from "@opencode/core/bus"
8: import { Credential } from "@opencode/core/credential"
9: import { Integration } from "@opencode/core/integration"
10: import { Permission } from "@opencode/core/permission"
11: import { Plugin } from "@opencode/core/plugin"
12: import { PluginModule } from "@opencode/core/plugin/module"
13: import { SessionMessage } from "@opencode/core/session/message"
14: import { Tool } from "@opencode/core/tool"
15: import { Watcher } from "@opencode/core/filesystem/watcher"
16: import { fromPromise } from "@opencode/plugin/promise/adapter"
17: import { Session } ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/test/plugin.test.ts</path>
<type>file</type>
<content>
430: yield* Deferred.await(cleaned)
431: expect(yield* commands.get("healthy")).toBeDefined()
432: expect((yield* plugins.list())[0]?.state.status).toBe("failed")
433: }),
434: )
435:
436: it.live("retains Promise plugin groups for later registrations and ignores a disabled group's attempts", () =>
437: Effect.gen(function* () {
438: const plugins = yield* Plugin.Service
439: const commands = yield* Command.Service
440: let register = async () => {}
441: const definition = fromPromise({
442: id: "promise-plugin",
443: setup(ctx) {
444: register = async () => {
445: await ctx.command.transform((editor) => {
446: editor.add({ name: "late", execute: async () => {} })
447: throw new Error("late Promise failure")
448: })
449: }
450: },
451: })
452: yield* ...
No files found
No files found
[
{
"content": "Inventory exact review scope and verify immutable source/artifact hashes",
"status": "completed",
"priority": "high"
},
{
"content": "Inspect every source, config, unit, CUTOVER, and PTY test file with pinned APIs",
"status": "in_progress",
"priority": "high"
},
{
"content": "Run canonical unprivileged typecheck, tests, reproducibility, and artifact checks",
"status": "pending",
"priority": "high"
},
{
"content": "Trace each prior blocker and end-to-end correctness invariant to evidence",
"status": "pending",
"priority": "high"
},
{
"content": "Deliver classified independent verdict with root acceptance separated",
"status": "pending",
"priority": "high"
}
]
<path>/tmp/opencode/pty-tsconfig.json</path>
<type>file</type>
<content>
1: {
2: "compilerOptions": {
3: "allowImportingTsExtensions": true,
4: "lib": ["ESNext", "DOM", "DOM.Iterable"],
5: "module": "Preserve",
6: "moduleResolution": "Bundler",
7: "noEmit": true,
8: "paths": {
9: "@opencode/plugin": ["/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/index.ts"],
10: "@opencode/plugin/*": ["/home/byk/Code/opencode-v2-pilot/packages/plugin/src/promise/*.ts"],
11: "effect": ["/home/byk/Code/opencode-v2-pilot/node_modules/.bun/effect@4.0.0-rc.112/node_modules/effect/dist/index.d.ts"],
12: "effect/*": ["/home/byk/Code/opencode-v2-pilot/node_modules/.bun/effect@4.0.0-rc.112/node_modules/effect/dist/*.d.ts"]
13: },
14: "skipLibCheck": true,
15: "strict": true,
16: "target": "ESNext",
17: "typeRoots": [
18: "/home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/@types",
19: ...
<path>/tmp/opencode/pty-smoke-tsconfig.json</path>
<type>file</type>
<content>
1: {
2: "compilerOptions": {
3: "allowImportingTsExtensions": true,
4: "module": "Preserve",
5: "moduleResolution": "Bundler",
6: "noEmit": true,
7: "paths": {
8: "@opencode/plugin": ["/tmp/opencode/pty-plugin-stub.ts"]
9: },
10: "target": "ESNext"
11: }
12: }
(End of file - total 12 lines)
</content>
No files found
/home/byk/.volta/bin/bun /usr/bin/go go version go1.22.2 linux/amd64 v24.16.0 1.3.14
<path>/home/byk/Code/opencode-v2-pilot/package.json</path>
<type>file</type>
<content>
1: {
2: "$schema": "https://json.schemastore.org/package.json",
3: "name": "opencode",
4: "description": "AI-powered development tool",
5: "version": "0.0.0",
6: "private": true,
7: "type": "module",
8: "packageManager": "bun@1.4.2",
9: "scripts": {
10: "dev": "bun run --cwd packages/cli src/index.ts",
11: "dev:live": "sh -c 'OPENCODE_TUI_CHANNEL=dev OPENCODE_PASSWORD=\"$(opencode2 service get password)\" exec bun run dev \"$@\" --server \"$(opencode2 service status)\"' --",
12: "dev:desktop": "bun --cwd packages/desktop dev",
13: "dev:web": "bun --cwd packages/app dev",
14: "dev:console": "ulimit -n 10240 2>/dev/null; bun run --cwd packages/console/app dev",
15: "dev:stats": "bun sst shell --stage=production -- bun run --cwd packages/stats/app dev",
16: "dev:www": "bun run --cwd services/www dev",
17: "dev:storybook": "bun --cwd packages/storybook ...
