@neuralnomads/codenomad-dev 0.10.3-dev-20260213-ba418a85

package/dist/integrations/github/sanitize-webhook.js

@@ -0,0 +1,42 @@
+const KEEP_URL_KEYS = new Set(["html_url"]);
+function shouldDropKey(key) {
+    if (key === "installation")
+        return true;
+    if (key === "url")
+        return true;
+    if (key.endsWith("_url") && !KEEP_URL_KEYS.has(key))
+        return true;
+    return false;
+}
+function sanitizeValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => sanitizeValue(item));
+    }
+    if (!value || typeof value !== "object") {
+        return value;
+    }
+    const out = {};
+    for (const [key, raw] of Object.entries(value)) {
+        // Never modify body fields; this preserves user content.
+        if (key === "body") {
+            out[key] = raw;
+            continue;
+        }
+        if (shouldDropKey(key)) {
+            continue;
+        }
+        out[key] = sanitizeValue(raw);
+    }
+    return out;
+}
+export function sanitizeGitHubWebhookPayload(payload) {
+    // Deep clone first to drop prototypes/functions and ensure deterministic output.
+    let cloned;
+    try {
+        cloned = JSON.parse(JSON.stringify(payload));
+    }
+    catch {
+        cloned = payload;
+    }
+    return sanitizeValue(cloned);
+}

package/dist/integrations/github/webhook-verify.js

@@ -0,0 +1,21 @@
+import crypto from "crypto";
+export function verifyGitHubWebhookSignature(params) {
+    const secret = (params.secret ?? "").trim();
+    if (!secret)
+        return false;
+    const signature = (params.signatureHeader ?? "").trim();
+    if (!signature.startsWith("sha256="))
+        return false;
+    const expectedHex = crypto.createHmac("sha256", secret).update(params.body).digest("hex");
+    const expected = `sha256=${expectedHex}`;
+    try {
+        const a = Buffer.from(signature, "utf8");
+        const b = Buffer.from(expected, "utf8");
+        if (a.length !== b.length)
+            return false;
+        return crypto.timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/integrations/github/workspace-context.js

@@ -0,0 +1,10 @@
+const workspaceContext = new Map();
+export function setGitHubWorkspaceContext(workspaceId, context) {
+    workspaceContext.set(workspaceId, context);
+}
+export function getGitHubWorkspaceContext(workspaceId) {
+    return workspaceContext.get(workspaceId) ?? null;
+}
+export function clearGitHubWorkspaceContext(workspaceId) {
+    workspaceContext.delete(workspaceId);
+}

package/dist/integrations/github/worktree-context.js

@@ -0,0 +1,15 @@
+const worktreeContextByWorkspace = new Map();
+export function setGitHubWorktreeContext(workspaceId, worktreeSlug, context) {
+    let map = worktreeContextByWorkspace.get(workspaceId);
+    if (!map) {
+        map = new Map();
+        worktreeContextByWorkspace.set(workspaceId, map);
+    }
+    map.set(worktreeSlug, context);
+}
+export function getGitHubWorktreeContext(workspaceId, worktreeSlug) {
+    return worktreeContextByWorkspace.get(workspaceId)?.get(worktreeSlug) ?? null;
+}
+export function clearGitHubWorktreeContext(workspaceId) {
+    worktreeContextByWorkspace.delete(workspaceId);
+}

