@neuralnomads/codenomad-dev 0.11.1-dev-20260216-1a0734c6 → 0.11.2-dev-20260218-127a1f62

package/dist/opencode-config/package.json

@@ -4,6 +4,6 @@
   "private": true,
   "license": "MIT",
   "dependencies": {
-    "@opencode-ai/plugin": "1.2.4"
+    "@opencode-ai/plugin": "1.2.6"
   }
-}
+}

package/dist/server/http-server.js

@@ -282,6 +282,20 @@ function registerInstanceProxyRoutes(app, deps) {
     });
 }
 const INSTANCE_PROXY_HOST = "127.0.0.1";
+// Special-case OpenCode directory override.
+//
+// UI clients may need to scope certain requests to an arbitrary directory that is not
+// part of the Git worktree list. Since the OpenCode SDK does not reliably support
+// injecting per-request headers, we encode an override into the *path* and strip it
+// before proxying to the instance.
+//
+// Example proxied request path:
+//   /workspaces/:id/worktrees/:slug/instance/__dir/<base64url>/session/create
+//
+// The server will decode <base64url> -> absolute directory, validate it, then set
+// x-opencode-directory accordingly and forward the request to /session/create.
+const OPENCODE_DIR_OVERRIDE_PREFIX = "__dir/";
+const OPENCODE_DIR_OVERRIDE_MAX_LEN = 4096;
 async function proxyWorkspaceRequest(args) {
     const { request, reply, workspaceManager, logger, worktreeSlug } = args;
     const workspaceId = request.params.id;
@@ -357,17 +371,43 @@ async function proxyWorkspaceRequest(args) {
         reply.code(400).send({ error: "Invalid worktree slug" });
         return;
     }
-    const directory = await resolveWorktreeDirectory({
-        workspaceId,
-        workspacePath: workspace.path,
-        worktreeSlug,
-        logger,
-    });
-    if (!directory) {
-        reply.code(404).send({ error: "Worktree not found" });
+    let extracted;
+    try {
+        extracted = extractOpencodeDirectoryOverride(args.pathSuffix);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Invalid directory override";
+        reply.code(400).send({ error: message });
         return;
     }
-    const normalizedSuffix = normalizeInstanceSuffix(args.pathSuffix);
+    let directory = null;
+    let forwardedSuffix = extracted.forwardedSuffix;
+    if (extracted.overrideDirectory) {
+        try {
+            directory = validateAndNormalizeOverrideDirectory({
+                overrideDirectory: extracted.overrideDirectory,
+                workspaceRoot: workspace.path,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Invalid directory override";
+            reply.code(400).send({ error: message });
+            return;
+        }
+    }
+    else {
+        directory = await resolveWorktreeDirectory({
+            workspaceId,
+            workspacePath: workspace.path,
+            worktreeSlug,
+            logger,
+        });
+        if (!directory) {
+            reply.code(404).send({ error: "Worktree not found" });
+            return;
+        }
+    }
+    const normalizedSuffix = normalizeInstanceSuffix(forwardedSuffix);
     const queryIndex = (request.raw.url ?? "").indexOf("?");
     const search = queryIndex >= 0 ? (request.raw.url ?? "").slice(queryIndex) : "";
     const targetUrl = `http://${INSTANCE_PROXY_HOST}:${port}${normalizedSuffix}${search}`;
@@ -418,6 +458,76 @@ async function proxyWorkspaceRequest(args) {
         },
     });
 }
+function extractOpencodeDirectoryOverride(pathSuffix) {
+    if (!pathSuffix) {
+        return { overrideDirectory: null, forwardedSuffix: pathSuffix };
+    }
+    // Fastify wildcard param does not include a leading slash.
+    const trimmed = pathSuffix.replace(/^\/+/, "");
+    if (!trimmed.startsWith(OPENCODE_DIR_OVERRIDE_PREFIX)) {
+        return { overrideDirectory: null, forwardedSuffix: pathSuffix };
+    }
+    const rest = trimmed.slice(OPENCODE_DIR_OVERRIDE_PREFIX.length);
+    const slashIndex = rest.indexOf("/");
+    const encoded = (slashIndex >= 0 ? rest.slice(0, slashIndex) : rest).trim();
+    const remaining = slashIndex >= 0 ? rest.slice(slashIndex + 1) : "";
+    if (!encoded) {
+        throw new Error("Missing directory override");
+    }
+    if (encoded.length > OPENCODE_DIR_OVERRIDE_MAX_LEN) {
+        throw new Error("Directory override too large");
+    }
+    let overrideDirectory = "";
+    try {
+        overrideDirectory = decodeBase64Url(encoded);
+    }
+    catch {
+        throw new Error("Invalid directory override");
+    }
+    const forwardedSuffix = remaining;
+    return { overrideDirectory, forwardedSuffix };
+}
+function decodeBase64Url(input) {
+    // base64url -> base64
+    const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+    const padding = normalized.length % 4 === 0 ? "" : "=".repeat(4 - (normalized.length % 4));
+    const base64 = `${normalized}${padding}`;
+    return Buffer.from(base64, "base64").toString("utf-8");
+}
+function validateAndNormalizeOverrideDirectory(params) {
+    const raw = params.overrideDirectory.trim();
+    if (!raw) {
+        throw new Error("Override directory is empty");
+    }
+    if (!path.isAbsolute(raw)) {
+        throw new Error("Override directory must be an absolute path");
+    }
+    if (!fs.existsSync(raw)) {
+        throw new Error(`Override directory does not exist: ${raw}`);
+    }
+    const stats = fs.statSync(raw);
+    if (!stats.isDirectory()) {
+        throw new Error(`Override path is not a directory: ${raw}`);
+    }
+    const normalizedOverride = fs.realpathSync(raw);
+    const normalizedRoot = fs.realpathSync(params.workspaceRoot);
+    if (!isSubpath(normalizedOverride, normalizedRoot)) {
+        throw new Error("Override directory must be within the workspace root");
+    }
+    return normalizedOverride;
+}
+function isSubpath(candidate, root) {
+    const rel = path.relative(root, candidate);
+    if (rel === "")
+        return true;
+    if (rel === "..")
+        return false;
+    if (rel.startsWith(`..${path.sep}`))
+        return false;
+    if (path.isAbsolute(rel))
+        return false;
+    return true;
+}
 function normalizeInstanceSuffix(pathSuffix) {
     if (!pathSuffix || pathSuffix === "/") {
         return "/";