No files found
(no output)
[
{
"content": "Inventory exact review scope and verify immutable source/artifact hashes",
"status": "completed",
"priority": "high"
},
{
"content": "Inspect every source, config, unit, CUTOVER, and PTY test file with pinned APIs",
"status": "completed",
"priority": "high"
},
{
"content": "Run canonical unprivileged typecheck, tests, reproducibility, and artifact checks",
"status": "in_progress",
"priority": "high"
},
{
"content": "Trace each prior blocker and end-to-end correctness invariant to evidence",
"status": "pending",
"priority": "high"
},
{
"content": "Deliver classified independent verdict with root acceptance separated",
"status": "pending",
"priority": "high"
}
]
The canonical pilot tsconfig.json passes bun x tsgo -p … --noEmit unchanged, including both PTY files and test/followup.test.ts; no exclusion or reduced file list was used. I found direct tests for the bounded backpressured STOP write and the helper description now says “Kill the PTY,” so both earlier blockers are closed in source.
ok opencode-pty-supervisor/cmd/client (cached) ok opencode-pty-supervisor/cmd/launcher (cached) ? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/internal/protocol (cached) ok opencode-pty-supervisor/internal/supervisor 3.783s
? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/cmd/client 0.234s ok opencode-pty-supervisor/cmd/launcher 1.134s ok opencode-pty-supervisor/internal/protocol 0.010s ok opencode-pty-supervisor/internal/supervisor 3.786s
? opencode-pty-supervisor/cmd/supervisor [no test files] ok opencode-pty-supervisor/cmd/client 2.241s ok opencode-pty-supervisor/cmd/launcher 2.059s ok opencode-pty-supervisor/internal/protocol 1.040s ok opencode-pty-supervisor/internal/supervisor 5.047s
(no output)
$ tsgo --noEmit
bun test v1.3.14 (0d9b296a)
test/plugin.test.ts:
[00:02:00.000] INFO (#7640): credential updated {
credentialID: "cred_0801dc534001QeethROnGqBWFe",
integrationID: "refresh-fixture",
valueChanged: true,
labelChanged: false,
}
19 pass
0 fail
65 expect() calls
Ran 19 tests across 1 file. [2.89s]
$ tsgo -b tsconfig.json tsconfig.tests.json
{"tools":["pty_spawn","pty_write","pty_read","pty_list","pty_kill"],"permissions":true,"ownership":true,"interactive":true,"notification":true,"timeout":true,"supervisorStop":true,"failClosedActivation":true,"sessionDeletion":true,"inflightDeletion":true,"atomicReservations":true,"argvBounds":true,"utf8Bytes":true,"linePaging":true,"preListenerOutputBound":true,"cleanup":true}
(no output)
5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-10.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-1.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-2.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-3.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-4.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-5.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-6.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 /tmp/opencode/pty-review-final-7.json 5aa1a58bafee41a7878a04f582d5a7a3f8e3314acae18d148263e7e075d1fe30 ...
Fresh Go tests, race tests, vet, plugin/core package typechecks, and the focused plugin tests all pass. The reviewed smoke harness also passed ten fresh runs with byte-identical JSON results; I am now checking deterministic rebuilds against the claimed artifacts and then will map every remaining acceptance item to source proof or an explicit host-only blocker.
(no output)
(no output)
ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2 /tmp/opencode/pty-review-fresh-a/opencode-pty-supervisor ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2 /tmp/opencode/pty-review-fresh-b/opencode-pty-supervisor d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd /tmp/opencode/pty-review-fresh-a/opencode-pty-launcher d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd /tmp/opencode/pty-review-fresh-b/opencode-pty-launcher fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde /tmp/opencode/pty-review-fresh-a/opencode-pty-client fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde /tmp/opencode/pty-review-fresh-b/opencode-pty-client ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2 bin/opencode-pty-supervisor d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd bin/opencode-pty-launcher fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde ...
bin/opencode-pty-supervisor: go1.22.2 path opencode-pty-supervisor/cmd/supervisor mod opencode-pty-supervisor (devel) dep github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs= dep github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= dep golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= build -buildmode=exe build -compiler=gc build -trimpath=true build CGO_ENABLED=0 build GOARCH=amd64 build GOOS=linux build GOAMD64=v1 bin/opencode-pty-launcher: go1.22.2 path opencode-pty-supervisor/cmd/launcher mod opencode-pty-supervisor (devel) dep golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= build -buildmode=exe build -compiler=gc build -trimpath=true build CGO_ENABLED=0 build GOARCH=amd64 build GOOS=linux build GOAMD64=v1 bin/opencode-pty-client: ...
2ac698d65aa4690a694307e9cbdf44537ea9a4fb 2ac698d65aa4690a694307e9cbdf44537ea9a4fb
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/test/followup.test.ts</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "bun:test"
2: import followup from "../plugins/followup.ts"
3:
4: describe("followup", () => {
5: test("schedules, lists, cancels, delivers, and rejects subagents", async () => {
6: const tools = new Map<string, Tool>()
7: const prompts: Array<{ sessionID: string; text: string; delivery?: string }> = []
8: const controller = new AbortController()
9: const context = {
10: session: {
11: get: async ({ sessionID }: { sessionID: string }) =>
12: sessionID === "subagent" ? { id: sessionID, parentID: "parent" } : { id: sessionID },
13: prompt: async (input: { sessionID: string; text: string; delivery?: string }) => {
14: prompts.push(input)
15: return {}
16: },
17: },
18: tool: {
19: transform: async (callback: (editor: { add(tool: Tool): void }) => void) => {
20: callback({ ...