package/dist/launcher.js

@@ -0,0 +1,149 @@
+import { spawn } from "child_process";
+import os from "os";
+import path from "path";
+const APP_ARGS = (url) => [`--app=${url}`, "--new-window"];
+export async function launchInBrowser(url, logger) {
+    const { platform, candidates, manualExamples } = buildPlatformCandidates(url);
+    console.log(`Attempting to launch browser (${platform}) using:`);
+    candidates.forEach((candidate) => console.log(`  - ${candidate.name}: ${candidate.command}`));
+    for (const candidate of candidates) {
+        const success = await tryLaunch(candidate, url, logger);
+        if (success) {
+            return true;
+        }
+    }
+    console.error("No supported browser found to launch. Run without --launch and use one of the commands below or install a compatible browser.");
+    if (manualExamples.length > 0) {
+        console.error("Manual launch commands:");
+        manualExamples.forEach((line) => console.error(`  ${line}`));
+    }
+    return false;
+}
+async function tryLaunch(candidate, url, logger) {
+    return new Promise((resolve) => {
+        let resolved = false;
+        try {
+            const args = candidate.args(url);
+            const child = spawn(candidate.command, args, { stdio: "ignore", detached: true });
+            child.once("error", (error) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                logger.debug({ err: error, candidate: candidate.name, command: candidate.command, args }, "Browser launch failed");
+                resolve(false);
+            });
+            child.once("spawn", () => {
+                if (resolved)
+                    return;
+                resolved = true;
+                logger.info({
+                    browser: candidate.name,
+                    command: candidate.command,
+                    args,
+                    fullCommand: [candidate.command, ...args].join(" "),
+                }, "Launched browser in app mode");
+                child.unref();
+                resolve(true);
+            });
+        }
+        catch (error) {
+            if (resolved)
+                return;
+            resolved = true;
+            logger.debug({ err: error, candidate: candidate.name, command: candidate.command }, "Browser spawn threw");
+            resolve(false);
+        }
+    });
+}
+function buildPlatformCandidates(url) {
+    switch (os.platform()) {
+        case "darwin":
+            return {
+                platform: "macOS",
+                candidates: buildMacCandidates(),
+                manualExamples: buildMacManualExamples(url),
+            };
+        case "win32":
+            return {
+                platform: "Windows",
+                candidates: buildWindowsCandidates(),
+                manualExamples: buildWindowsManualExamples(url),
+            };
+        default:
+            return {
+                platform: "Linux",
+                candidates: buildLinuxCandidates(),
+                manualExamples: buildLinuxManualExamples(url),
+            };
+    }
+}
+function buildMacCandidates() {
+    const apps = [
+        { name: "Google Chrome", path: "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" },
+        { name: "Google Chrome Canary", path: "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary" },
+        { name: "Microsoft Edge", path: "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge" },
+        { name: "Brave Browser", path: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser" },
+        { name: "Chromium", path: "/Applications/Chromium.app/Contents/MacOS/Chromium" },
+        { name: "Vivaldi", path: "/Applications/Vivaldi.app/Contents/MacOS/Vivaldi" },
+        { name: "Arc", path: "/Applications/Arc.app/Contents/MacOS/Arc" },
+    ];
+    return apps.map((entry) => ({ name: entry.name, command: entry.path, args: APP_ARGS }));
+}
+function buildWindowsCandidates() {
+    const programFiles = process.env["ProgramFiles"];
+    const programFilesX86 = process.env["ProgramFiles(x86)"];
+    const localAppData = process.env["LocalAppData"];
+    const paths = [
+        [programFiles, "Google/Chrome/Application/chrome.exe", "Google Chrome"],
+        [programFilesX86, "Google/Chrome/Application/chrome.exe", "Google Chrome (x86)"],
+        [localAppData, "Google/Chrome/Application/chrome.exe", "Google Chrome (User)"],
+        [programFiles, "Microsoft/Edge/Application/msedge.exe", "Microsoft Edge"],
+        [programFilesX86, "Microsoft/Edge/Application/msedge.exe", "Microsoft Edge (x86)"],
+        [localAppData, "Microsoft/Edge/Application/msedge.exe", "Microsoft Edge (User)"],
+        [programFiles, "BraveSoftware/Brave-Browser/Application/brave.exe", "Brave"],
+        [localAppData, "BraveSoftware/Brave-Browser/Application/brave.exe", "Brave (User)"],
+        [programFiles, "Chromium/Application/chromium.exe", "Chromium"],
+    ];
+    return paths
+        .filter(([root]) => Boolean(root))
+        .map(([root, rel, name]) => ({
+        name,
+        command: path.join(root, rel),
+        args: APP_ARGS,
+    }));
+}
+function buildLinuxCandidates() {
+    const names = [
+        "google-chrome",
+        "google-chrome-stable",
+        "chromium",
+        "chromium-browser",
+        "brave-browser",
+        "microsoft-edge",
+        "microsoft-edge-stable",
+        "vivaldi",
+    ];
+    return names.map((name) => ({ name, command: name, args: APP_ARGS }));
+}
+function buildMacManualExamples(url) {
+    return [
+        `"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --app="${url}" --new-window`,
+        `"/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge" --app="${url}" --new-window`,
+        `"/Applications/Brave Browser.app/Contents/MacOS/Brave Browser" --app="${url}" --new-window`,
+    ];
+}
+function buildWindowsManualExamples(url) {
+    return [
+        `"%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe" --app="${url}" --new-window`,
+        `"%ProgramFiles%\\Microsoft\\Edge\\Application\\msedge.exe" --app="${url}" --new-window`,
+        `"%ProgramFiles%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe" --app="${url}" --new-window`,
+    ];
+}
+function buildLinuxManualExamples(url) {
+    return [
+        `google-chrome --app="${url}" --new-window`,
+        `chromium --app="${url}" --new-window`,
+        `brave-browser --app="${url}" --new-window`,
+        `microsoft-edge --app="${url}" --new-window`,
+    ];
+}