package/dist/server/routes/auth-pages/login.html

@@ -119,7 +119,8 @@
             showError(message || `Login failed (${res.status})`)
             return
           }
-          window.location.href = "/"
+          // Replace history entry so Back doesn't return to /login.
+          window.location.replace("/")
         } catch (e) {
           showError(e && e.message ? e.message : String(e))
         }

package/dist/server/routes/auth.js

@@ -35,7 +35,17 @@ function getTokenHtml() {
     return cachedTokenTemplate;
 }
 export function registerAuthRoutes(app, deps) {
-    app.get("/login", async (_request, reply) => {
+    app.get("/login", async (request, reply) => {
+        // If already authenticated, don't show the login page.
+        const session = deps.authManager.getSessionFromRequest(request);
+        if (session) {
+            reply.redirect("/");
+            return;
+        }
+        // Avoid caching the login page (helps with bfcache/back behavior).
+        reply.header("Cache-Control", "no-store");
+        reply.header("Pragma", "no-cache");
+        reply.header("Expires", "0");
         const status = deps.authManager.getStatus();
         reply.type("text/html").send(getLoginHtml(status.username));
     });
@@ -48,6 +58,10 @@ export function registerAuthRoutes(app, deps) {
             reply.code(404).send({ error: "Not found" });
             return;
         }
+        // Avoid caching the token bootstrap page.
+        reply.header("Cache-Control", "no-store");
+        reply.header("Pragma", "no-cache");
+        reply.header("Expires", "0");
         reply.type("text/html").send(getTokenHtml());
     });
     app.get("/api/auth/status", async (request, reply) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neuralnomads/codenomad-dev",
-  "version": "0.11.1-dev-20260216-1a0734c6",
+  "version": "0.11.2-dev-20260218-127a1f62",
   "description": "CodeNomad Server",
   "license": "MIT",
   "author": {