bun test v1.3.14 (0d9b296a) 1 pass 0 fail 7 expect() calls Ran 1 test across 1 file. [1352.00ms]
bin/opencode-pty-supervisor: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, with debug_info, not stripped bin/opencode-pty-launcher: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, with debug_info, not stripped bin/opencode-pty-client: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, with debug_info, not stripped not a dynamic executable not a dynamic executable not a dynamic executable
Found 9 matches
/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/properties.go:
Line 57: func PropExecStart(command []string, uncleanIsFailure bool) Property {
Line 83: func PropType(t string) Property {
Line 138: func PropBindsTo(units ...string) Property {
Line 186: func PropAfter(units ...string) Property {
/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods.go:
Line 122: func (c *Conn) StopUnitContext(ctx context.Context, name string, mode string, ch chan<- string) (int, error) {
Line 181: // Deprecated: use StartTransientUnitContext instead.
Line 183: return c.StartTransientUnitContext(context.Background(), name, mode, properties, ch)
Line 186: // StartTransientUnitContext may be used to create and start a transient unit, which
Line 191: func (c *Conn) StartTransientUnitContext(ctx context.Context, name string, mode string, properties []Property, ch chan<- string) (int, error) {
<path>/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/properties.go</path>
<type>file</type>
<content>
45: }
46:
47: type execStart struct {
48: Path string // the binary path to execute
49: Args []string // an array with all arguments to pass to the executed command, starting with argument 0
50: UncleanIsFailure bool // a boolean whether it should be considered a failure if the process exits uncleanly
51: }
52:
53: // PropExecStart sets the ExecStart service property. The first argument is a
54: // slice with the binary path to execute followed by the arguments to pass to
55: // the executed command. See
56: // http://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
57: func PropExecStart(command []string, uncleanIsFailure bool) Property {
58: execStarts := []execStart{
59: {
60: Path: command[0],
61: Args: command,
62: UncleanIsFailure: uncleanIsFailure,
63: },
64: ...
<path>/home/byk/go/pkg/mod/github.com/coreos/go-systemd/v22@v22.5.0/dbus/methods.go</path>
<type>file</type>
<content>
105: // If no error occurs, the ID of the underlying systemd job will be returned. There
106: // does exist the possibility for no error to be returned, but for the returned job
107: // ID to be 0. In this case, the actual underlying ID is not 0 and this datapoint
108: // should not be considered authoritative.
109: //
110: // If an error does occur, it will be returned to the user alongside a job ID of 0.
111: func (c *Conn) StartUnitContext(ctx context.Context, name string, mode string, ch chan<- string) (int, error) {
112: return c.startJob(ctx, ch, "org.freedesktop.systemd1.Manager.StartUnit", name, mode)
113: }
114:
115: // Deprecated: use StopUnitContext instead.
116: func (c *Conn) StopUnit(name string, mode string, ch chan<- string) (int, error) {
117: return c.StopUnitContext(context.Background(), name, mode, ch)
118: }
119:
120: // StopUnitContext is ...
diff --git a/packages/core/src/plugin/host.ts b/packages/core/src/plugin/host.ts
index 44beadcc6c..6abb955508 100644
--- a/packages/core/src/plugin/host.ts
+++ b/packages/core/src/plugin/host.ts
@@ -383,6 +383,7 @@ export const make = Effect.fn("PluginHost.make")(function* (
},
permission: {
hook: (name, callback) => hooks.register("permission", name, callback),
+ assert: permission.assert,
list: (input) => permission.forSession(input.sessionID),
get: (input) =>
permission
diff --git a/packages/core/test/plugin.test.ts b/packages/core/test/plugin.test.ts
index 1b71e18978..18a6966a62 100644
--- a/packages/core/test/plugin.test.ts
+++ b/packages/core/test/plugin.test.ts
@@ -1,20 +1,33 @@
import { expect } from "bun:test"
import path from "path"
-import { Clock, Deferred, Effect } from "effect"
+import { Cause, Clock, Deferred, Effect, Exit, Schema } from "effect"
import { TestClock } from "effect/testing"
+import { Agent } from ...
/home/byk/Code/opencode-v2-pilot/packages/core/test/persistent-pty-daemon.test.ts /home/byk/Code/opencode-v2-pilot/packages/server/test/persistent-pty.test.ts
/home/byk/Code/opencode-v2-pilot/packages/client/test/solid-pty.test.ts /home/byk/Code/opencode-v2-pilot/packages/core/test/persistent-pty-daemon.test.ts /home/byk/Code/opencode-v2-pilot/packages/core/test/pty/pty-windows.test.ts /home/byk/Code/opencode-v2-pilot/packages/core/test/pty/pty-session.test.ts /home/byk/Code/opencode-v2-pilot/packages/server/test/pty-socket.test.ts /home/byk/Code/opencode-v2-pilot/packages/server/test/persistent-pty.test.ts
<path>/home/byk/Code/opencode-v2-pilot/packages/core/test/persistent-pty-daemon.test.ts</path>
<type>file</type>
<content>
1: import { expect } from "bun:test"
2: import { spawn } from "node:child_process"
3: import { mkdtemp, rm, writeFile } from "node:fs/promises"
4: import net from "node:net"
5: import os from "node:os"
6: import path from "node:path"
7: import { Effect } from "effect"
8: import { makeDaemonTransport } from "../src/persistent-pty/daemon"
9: import { it } from "./lib/effect"
10:
11: const pong = { type: "pong", instance_id: "test", pid: process.pid, protocol: 7 }
12:
13: it.live("rediscovers a same-protocol daemon after its registration rotates", () =>
14: Effect.gen(function* () {
15: const directory = yield* temporaryDirectory()
16: const socketPath = path.join(directory, "daemon.sock")
17: let token = "old-token"
18: let instance = "old-instance"
19: let creates = 0
20: yield* listen(socketPath, (_socket, request, receivedToken) => ...