package/dist/loader.js

@@ -0,0 +1,21 @@
+export async function resolve(specifier, context, defaultResolve) {
+    try {
+        return await defaultResolve(specifier, context, defaultResolve);
+    }
+    catch (error) {
+        if (shouldRetry(specifier, error)) {
+            const retried = specifier.endsWith(".js") ? specifier : `${specifier}.js`;
+            return defaultResolve(retried, context, defaultResolve);
+        }
+        throw error;
+    }
+}
+function shouldRetry(specifier, error) {
+    if (!error || error.code !== "ERR_MODULE_NOT_FOUND") {
+        return false;
+    }
+    if (specifier.startsWith("./") || specifier.startsWith("../")) {
+        return true;
+    }
+    return false;
+}

package/dist/logger.js

@@ -0,0 +1,109 @@
+import { Transform } from "node:stream";
+import pino from "pino";
+const LEVEL_LABELS = {
+    10: "trace",
+    20: "debug",
+    30: "info",
+    40: "warn",
+    50: "error",
+    60: "fatal",
+};
+const LIFECYCLE_COMPONENTS = new Set(["app", "workspace"]);
+const OMITTED_FIELDS = new Set(["time", "msg", "level", "component", "module"]);
+export function createLogger(options = {}) {
+    const level = (options.level ?? process.env.CLI_LOG_LEVEL ?? "info").toLowerCase();
+    const destination = options.destination ?? process.env.CLI_LOG_DESTINATION ?? "stdout";
+    const baseComponent = options.component ?? "app";
+    const loggerOptions = {
+        level,
+        base: { component: baseComponent },
+        timestamp: false,
+    };
+    if (destination && destination !== "stdout") {
+        const stream = pino.destination({ dest: destination, mkdir: true, sync: false });
+        return pino(loggerOptions, stream);
+    }
+    const lifecycleStream = new LifecycleLogStream({ restrictInfoToLifecycle: level === "info" });
+    lifecycleStream.pipe(process.stdout);
+    return pino(loggerOptions, lifecycleStream);
+}
+class LifecycleLogStream extends Transform {
+    constructor(options) {
+        super();
+        this.options = options;
+        this.buffer = "";
+    }
+    _transform(chunk, _encoding, callback) {
+        this.buffer += chunk.toString();
+        let newlineIndex = this.buffer.indexOf("\n");
+        while (newlineIndex >= 0) {
+            const line = this.buffer.slice(0, newlineIndex);
+            this.buffer = this.buffer.slice(newlineIndex + 1);
+            this.pushFormatted(line);
+            newlineIndex = this.buffer.indexOf("\n");
+        }
+        callback();
+    }
+    _flush(callback) {
+        if (this.buffer.length > 0) {
+            this.pushFormatted(this.buffer);
+            this.buffer = "";
+        }
+        callback();
+    }
+    pushFormatted(line) {
+        if (!line.trim()) {
+            return;
+        }
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        const levelNumber = typeof entry.level === "number" ? entry.level : 30;
+        const levelLabel = LEVEL_LABELS[levelNumber] ?? "info";
+        const component = entry.component ?? entry.module ?? "app";
+        if (this.options.restrictInfoToLifecycle && levelNumber <= 30 && !LIFECYCLE_COMPONENTS.has(component)) {
+            return;
+        }
+        const message = typeof entry.msg === "string" ? entry.msg : "";
+        const metadata = this.formatMetadata(entry);
+        const formatted = metadata.length > 0 ? `[${levelLabel.toUpperCase()}] [${component}] ${message} ${metadata}` : `[${levelLabel.toUpperCase()}] [${component}] ${message}`;
+        this.push(`${formatted}\n`);
+    }
+    formatMetadata(entry) {
+        const pairs = [];
+        for (const [key, value] of Object.entries(entry)) {
+            if (OMITTED_FIELDS.has(key)) {
+                continue;
+            }
+            if (key === "err" && value && typeof value === "object") {
+                const err = value;
+                const errLabel = err.type ?? "Error";
+                const errMessage = err.message ? `: ${err.message}` : "";
+                pairs.push(`err=${errLabel}${errMessage}`);
+                if (err.stack) {
+                    pairs.push(`stack="${err.stack}"`);
+                }
+                continue;
+            }
+            pairs.push(`${key}=${this.stringifyValue(value)}`);
+        }
+        return pairs.join(" ").trim();
+    }
+    stringifyValue(value) {
+        if (value === undefined)
+            return "undefined";
+        if (value === null)
+            return "null";
+        if (typeof value === "string")
+            return value;
+        if (typeof value === "number" || typeof value === "boolean")
+            return String(value);
+        if (value instanceof Error)
+            return value.message ?? value.name;
+        return JSON.stringify(value);
+    }
+}