<path>/home/byk/Code/opencode-v2-pilot/packages/server/test/persistent-pty.test.ts</path>
<type>file</type>
<content>
1: import { existsSync } from "node:fs"
2: import fs from "node:fs/promises"
3: import os from "node:os"
4: import path from "node:path"
5: import { expect } from "bun:test"
6: import { PersistentPty } from "@opencode/schema/persistent-pty"
7: import { Session } from "@opencode/schema/session"
8: import { Effect, Exit, Schema, Scope } from "effect"
9: import { HttpServer } from "effect/unstable/http"
10: import { OpenCode } from "../../client/src/promise/index"
11: import { it } from "../../core/test/lib/effect"
12: import { ServerProcess } from "../src/process"
13:
14: const binary = process.env.OPENCODE_PTY_BIN ?? "/root/projects/opencode-pty/target/debug/opencode-pty"
15: const smoke = existsSync(binary) ? it.live : it.live.skip
16:
17: smoke(
18: "reads the latest controlled terminal with optional physical line counts through the SDK",
19: () =>
20: ...
No files found
bun test v1.3.14 (0d9b296a) 5 pass 0 fail 12 expect() calls Ran 5 tests across 1 file. [380.00ms]
bun test v1.3.14 (0d9b296a) 0 pass 3 skip 0 fail Ran 3 tests across 1 file. [1.72s]
<path>/home/byk/.local/share/opencode-v2-pilot/config/opencode/bun.lock</path>
<type>file</type>
<content>
1: {
2: "lockfileVersion": 1,
3: "configVersion": 1,
4: "workspaces": {
5: "": {
6: "dependencies": {
7: "effect": "file:/home/byk/Code/opencode-v2-pilot/node_modules/.bun/effect@4.0.0-rc.112/node_modules/effect",
8: },
9: "devDependencies": {
10: "@types/bun": "1.2.21",
11: },
12: },
13: },
14: "packages": {
15: "@msgpackr-extract/msgpackr-extract-darwin-arm64": ["@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ=="],
16:
17: "@msgpackr-extract/msgpackr-extract-darwin-x64": ["@msgpackr-extract/msgpackr-extract-darwin-x64@3.0.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w=="],
18:
19: ...
bun test v1.3.14 (0d9b296a) 7 pass 2 skip 0 fail 30 expect() calls Ran 9 tests across 2 files. [1.84s]
bun test v1.3.14 (0d9b296a) 1 pass 0 fail 2 expect() calls Ran 1 test across 1 file. [250.00ms]
bun test v1.3.14 (0d9b296a) 3 pass 0 fail 16 expect() calls Ran 3 tests across 1 file. [245.00ms]
Found 51 matches
/tmp/opencode/pty-plugin-smoke.ts:
Line 2: import { assertSupervisorAvailable } from "/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts"
Line 7: async assertAvailable() {},
Line 36: if (runtimeSeconds) setTimeout(() => finish({ result: "timeout", execMainCode: 2, execMainStatus: 15 }), runtimeSeconds * 1_000)
Line 57: const tools = new Map<string, { execute: (input: unknown, context: unknown) => Promise<{ output: string }>; options?: { permission?: string } }>()
Line 62: let permissions = [{ action: "*", resource: "*", effect: "allow" as const }]
Line 63: const permissionCalls: Array<{ action: string; resources: readonly string[]; save?: readonly string[]; source?: unknown }> = []
Line 64: let permissionGate: Promise<void> | undefined
Line 67: await assertSupervisorAvailable({ helperPath: "/tmp/opencode/does-not-exist", socketPath: "/tmp/opencode/does-not-exist.sock" })
Line 86: permission: {
Line 87: ...
Version 7.0.0-dev.20251207.1
<path>/home/byk/Code/opencode-v2-pilot/packages/plugin/package.json</path>
<type>file</type>
<content>
1: {
2: "$schema": "https://json.schemastore.org/package.json",
3: "name": "@opencode/plugin",
4: "version": "1.18.15",
5: "type": "module",
6: "license": "MIT",
7: "scripts": {
8: "test": "bun test --only-failures",
9: "typecheck": "tsgo --noEmit",
10: "build": "tsc -p tsconfig.build.json"
11: },
12: "exports": {
13: ".": "./src/promise/index.ts",
14: "./effect": "./src/effect/index.ts",
15: "./host": "./src/host.ts",
16: "./tui": "./src/tui/index.ts",
17: "./*": "./src/*.ts"
18: },
19: "imports": {
20: "#plugin-source": {
21: "bun": "./src/source.bun.ts",
22: "node": "./src/source.node.ts",
23: "default": "./src/source.node.ts"
24: }
25: },
26: "files": [
27: "dist"
28: ],
29: "dependencies": {
30: "@ai-sdk/provider": "3.0.8",
31: "@opencode/ai": "workspace:*",
32: ...
1 0 packages/core/src/plugin/host.ts 100 2 packages/core/test/plugin.test.ts 59 55 packages/core/test/plugin/fixture.ts 1 0 packages/core/test/plugin/host.ts 12 0 packages/plugin/src/effect/permission.ts 36 5 packages/plugin/src/promise/adapter.ts 11 0 packages/plugin/src/promise/permission.ts
ae666b20da50bcd40fcd02b80de781c9907d9902c68106adc5c1d79aa28e6408 /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts e464229acac2e97f1e24c93b59a075286838bd3307a4f9c778cda57337574ce3 /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts 07196988cfa0e34e77927d4ec5e208a5e7ea66192b70af0dde27a9a049ee92b5 /home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json cbe806483294fe4b7fe9c5fa98723ccbfe0baa8ab202a030b08c0cdf097af2e9 /home/byk/.local/share/opencode-v2-pilot/config/opencode/package.json 6354314458f32d267337225e3509a8afd9ca4e4874306f35dad81083a0f35ec5 /home/byk/.local/share/opencode-v2-pilot/config/opencode/bun.lock 07181f554cf14fe2608b759a048870353bb4b440c0be9d06126464e6f36b1612 /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service 1c6fb3e2199f7475f2020981cb8eac05cdded6083291b5cab7e997068fdb48fd /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md
Found 12 matches
/home/byk/Code/opencode-v2-pilot/packages/core/src/tool.ts:
Line 61: }) => Effect.Effect<NormalizedResult, Tool.Error>
Line 112: const executeTool = Effect.fn("Tool.execute")(function* (
Line 120: Effect.catchTag("Tool.Error", (failure) => Effect.succeed({ failure })),
Line 236: Effect.flatMap((event) => executeTool(tool, name, event.input, context)),
Line 261: return yield* new Tool.Error({ message: `Tool is not available for this request: ${event.tool}` })
Line 264: return yield* executeTool(codeModeTool, name, event.input, context)
Line 266: if (tool) return yield* executeTool(tool, name, event.input, context)
Line 267: return yield* new Tool.Error({ message: `Unknown tool: ${name}` })
/home/byk/Code/opencode-v2-pilot/packages/core/src/codemode/tool.ts:
Line 72: executeTool: (name: string, tool: Info, input: unknown, context: Context) => ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/tool.ts</path>
<type>file</type>
<content>
100: })
101:
102: const beforeExecute = (name: string, input: unknown, context: Tool.Context) =>
103: hooks.trigger("tool", "execute.before", {
104: tool: name,
105: sessionID: context.sessionID,
106: agent: context.agent,
107: messageID: context.messageID,
108: id: context.id,
109: input,
110: })
111:
112: const executeTool = Effect.fn("Tool.execute")(function* (
113: tool: Tool.Info,
114: name: string,
115: input: unknown,
116: context: Tool.Context,
117: ) {
118: const execution = yield* execute(tool, input, context).pipe(
119: Effect.map((value) => ({ value })),
120: Effect.catchTag("Tool.Error", (failure) => Effect.succeed({ failure })),
121: )
122: const base = {
123: tool: name,
124: sessionID: context.sessionID,
125: ...
No files found
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/tool.ts</path>
<type>file</type>
<content>
50: export interface Snapshot {
51: readonly definitions: ReadonlyArray<ToolDefinition>
52: readonly codeModeCatalog?: CodeModeCatalog.Inventory
53: readonly execute: (input: {
54: readonly sessionID: SessionSchema.ID
55: readonly agent: Agent.ID
56: readonly messageID: SessionMessage.ID
57: readonly call: ToolCall
58: readonly progress?: (update: Tool.Metadata) => Effect.Effect<void>
59: /** Surviving request definitions, keyed by the names advertised after session context hooks. */
60: readonly definitions?: ReadonlyMap<string, ToolDefinition>
61: }) => Effect.Effect<NormalizedResult, Tool.Error>
62: }
63:
64: export class Service extends Context.Service<Service, Interface>()("@opencode/Tool") {}
65:
66: const layer = Layer.effect(
67: Service,
68: Effect.gen(function* () {
69: const hooks = yield* PluginHooks.Service
70: const image = ...
Found 2 matches
/home/byk/Code/opencode-v2-pilot/packages/core/src/tool.ts:
Line 112: const executeTool = Effect.fn("Tool.execute")(function* (
/home/byk/Code/opencode-v2-pilot/packages/core/src/codemode/tool.ts:
Line 94: const executed = yield* executeTool(name, tool, input, context)
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/tool.ts</path>
<type>file</type>
<content>
155: })
156:
157: const state = State.create<Data, Editor>({
158: name: "tool",
159: initial: () => ({
160: tools: new Map(),
161: namespaces: new Map(),
162: errors: [],
163: }),
164: editor: (editor) => ({
165: list: () => Array.from(editor.tools.values()),
166: get: (id) => editor.tools.get(id),
167: namespace: (namespace) => {
168: const error = namespaceError(namespace.name)
169: if (error) {
170: editor.errors.push({ kind: "namespace", name: namespace.name, namespace: namespace.name, error })
171: return
172: }
173: editor.namespaces.set(namespace.name, { ...namespace })
174: },
175: add: (tool) => {
176: const error = registrationError(tool)
177: if (error) {
178: editor.errors.push({ kind: ...