package/dist/opencode/request-context.js

@@ -0,0 +1,39 @@
+import { isValidWorktreeSlug } from "../workspaces/git-worktrees";
+import { resolveWorktreeDirectory } from "./worktree-directory";
+const INSTANCE_PROXY_HOST = "127.0.0.1";
+export async function buildOpencodeRequestContext(params) {
+    const workspace = params.workspaceManager.get(params.workspaceId);
+    if (!workspace) {
+        throw new Error("Workspace not found");
+    }
+    const port = params.workspaceManager.getInstancePort(params.workspaceId);
+    if (!port) {
+        throw new Error("Workspace instance is not ready");
+    }
+    if (!isValidWorktreeSlug(params.worktreeSlug)) {
+        throw new Error("Invalid worktree slug");
+    }
+    const directory = await resolveWorktreeDirectory({
+        workspaceId: params.workspaceId,
+        workspacePath: workspace.path,
+        worktreeSlug: params.worktreeSlug,
+        logger: params.logger,
+    });
+    if (!directory) {
+        throw new Error("Worktree not found");
+    }
+    const instanceAuthHeader = params.workspaceManager.getInstanceAuthorizationHeader(params.workspaceId);
+    const isNonASCII = /[^\x00-\x7F]/.test(directory);
+    const encodedDirectory = isNonASCII ? encodeURIComponent(directory) : directory;
+    const headers = {
+        "x-opencode-directory": encodedDirectory,
+    };
+    if (instanceAuthHeader) {
+        headers.authorization = instanceAuthHeader;
+    }
+    return {
+        baseUrl: `http://${INSTANCE_PROXY_HOST}:${port}`,
+        directory,
+        headers,
+    };
+}

package/dist/opencode/worktree-directory.js

@@ -0,0 +1,42 @@
+import { resolveRepoRoot, listWorktrees } from "../workspaces/git-worktrees";
+const WORKTREE_CACHE_TTL_MS = 2000;
+const worktreeCache = new Map();
+async function getCachedWorktrees(params) {
+    const cached = worktreeCache.get(params.workspaceId);
+    const now = Date.now();
+    if (cached && cached.expiresAt > now) {
+        return cached;
+    }
+    const { repoRoot } = await resolveRepoRoot(params.workspacePath, params.logger);
+    const worktrees = await listWorktrees({ repoRoot, workspaceFolder: params.workspacePath, logger: params.logger });
+    const entry = {
+        expiresAt: now + WORKTREE_CACHE_TTL_MS,
+        repoRoot,
+        worktrees: worktrees.map((wt) => ({ slug: wt.slug, directory: wt.directory })),
+    };
+    worktreeCache.set(params.workspaceId, entry);
+    return entry;
+}
+export async function resolveWorktreeDirectory(params) {
+    const { worktreeSlug } = params;
+    const cached = await getCachedWorktrees({
+        workspaceId: params.workspaceId,
+        workspacePath: params.workspacePath,
+        logger: params.logger,
+    });
+    const match = cached.worktrees.find((wt) => wt.slug === worktreeSlug);
+    if (match) {
+        return match.directory;
+    }
+    // If the slug is new (e.g., created moments ago), refresh once.
+    worktreeCache.delete(params.workspaceId);
+    const refreshed = await getCachedWorktrees({
+        workspaceId: params.workspaceId,
+        workspacePath: params.workspacePath,
+        logger: params.logger,
+    });
+    return refreshed.worktrees.find((wt) => wt.slug === worktreeSlug)?.directory ?? null;
+}
+export function clearWorktreeDirectoryCache(workspaceId) {
+    worktreeCache.delete(workspaceId);
+}