Found 1 matches /home/byk/Code/opencode-v2-pilot/packages/core/src/tool.ts: Line 118: const execution = yield* execute(tool, input, context).pipe(
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/tool.ts</path>
<type>file</type>
<content>
1: export * as Tool from "./tool.js"
2: export { CallID, Content, Error, FileContent, TextContent } from "@opencode/schema/tool"
3: export type { Context, Metadata, Namespace, Options, Result } from "@opencode/schema/tool"
4:
5: import { ToolDefinition, type ToolCall } from "@opencode/ai"
6: import { Tool } from "@opencode/schema/tool"
7: import { Context, Effect, Layer, Result, Schema, SchemaIssue, Types } from "effect"
8: import { makeLocationNode } from "@opencode/util/effect/app-node"
9: import type { Agent } from "./agent.js"
10: import { CodeModeCatalog } from "./codemode/catalog.js"
11: import { CodeModeTool } from "./codemode/tool.js"
12: import { Image } from "./image.js"
13: import { Permission } from "./permission.js"
14: import { PluginHooks } from "./plugin/hooks.js"
15: import { SessionMessage } from "./session/message.js"
16: import { SessionSchema } from ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/tool/runtime.ts</path>
<type>file</type>
<content>
1: import type { ToolDefinition } from "@opencode/ai"
2: import { Tool } from "@opencode/schema/tool"
3: import type { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec"
4: import { Cache, Effect, JsonSchema, Schema, SchemaIssue, SchemaRepresentation } from "effect"
5: import { $ZodType, toJSONSchema } from "zod/v4/core"
6:
7: const formatEffectIssues = SchemaIssue.makeFormatterStandardSchemaV1()
8:
9: const jsonSchemas = Effect.runSync(
10: Cache.make<JsonSchema.JsonSchema, Schema.Codec<unknown> | undefined>({
11: capacity: 100,
12: lookup: (schema) =>
13: Effect.try({
14: try: () => jsonSchema(schema),
15: catch: () => undefined,
16: }).pipe(Effect.orElseSucceed(() => undefined)),
17: }),
18: )
19:
20: export const definition = (tool: Tool.Info<any, any>): ToolDefinition => ({
21: type: "tool",
22: name: ...
A release-blocking trust gap emerged in the candidate unit and readiness design: the root unit executes the Node runtime and loads PTY code from paths owned by byk, while the runtime verifier hashes only the three Go binaries. The embedded source digest is compared only with marker text and is never recomputed, so changing the executable, plugin, transport, or Core permission bridge after marker creation never fails ExecCondition; I am verifying ownership and the exact manifest omissions before the verdict.
byk:byk 751 /home/byk byk:byk 775 /home/byk/Code byk:byk 755 /home/byk/Code/opencode-v2-pilot byk:byk 755 /home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node byk:byk 755 /home/byk/.local/share/opencode-v2-pilot byk:byk 755 /home/byk/.local/share/opencode-v2-pilot/config byk:byk 755 /home/byk/.local/share/opencode-v2-pilot/config/opencode byk:byk 755 /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins byk:byk 644 /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts byk:byk 644 /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts
Found 100 matches (more matches available)
/home/byk/Code/opencode-v2-pilot/packages/core/src/plugin/warming.ts:
Line 3: import { define } from "@opencode/plugin/effect/plugin"
Line 6: import { Config } from "../config.js"
Line 17: const config = yield* Config.Service
Line 18: const loadSettings = Effect.fn("WarmingPlugin.loadSettings")(function* () {
Line 19: const warming = Config.latest(yield* config.entries(), "warming")
Line 60: const settings = yield* loadSettings()
/home/byk/Code/opencode-v2-pilot/packages/core/src/plugin/vcs/hg.ts:
Line 6: import { define } from "@opencode/plugin/effect/plugin"
/home/byk/Code/opencode-v2-pilot/packages/core/src/plugin/vcs/git.ts:
Line 3: import { define } from "@opencode/plugin/effect/plugin"
Line 198: const configured = Effect.fnUntraced(function* (cwd: string, list: string[]) {
Line 199: const result = yield* run(["config", "init.defaultBranch"], { cwd })
Line 250: const next ...
byk:byk 755 regular file verify-readiness byk:byk 755 regular file review-source-hash byk:byk 644 regular file opencode-pty-supervisor.service byk:byk 644 regular file opencode-pty.slice byk:byk 755 regular file bin/opencode-pty-supervisor byk:byk 755 regular file bin/opencode-pty-launcher byk:byk 755 regular file bin/opencode-pty-client
opencode-pty-supervisor.service: Command /usr/local/libexec/opencode-pty-supervisor is not executable: No such file or directory opencode-v2.service: Command /usr/local/libexec/opencode-pty-verify-readiness is not executable: No such file or directory
systemd 255 (255.4-1ubuntu8.17) +PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified
Found 1 matches /home/byk/Code/opencode-v2-pilot/packages/core/src/permission.ts: Line 47: export type AssertInput = typeof AssertInput.Type
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/permission.ts</path>
<type>file</type>
<content>
20:
21: export const ID = Permission.ID
22: export type ID = typeof ID.Type
23:
24: export const Source = Permission.Source
25: export type Source = typeof Source.Type
26:
27: const RequestFields = {
28: sessionID: Permission.Request.fields.sessionID,
29: action: Permission.Request.fields.action,
30: resources: Permission.Request.fields.resources,
31: save: Permission.Request.fields.save,
32: metadata: Permission.Request.fields.metadata,
33: source: Permission.Request.fields.source,
34: }
35:
36: export const Request = Permission.Request
37: export type Request = typeof Request.Type
38:
39: export const Reply = Permission.Reply
40: export type Reply = typeof Reply.Type
41:
42: export const AssertInput = Schema.Struct({
43: id: ID.pipe(Schema.optional),
44: ...RequestFields,
45: agent: Agent.ID.pipe(Schema.optional),
46: }).annotate({ identifier: ...
[
{
"content": "Inventory exact review scope and verify immutable source/artifact hashes",
"status": "completed",
"priority": "high"
},
{
"content": "Inspect every source, config, unit, CUTOVER, and PTY test file with pinned APIs",
"status": "completed",
"priority": "high"
},
{
"content": "Run canonical unprivileged typecheck, tests, reproducibility, and artifact checks",
"status": "completed",
"priority": "high"
},
{
"content": "Trace each prior blocker and end-to-end correctness invariant to evidence",
"status": "in_progress",
"priority": "high"
},
{
"content": "Deliver classified independent verdict with root acceptance separated",
"status": "pending",
"priority": "high"
}
]
Found 7 matches
/home/byk/Code/opencode-v2-pilot/packages/core/src/config/normalize.ts:
Line 188: const nativePlugins = decodeList(input.plugins, ConfigPlugin.Plugin, ["plugins"], diagnostics, decodeEncoded)
Line 189: if (legacyPlugins.length || nativePlugins.length || Array.isArray(input.plugin) || Array.isArray(input.plugins))
Line 190: encoded.plugins = [...legacyPlugins, ...nativePlugins]
/home/byk/Code/opencode-v2-pilot/packages/core/src/config/plugin/source.ts:
Line 45: // Configured local plugins can live outside config roots, where the
Line 57: // The config change feed already covers {plugin,plugins} directories.
Line 137: (entry.info.plugins ?? []).map(parse).map((operation) => {
Line 152: yield* Effect.logWarning("configured plugin path must be a directory", { target: operation.target })
Found 20 matches
/home/byk/Code/opencode-v2-pilot/packages/util/src/global.ts:
Line 79: Effect.suspend(() => acquire({ config: process.env.OPENCODE_CONFIG_DIR ?? Path.config })),
/home/byk/Code/opencode-v2-pilot/packages/desktop/test/browser/server.ts:
Line 20: directory: process.env.OPENCODE_CONFIG_DIR!,
/home/byk/Code/opencode-v2-pilot/packages/desktop/test/browser-native.test.ts:
Line 26: OPENCODE_CONFIG_DIR: path.join(root, "config"),
/home/byk/Code/opencode-v2-pilot/packages/tui/test/mini/theme.test.ts:
Line 17: const previousConfig = process.env.OPENCODE_CONFIG_DIR
Line 19: process.env.OPENCODE_CONFIG_DIR = tmp.path
Line 22: if (previousConfig === undefined) delete process.env.OPENCODE_CONFIG_DIR
Line 23: else process.env.OPENCODE_CONFIG_DIR = previousConfig
/home/byk/Code/opencode-v2-pilot/packages/tui/test/mini/footer.test.ts:
Line 314: const previous = process.env.OPENCODE_CONFIG_DIR
Line 315: ...
<path>/home/byk/Code/opencode-v2-pilot/packages/core/src/config/plugin/source.ts</path>
<type>file</type>
<content>
1: export * as ConfigPluginSource from "./source.js"
2:
3: import { Directory, Document, type Entry } from "@opencode/schema/config"
4: import { ConfigPlugin } from "@opencode/schema/config/plugin"
5: import { FSUtil } from "@opencode/util/fs-util"
6: import { Host } from "@opencode/plugin/host"
7: import { makeLocationNode } from "@opencode/util/effect/app-node"
8: import { Context, Effect, Layer, Option, PubSub, Scope, Stream } from "effect"
9: import path from "path"
10: import { fileURLToPath, pathToFileURL } from "url"
11: import { Config } from "../../config.js"
12: import { Watcher } from "../../filesystem/watcher.js"
13: import { Location } from "../../location.js"
14: import { PluginSourceDirectory } from "../../plugin/source-directory.js"
15:
16: export type Operation =
17: | {
18: readonly type: "add"
19: readonly target: string
20: ...