package/dist/opencode-config/README.md

@@ -0,0 +1,32 @@
+# opencode-config
+
+## TLDR
+Template config + plugins injected into every OpenCode instance that CodeNomad launches. It provides a CodeNomad bridge plugin for local event exchange between the CLI server and opencode.
+
+## What it is
+A packaged config directory that CodeNomad copies into `~/.config/codenomad/opencode-config` for production builds or uses directly in dev. OpenCode autoloads any `plugin/*.ts` or `plugin/*.js` from this directory.
+
+## How it works
+- CodeNomad sets `OPENCODE_CONFIG_DIR` when spawning each opencode instance (`packages/server/src/workspaces/manager.ts`).
+- This template is synced from `packages/opencode-config` (`packages/server/src/opencode-config.ts`, `packages/server/scripts/copy-opencode-config.mjs`).
+- OpenCode autoloads plugins from `plugin/` (`packages/opencode-config/plugin/codenomad.ts`).
+- The `CodeNomadPlugin` reads `CODENOMAD_INSTANCE_ID` + `CODENOMAD_BASE_URL`, connects to `GET /workspaces/:id/plugin/events`, and posts to `POST /workspaces/:id/plugin/event` (`packages/opencode-config/plugin/lib/client.ts`).
+- The server exposes the plugin routes and maps events into the UI SSE pipeline (`packages/server/src/server/routes/plugin.ts`, `packages/server/src/plugins/handlers.ts`).
+
+## Expectations
+- Local-only bridge (no auth/token yet).
+- Plugin must fail startup if it cannot connect after 3 retries.
+- Keep plugin entrypoints thin; put shared logic under `plugin/lib/` to avoid autoloaded helpers.
+- Keep event shapes small and explicit; use `type` + `properties` only.
+
+## Ideas
+- Add feature modules under `plugin/lib/features/` (tool lifecycle, permission prompts, custom commands).
+- Expand `/workspaces/:id/plugin/*` with dedicated endpoints as needed.
+- Promote stable event shapes and version tags once the protocol settles.
+
+## Pointers
+- Plugin entry: `packages/opencode-config/plugin/codenomad.ts`
+- Plugin client: `packages/opencode-config/plugin/lib/client.ts`
+- Plugin server routes: `packages/server/src/server/routes/plugin.ts`
+- Plugin event handling: `packages/server/src/plugins/handlers.ts`
+- Workspace env injection: `packages/server/src/workspaces/manager.ts`

package/dist/opencode-config/opencode.jsonc

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://opencode.ai/config.json"
+}

package/dist/opencode-config/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@codenomad/opencode-config",
+  "version": "0.5.0",
+  "private": true,
+  "license": "MIT",
+  "dependencies": {
+    "@opencode-ai/plugin": "1.1.53"
+  }
+}

package/dist/opencode-config/plugin/codenomad.ts

@@ -0,0 +1,32 @@
+import type { PluginInput } from "@opencode-ai/plugin"
+import { createCodeNomadClient, getCodeNomadConfig } from "./lib/client"
+import { createBackgroundProcessTools } from "./lib/background-process"
+
+export async function CodeNomadPlugin(input: PluginInput) {
+  const config = getCodeNomadConfig()
+  const client = createCodeNomadClient(config)
+  const backgroundProcessTools = createBackgroundProcessTools(config, { baseDir: input.directory })
+
+  await client.startEvents((event) => {
+    if (event.type === "codenomad.ping") {
+      void client.postEvent({
+        type: "codenomad.pong",
+        properties: {
+          ts: Date.now(),
+          pingTs: (event.properties as any)?.ts,
+        },
+      }).catch(() => {})
+    }
+  })
+
+  return {
+    tool: {
+      ...backgroundProcessTools,
+    },
+    async event(input: { event: any }) {
+      const opencodeEvent = input?.event
+      if (!opencodeEvent || typeof opencodeEvent !== "object") return
+
+    },
+  }
+}