M packages/core/src/plugin/host.ts M packages/core/test/plugin.test.ts M packages/core/test/plugin/fixture.ts M packages/core/test/plugin/host.ts M packages/plugin/src/effect/permission.ts M packages/plugin/src/promise/adapter.ts M packages/plugin/src/promise/permission.ts packages/core/src/plugin/host.ts packages/core/test/plugin.test.ts packages/core/test/plugin/fixture.ts packages/core/test/plugin/host.ts packages/plugin/src/effect/permission.ts packages/plugin/src/promise/adapter.ts packages/plugin/src/promise/permission.ts
[
{
"content": "Inventory exact review scope and verify immutable source/artifact hashes",
"status": "completed",
"priority": "high"
},
{
"content": "Inspect every source, config, unit, CUTOVER, and PTY test file with pinned APIs",
"status": "completed",
"priority": "high"
},
{
"content": "Run canonical unprivileged typecheck, tests, reproducibility, and artifact checks",
"status": "completed",
"priority": "high"
},
{
"content": "Trace each prior blocker and end-to-end correctness invariant to evidence",
"status": "completed",
"priority": "high"
},
{
"content": "Deliver classified independent verdict with root acceptance separated",
"status": "completed",
"priority": "high"
}
]
Findings
verify-readiness validates only the marker text and three Go binaries (supervisor/verify-readiness:23-34). It never hashes the Node SEA executable from opencode-v2.service:19, the dynamically loaded plugins from opencode-v2.service:10, or their dependencies. Those paths are owned and writable by byk. After marker creation, replacing the SEA executable, pty.ts, pty-transport.ts, or the Promise permission bridge would still pass ExecCondition. Install the complete runtime in root-owned immutable paths and bind every executable and loaded code artifact to the readiness check.review-source-hash:7-21 includes supervisor Go files, all packages/plugin/src TypeScript, and selected pilot files, but omits the modified Core permission bridge at packages/core/src/plugin/host.ts:384-408 and packages/core/src/tool/runtime.ts:28-44. The embedded revision names clean commit 2ac698d65aa4690a694307e9cbdf44537ea9a4fb, while the bridge and its tests remain uncommitted. The manifest therefore cannot prove the reviewed permission path matches the runtime build.Source Checks
fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f.bun x tsgo -p config/opencode/tsconfig.json --noEmit passed without exclusions.bun typecheck passed in packages/plugin and packages/core.go test -count=1 ./..., go test -race -count=1 ./..., and go vet ./... passed.packages/core/test/plugin.test.ts:465-547). ...* 🔴 (08:18) User requires running `bun typecheck` from package directories such as `packages/core`; never run `tsc` directly. * 🔴 (08:18) User requires runtime dependencies to flow from Schema to Core and Protocol, then from Core and Protocol to Server. Client runtime code may depend on Schema and Protocol but never Core or Server; `sdk` composes Client, Core, and Server. * 🔴 (08:18) User proh…
* 🟡 (08:18) Inspected `/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/supervisor/server_test.go` (787 lines). Its `sessionManager` mock tracks `startErr`, asynchronous `wait`, cleanup via `StopAndWait()`, a `stopped` channel guarded by `sync.Once`, and `ClientState()` query count in `identity`. * 🟡 (08:18) `TestReceiveStartWithDirectoryDescriptor` sends a `TypeStart` frame plus ex…
Date: Sep 8, 2026 * 🔴 (08:17) User directed that Bun should always use the canary build; persistent configuration is `BUN_CANARY=1` in the shell startup script. * 🔴 (08:17) User stated the fixed interactive shell never evaluates command arguments; the inner launcher directly invokes `execve` with the original argv vector, preserving all argument bytes and argv boundaries. * 🟡 (08:17) Inspected…
Date: Sep 8, 2026 * 🟡 (08:15) Inspected `/home/byk/.local/share/opencode-v2-pilot/supervisor/cmd/client/main.go` (107 lines), the fixed client helper that sends a `TypeStart` frame over inherited fd `3` and transfers the approved cwd on inherited fd `4`. * 🔴 (08:15) User stated the fixed client helper never initiates a socket connection, resolves a caller path, or opens an application-selected …
Date: Sep 8, 2026 * 🟡 (08:15) Inspected `/home/byk/.local/share/opencode-v2-pilot/supervisor/internal/protocol/frame.go` (225 lines), which defines Go-side `OPTY` frame parsing/writing plus `Start` payload encoding and decoding. * 🟡 (08:15) `frame.go` protocol constants are `HeaderSize = 12`, `MaxFrameSize = 70 * 1024`, `MaxIOPayloadSize = 32 * 1024`, `Version = 1`, and frame types `TypeStart =…
Date: Sep 8, 2026 * 🟡 (08:15) Inspected `/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts` (319 lines), which implements the Node-side Unix-socket supervisor transport, helper launch, protocol framing/parsing, buffered output delivery, input writes, STOP/exit handling, and helper/readiness checks. * 🟡 (08:15) `pty-transport.ts` protocol constants are `MAGIC = Bu…
Date: Sep 8, 2026 * 🔴 [requested-review] (08:13) User requested a final substantive independent READ-ONLY correctness review of the exact current source and artifacts under `/home/byk/.local/share/opencode-v2-pilot/supervisor`; plugin files `/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts` and `/home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport…