@neuralnomads/codenomad-dev 0.20.0-dev-20260911-ea37f97b → 0.20.0-dev-20260917-aa51cbb9

package/dist/opencode/compatibility/proxy.test.js

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { Readable } from "node:stream";
+import { setImmediate } from "node:timers/promises";
+import Fastify from "fastify";
+import { OpenCodeSharedService } from "../../workspaces/opencode-service";
+import { forwardRuntimeRequest } from "./proxy";
+test("retiring the actual connection preserves complete and streamed native 401 envelopes", async () => {
+    for (const delayed of [false, true]) {
+        const upstream = Fastify();
+        const envelope = { _tag: "UnauthorizedError", message: "fixture" };
+        upstream.get("/api/denied", async (_request, reply) => {
+            reply.code(401);
+            if (!delayed)
+                return envelope;
+            return reply.type("application/json").send(Readable.from((async function* () {
+                yield '{"_tag":"UnauthorizedError",';
+                await setImmediate();
+                yield '"message":"fixture"}';
+            })()));
+        });
+        await upstream.listen({ host: "127.0.0.1", port: 0 });
+        const endpoint = { url: `http://127.0.0.1:${upstream.server.address().port}` };
+        const service = new OpenCodeSharedService();
+        await service.client({ kind: "lifecycle", identity: "fixture", lifecycle: { discover: async () => endpoint, ensure: async () => endpoint } });
+        const connection = await service.acquire();
+        const app = Fastify();
+        let releases = 0;
+        app.get("/fixture", (request, reply) => forwardRuntimeRequest({
+            request, reply, url: `${endpoint.url}/api/denied`, body: undefined, headers: {},
+            fetch: connection.fetch, invalidate: connection.invalidate, release: () => { releases++; },
+        }));
+        try {
+            const response = await app.inject("/fixture");
+            assert.equal(response.statusCode, 401);
+            assert.deepEqual(response.json(), envelope);
+            assert.equal(releases, 1);
+            assert.throws(connection.assertCurrent, /connection changed/);
+        }
+        finally {
+            await service.shutdown();
+            await app.close();
+            await upstream.close();
+        }
+    }
+});
+//# sourceMappingURL=proxy.test.js.map

package/dist/opencode/compatibility/proxy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.test.js","sourceRoot":"","sources":["../../../src/opencode/compatibility/proxy.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAE/C,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,KAAK,MAAM,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAA;QAC1B,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QAClE,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACf,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAA;YAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;gBACvE,MAAM,8BAA8B,CAAA;gBACpC,MAAM,YAAY,EAAE,CAAA;gBACpB,MAAM,sBAAsB,CAAA;YAC9B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACR,CAAC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACrD,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,oBAAqB,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,EAAE,CAAA;QACpG,MAAM,OAAO,GAAG,IAAI,qBAAqB,EAAE,CAAA;QAC3C,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC7I,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;QACrB,IAAI,QAAQ,GAAG,CAAC,CAAA;QAChB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC;YAC5D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;YAC/E,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA,CAAC,CAAC;SAC1F,CAAC,CAAC,CAAA;QACH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAC7C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;YACtC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAA;YAC3C,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YACzB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;QAC/D,CAAC;gBAAS,CAAC;YAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACnF,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import assert from \"node:assert/strict\"\nimport { test } from \"node:test\"\nimport { Readable } from \"node:stream\"\nimport { setImmediate } from \"node:timers/promises\"\nimport Fastify from \"fastify\"\nimport { OpenCodeSharedService } from \"../../workspaces/opencode-service\"\nimport { forwardRuntimeRequest } from \"./proxy\"\n\ntest(\"retiring the actual connection preserves complete and streamed native 401 envelopes\", async () => {\n  for (const delayed of [false, true]) {\n    const upstream = Fastify()\n    const envelope = { _tag: \"UnauthorizedError\", message: \"fixture\" }\n    upstream.get(\"/api/denied\", async (_request, reply) => {\n      reply.code(401)\n      if (!delayed) return envelope\n      return reply.type(\"application/json\").send(Readable.from((async function* () {\n        yield '{\"_tag\":\"UnauthorizedError\",'\n        await setImmediate()\n        yield '\"message\":\"fixture\"}'\n      })()))\n    })\n    await upstream.listen({ host: \"127.0.0.1\", port: 0 })\n    const endpoint = { url: `http://127.0.0.1:${(upstream.server.address() as { port: number }).port}` }\n    const service = new OpenCodeSharedService()\n    await service.client({ kind: \"lifecycle\", identity: \"fixture\", lifecycle: { discover: async () => endpoint, ensure: async () => endpoint } })\n    const connection = await service.acquire()\n    const app = Fastify()\n    let releases = 0\n    app.get(\"/fixture\", (request, reply) => forwardRuntimeRequest({\n      request, reply, url: `${endpoint.url}/api/denied`, body: undefined, headers: {},\n      fetch: connection.fetch, invalidate: connection.invalidate, release: () => { releases++ },\n    }))\n    try {\n      const response = await app.inject(\"/fixture\")\n      assert.equal(response.statusCode, 401)\n      assert.deepEqual(response.json(), envelope)\n      assert.equal(releases, 1)\n      assert.throws(connection.assertCurrent, /connection changed/)\n    } finally { await service.shutdown(); await app.close(); await upstream.close() }\n  }\n})\n"]}

package/dist/opencode/compatibility/requests.js

@@ -0,0 +1,54 @@
+// Only translate consumed, reviewed operations. The external proxy allowlist is
+// checked before reaching this module; translation never expands that allowlist.
+export function legacyRequest(url, method, body) {
+    const original = url.pathname;
+    if (original === "/api/status" && method === "GET")
+        url.pathname = "/api/health";
+    if (/^\/api\/experimental\/session\/(?:stats|import|[^/]+\/(?:export|wait|instructions\/entries(?:\/[^/]+)?))$/.test(original)
+        || /^\/api\/experimental\/mcp\/[^/]+\/(?:connect|disconnect)$/.test(original)) {
+        url.pathname = original.replace("/experimental", "");
+    }
+    if (original === "/api/form" && method === "GET")
+        url.pathname = "/api/form/request";
+    if (/^\/api\/session\/[^/]+$/.test(original) && method === "PATCH") {
+        if (!body || typeof body.title !== "string" || Object.keys(body).some(key => key !== "title")) {
+            throw new Error("Earlier OpenCode V2 supports title-only session updates");
+        }
+        url.pathname += "/rename";
+        method = "POST";
+    }
+    if (/^\/api\/session\/[^/]+\/fork$/.test(original) && method === "POST") {
+        if (body?.before !== undefined && typeof body.before !== "string")
+            throw new Error("Invalid fork boundary");
+        body = { boundary: body?.before === undefined ? { type: "through" } : { type: "before", messageID: body.before } };
+    }
+    if (/^\/api\/session\/[^/]+\/command$/.test(original) && method === "POST" && body) {
+        const { name, ...rest } = body;
+        body = { ...rest, command: name };
+    }
+    if (/^\/api\/session\/[^/]+\/permission\/[^/]+\/reply$/.test(original) && method === "POST" && body) {
+        const { decision, ...rest } = body;
+        body = { ...rest, reply: decision };
+    }
+    if (/^\/api\/session\/[^/]+\/interrupt$/.test(original) && method === "POST" && url.searchParams.has("resume")) {
+        url.searchParams.set("continue", url.searchParams.get("resume"));
+        url.searchParams.delete("resume");
+    }
+    if (/^\/api\/session\/[^/]+\/inbox\/[^/]+$/.test(original) && method === "PATCH") {
+        if (body?.delivery !== "steer" && body?.delivery !== "queue")
+            throw new Error("Invalid inbox delivery");
+        url.pathname += `/${body.delivery}`;
+        method = "POST";
+        body = undefined;
+    }
+    if (/^\/api\/session\/[^/]+\/revert$/.test(original) && method === "DELETE") {
+        url.pathname += "/clear";
+        method = "POST";
+    }
+    if (/^\/api\/session\/[^/]+\/form\/[^/]+$/.test(original) && method === "DELETE") {
+        url.pathname += "/cancel";
+        method = "POST";
+    }
+    return { url, method, body };
+}
+//# sourceMappingURL=requests.js.map

package/dist/opencode/compatibility/requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requests.js","sourceRoot":"","sources":["../../../src/opencode/compatibility/requests.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,GAAQ,EAAE,MAAc,EAAE,IAAyC;IAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IAC7B,IAAI,QAAQ,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK;QAAE,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAA;IAChF,IAAI,2GAA2G,CAAC,IAAI,CAAC,QAAQ,CAAC;WACzH,2DAA2D,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,IAAI,MAAM,KAAK,KAAK;QAAE,GAAG,CAAC,QAAQ,GAAG,mBAAmB,CAAA;IACpF,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC5E,CAAC;QACD,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAA;QACzB,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,IAAI,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACxE,IAAI,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC3G,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAA;IACpH,CAAC;IACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;QACnF,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAC9B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IACD,IAAI,mDAAmD,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;QACpG,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAClC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IACrC,CAAC;IACD,IAAI,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/G,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAA;QACjE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACjF,IAAI,IAAI,EAAE,QAAQ,KAAK,OAAO,IAAI,IAAI,EAAE,QAAQ,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QACvG,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;QACnC,MAAM,GAAG,MAAM,CAAA;QACf,IAAI,GAAG,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAA;QACxB,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjF,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAA;QACzB,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AAC9B,CAAC","sourcesContent":["// Only translate consumed, reviewed operations. The external proxy allowlist is\n// checked before reaching this module; translation never expands that allowlist.\nexport function legacyRequest(url: URL, method: string, body: Record<string, unknown> | undefined) {\n  const original = url.pathname\n  if (original === \"/api/status\" && method === \"GET\") url.pathname = \"/api/health\"\n  if (/^\\/api\\/experimental\\/session\\/(?:stats|import|[^/]+\\/(?:export|wait|instructions\\/entries(?:\\/[^/]+)?))$/.test(original)\n    || /^\\/api\\/experimental\\/mcp\\/[^/]+\\/(?:connect|disconnect)$/.test(original)) {\n    url.pathname = original.replace(\"/experimental\", \"\")\n  }\n  if (original === \"/api/form\" && method === \"GET\") url.pathname = \"/api/form/request\"\n  if (/^\\/api\\/session\\/[^/]+$/.test(original) && method === \"PATCH\") {\n    if (!body || typeof body.title !== \"string\" || Object.keys(body).some(key => key !== \"title\")) {\n      throw new Error(\"Earlier OpenCode V2 supports title-only session updates\")\n    }\n    url.pathname += \"/rename\"\n    method = \"POST\"\n  }\n  if (/^\\/api\\/session\\/[^/]+\\/fork$/.test(original) && method === \"POST\") {\n    if (body?.before !== undefined && typeof body.before !== \"string\") throw new Error(\"Invalid fork boundary\")\n    body = { boundary: body?.before === undefined ? { type: \"through\" } : { type: \"before\", messageID: body.before } }\n  }\n  if (/^\\/api\\/session\\/[^/]+\\/command$/.test(original) && method === \"POST\" && body) {\n    const { name, ...rest } = body\n    body = { ...rest, command: name }\n  }\n  if (/^\\/api\\/session\\/[^/]+\\/permission\\/[^/]+\\/reply$/.test(original) && method === \"POST\" && body) {\n    const { decision, ...rest } = body\n    body = { ...rest, reply: decision }\n  }\n  if (/^\\/api\\/session\\/[^/]+\\/interrupt$/.test(original) && method === \"POST\" && url.searchParams.has(\"resume\")) {\n    url.searchParams.set(\"continue\", url.searchParams.get(\"resume\")!)\n    url.searchParams.delete(\"resume\")\n  }\n  if (/^\\/api\\/session\\/[^/]+\\/inbox\\/[^/]+$/.test(original) && method === \"PATCH\") {\n    if (body?.delivery !== \"steer\" && body?.delivery !== \"queue\") throw new Error(\"Invalid inbox delivery\")\n    url.pathname += `/${body.delivery}`\n    method = \"POST\"\n    body = undefined\n  }\n  if (/^\\/api\\/session\\/[^/]+\\/revert$/.test(original) && method === \"DELETE\") {\n    url.pathname += \"/clear\"\n    method = \"POST\"\n  }\n  if (/^\\/api\\/session\\/[^/]+\\/form\\/[^/]+$/.test(original) && method === \"DELETE\") {\n    url.pathname += \"/cancel\"\n    method = \"POST\"\n  }\n  return { url, method, body }\n}\n"]}

package/dist/opencode/compatibility/runtime.js

@@ -0,0 +1,26 @@
+// Keep authenticated daemon metadata out of public endpoints and credentials.
+const RUNTIME_IDENTITY = Symbol.for("codenomad.opencode.runtime");
+export function rememberRuntime(endpoint, identity) {
+    Object.defineProperty(endpoint, RUNTIME_IDENTITY, { value: Object.freeze({ ...identity, contract: {} }) });
+}
+export function runtimeIdentity(endpoint) {
+    return endpoint[RUNTIME_IDENTITY];
+}
+export function contractProfile(identity) {
+    // Custom embedded/test lifecycles that don't negotiate use the pinned contract.
+    if (!identity)
+        return "modern";
+    if (identity.contract?.profile)
+        return identity.contract.profile;
+    if (/^2\.0\.[0-3]$/.test(identity.version))
+        return "legacy";
+    if (/^2\.0\.[45]$/.test(identity.version))
+        return "modern";
+    const beta = /^0\.0\.0-beta-(\d+)$/.exec(identity.version)?.[1];
+    const audited = new Set([18866, 18955, 18965, 18985, 18992, 18999, 19059, 19086,
+        19124, 19129, 19133, 19135, 19151, 19157, 19187, 19192, 19215, 19213,
+        19228, 19234, 19242, 19266, 19271, 19275, 19278, 19283, 19288, 19289,
+        19296, 19365, 19378, 19381, 19398, 19419, 19422, 19425, 19500, 19507]);
+    return beta && audited.has(Number(beta)) ? "legacy" : "unknown";
+}
+//# sourceMappingURL=runtime.js.map

package/dist/opencode/compatibility/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/opencode/compatibility/runtime.ts"],"names":[],"mappings":"AAUA,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;AACjE,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAyB;IAC3E,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;AAC5G,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,OAAQ,QAAgE,CAAC,gBAAgB,CAAC,CAAA;AAC5F,CAAC;AAGD,MAAM,UAAU,eAAe,CAAC,QAAqC;IACnE,gFAAgF;IAChF,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC9B,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAA;IAChE,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3D,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC1D,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;QAC7E,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;QACpE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;QACpE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IACxE,OAAO,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACjE,CAAC","sourcesContent":["import type { Endpoint } from \"@opencode/client/service\"\n\nexport interface RuntimeIdentity {\n  version: string\n  pid: number\n  discovery: \"status\" | \"health\"\n  /** Filled only by a successful, authenticated schema negotiation. */\n  contract?: { profile?: Exclude<ContractProfile, \"unknown\"> }\n}\n\n// Keep authenticated daemon metadata out of public endpoints and credentials.\nconst RUNTIME_IDENTITY = Symbol.for(\"codenomad.opencode.runtime\")\nexport function rememberRuntime(endpoint: Endpoint, identity: RuntimeIdentity): void {\n  Object.defineProperty(endpoint, RUNTIME_IDENTITY, { value: Object.freeze({ ...identity, contract: {} }) })\n}\nexport function runtimeIdentity(endpoint: Endpoint): RuntimeIdentity | undefined {\n  return (endpoint as Endpoint & { [RUNTIME_IDENTITY]?: RuntimeIdentity })[RUNTIME_IDENTITY]\n}\n\nexport type ContractProfile = \"modern\" | \"legacy\" | \"unknown\"\nexport function contractProfile(identity: RuntimeIdentity | undefined): ContractProfile {\n  // Custom embedded/test lifecycles that don't negotiate use the pinned contract.\n  if (!identity) return \"modern\"\n  if (identity.contract?.profile) return identity.contract.profile\n  if (/^2\\.0\\.[0-3]$/.test(identity.version)) return \"legacy\"\n  if (/^2\\.0\\.[45]$/.test(identity.version)) return \"modern\"\n  const beta = /^0\\.0\\.0-beta-(\\d+)$/.exec(identity.version)?.[1]\n  const audited = new Set([18866, 18955, 18965, 18985, 18992, 18999, 19059, 19086,\n    19124, 19129, 19133, 19135, 19151, 19157, 19187, 19192, 19215, 19213,\n    19228, 19234, 19242, 19266, 19271, 19275, 19278, 19283, 19288, 19289,\n    19296, 19365, 19378, 19381, 19398, 19419, 19422, 19425, 19500, 19507])\n  return beta && audited.has(Number(beta)) ? \"legacy\" : \"unknown\"\n}\n"]}

package/dist/opencode/compatibility/transport.js

@@ -0,0 +1,112 @@
+import { Service } from "@opencode/client/service";
+import { contractProfile, runtimeIdentity } from "./runtime";
+import { legacyRequest } from "./requests";
+import { negotiateRuntime } from "./negotiate";
+import { applyLocationContext, LOCATION_CONTEXT_HEADER } from "./location";
+function object(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeInbox(value) {
+    if (!object(value))
+        throw new Error("Invalid native inbox item");
+    if (object(value.time) && typeof value.time.created === "number")
+        return value;
+    if (typeof value.timeCreated !== "number" || !Number.isFinite(value.timeCreated)) {
+        throw new Error("Invalid native inbox creation time");
+    }
+    const { timeCreated, ...rest } = value;
+    return { ...rest, time: { created: timeCreated } };
+}
+// Both the server's generated client and the authorized browser proxy use this
+// transport. No error classification here retries a mutation.
+export function createRuntimeFetch(endpoint, fetcher = globalThis.fetch) {
+    return createRuntimeTransport(endpoint, fetcher).fetch;
+}
+export function createRuntimeTransport(endpoint, fetcher = globalThis.fetch, lifetime = new AbortController().signal) {
+    const identity = runtimeIdentity(endpoint);
+    let profile = contractProfile(identity);
+    let negotiation;
+    const resolveProfile = async (signal) => {
+        signal?.throwIfAborted();
+        lifetime.throwIfAborted();
+        if (profile !== "unknown")
+            return profile;
+        negotiation ??= negotiateRuntime(endpoint, fetcher, lifetime).then(value => {
+            profile = value;
+            return value;
+        }).catch(error => { negotiation = undefined; throw error; });
+        return awaitLocal(negotiation, signal);
+    };
+    const adaptedFetch = async (input, init) => {
+        const request = new Request(input, init);
+        const url = new URL(request.url);
+        if (url.origin !== new URL(endpoint.url).origin)
+            throw new Error("OpenCode transport origin mismatch");
+        const profile = await resolveProfile(request.signal);
+        const headers = new Headers(request.headers);
+        for (const [name, value] of Object.entries(Service.headers(endpoint) ?? {}))
+            headers.set(name, value);
+        // Credentialed native requests must never follow a redirect to another host.
+        const options = { method: request.method, headers, signal: AbortSignal.any([request.signal, lifetime]), redirect: "error" };
+        const originalPath = url.pathname;
+        if (profile === "legacy" || headers.has(LOCATION_CONTEXT_HEADER)) {
+            const text = request.body ? await request.text() : undefined;
+            let body = text ? JSON.parse(text) : undefined;
+            body = applyLocationContext(url, request.method, body, headers, profile);
+            if (body !== undefined && !object(body))
+                throw new Error("Invalid OpenCode request body");
+            const translated = profile === "legacy" ? legacyRequest(url, request.method, body) : { method: request.method, body };
+            options.method = translated.method;
+            options.body = translated.body === undefined ? undefined : JSON.stringify(translated.body);
+            headers.delete("content-length");
+            if (options.body === undefined)
+                headers.delete("content-type");
+        }
+        else if (request.body) {
+            options.body = await request.arrayBuffer();
+        }
+        const response = await fetcher(url, options);
+        if (!response.ok && !response.headers.get("content-type")?.includes("application/json")) {
+            await response.body?.cancel();
+            return Response.json({
+                _tag: "OpenCodeContractError", message: `OpenCode ${identity?.version ?? profile}: ${request.method} ${originalPath} returned HTTP ${response.status}`,
+                status: response.status, profile, method: request.method, path: originalPath,
+            }, { status: response.status });
+        }
+        if (profile === "legacy" && response.ok && originalPath === "/api/status") {
+            const health = await response.json();
+            return Response.json({ version: health.version, pid: health.pid, urls: [endpoint.url] });
+        }
+        if (profile !== "legacy" || !response.ok || !/^\/api\/session\/[^/]+\/(?:inbox|prompt|synthetic|compact)$/.test(originalPath)
+            || response.status === 204)
+            return response;
+        const value = await response.json();
+        if (!object(value))
+            throw new Error("Invalid native inbox response");
+        const normalized = { ...value, data: Array.isArray(value.data) ? value.data.map(normalizeInbox) : normalizeInbox(value.data) };
+        const responseHeaders = new Headers(response.headers);
+        responseHeaders.delete("content-length");
+        responseHeaders.delete("content-encoding");
+        return new Response(JSON.stringify(normalized), { status: response.status, headers: responseHeaders });
+    };
+    return { fetch: adaptedFetch, profile: resolveProfile };
+}
+// A cancelled subscriber must not cancel the connection's negotiation or wait
+// for another subscriber's request to finish before observing its own abort.
+function awaitLocal(pending, signal) {
+    if (!signal)
+        return pending;
+    return new Promise((resolve, reject) => {
+        const abort = () => { signal.removeEventListener("abort", abort); reject(signal.reason); };
+        if (signal.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        signal.addEventListener("abort", abort, { once: true });
+        pending.then(value => { signal.removeEventListener("abort", abort); resolve(value); }, error => {
+            signal.removeEventListener("abort", abort);
+            reject(error);
+        });
+    });
+}
+//# sourceMappingURL=transport.js.map

package/dist/opencode/compatibility/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../../src/opencode/compatibility/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAE1E,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAChE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC9E,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IACtC,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAA;AACpD,CAAC;AAED,+EAA+E;AAC/E,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,UAAwB,UAAU,CAAC,KAAK;IAC7F,OAAO,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAkB,EAAE,UAAwB,UAAU,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM;IAC1I,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACvC,IAAI,WAAqD,CAAA;IACzD,MAAM,cAAc,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;QACpD,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,QAAQ,CAAC,cAAc,EAAE,CAAA;QACzB,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAA;QACzC,WAAW,KAAK,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACzE,OAAO,GAAG,KAAK,CAAA;YACf,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3D,OAAO,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC,CAAA;IACD,MAAM,YAAY,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACtG,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACrG,6EAA6E;QAC7E,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QACxI,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAA;QACjC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5D,IAAI,IAAI,GAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACvD,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACxE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;YACzF,MAAM,UAAU,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;YACrH,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAClC,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1F,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;YAChC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAChE,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAA;QAC5C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;YAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,YAAY,QAAQ,EAAE,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC,MAAM,IAAI,YAAY,kBAAkB,QAAQ,CAAC,MAAM,EAAE;gBACtJ,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY;aAC7E,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsC,CAAA;YACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,6DAA6D,CAAC,IAAI,CAAC,YAAY,CAAC;eACxH,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAA;QAC7C,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACpE,MAAM,UAAU,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;QAC9H,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACrD,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACxC,eAAe,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC1C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;IACxG,CAAC,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;AACzD,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,SAAS,UAAU,CAAI,OAAmB,EAAE,MAAoB;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAA;QACzF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QACrD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE;YAC5F,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { Service, type Endpoint } from \"@opencode/client/service\"\nimport { contractProfile, runtimeIdentity } from \"./runtime\"\nimport { legacyRequest } from \"./requests\"\nimport { negotiateRuntime } from \"./negotiate\"\nimport { applyLocationContext, LOCATION_CONTEXT_HEADER } from \"./location\"\n\nfunction object(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value)\n}\n\nfunction normalizeInbox(value: unknown): unknown {\n  if (!object(value)) throw new Error(\"Invalid native inbox item\")\n  if (object(value.time) && typeof value.time.created === \"number\") return value\n  if (typeof value.timeCreated !== \"number\" || !Number.isFinite(value.timeCreated)) {\n    throw new Error(\"Invalid native inbox creation time\")\n  }\n  const { timeCreated, ...rest } = value\n  return { ...rest, time: { created: timeCreated } }\n}\n\n// Both the server's generated client and the authorized browser proxy use this\n// transport. No error classification here retries a mutation.\nexport function createRuntimeFetch(endpoint: Endpoint, fetcher: typeof fetch = globalThis.fetch): typeof fetch {\n  return createRuntimeTransport(endpoint, fetcher).fetch\n}\n\nexport function createRuntimeTransport(endpoint: Endpoint, fetcher: typeof fetch = globalThis.fetch, lifetime = new AbortController().signal) {\n  const identity = runtimeIdentity(endpoint)\n  let profile = contractProfile(identity)\n  let negotiation: Promise<\"modern\" | \"legacy\"> | undefined\n  const resolveProfile = async (signal?: AbortSignal) => {\n    signal?.throwIfAborted()\n    lifetime.throwIfAborted()\n    if (profile !== \"unknown\") return profile\n    negotiation ??= negotiateRuntime(endpoint, fetcher, lifetime).then(value => {\n      profile = value\n      return value\n    }).catch(error => { negotiation = undefined; throw error })\n    return awaitLocal(negotiation, signal)\n  }\n  const adaptedFetch: typeof fetch = async (input, init) => {\n    const request = new Request(input, init)\n    const url = new URL(request.url)\n    if (url.origin !== new URL(endpoint.url).origin) throw new Error(\"OpenCode transport origin mismatch\")\n    const profile = await resolveProfile(request.signal)\n    const headers = new Headers(request.headers)\n    for (const [name, value] of Object.entries(Service.headers(endpoint) ?? {})) headers.set(name, value)\n    // Credentialed native requests must never follow a redirect to another host.\n    const options: RequestInit = { method: request.method, headers, signal: AbortSignal.any([request.signal, lifetime]), redirect: \"error\" }\n    const originalPath = url.pathname\n    if (profile === \"legacy\" || headers.has(LOCATION_CONTEXT_HEADER)) {\n      const text = request.body ? await request.text() : undefined\n      let body: unknown = text ? JSON.parse(text) : undefined\n      body = applyLocationContext(url, request.method, body, headers, profile)\n      if (body !== undefined && !object(body)) throw new Error(\"Invalid OpenCode request body\")\n      const translated = profile === \"legacy\" ? legacyRequest(url, request.method, body) : { method: request.method, body }\n      options.method = translated.method\n      options.body = translated.body === undefined ? undefined : JSON.stringify(translated.body)\n      headers.delete(\"content-length\")\n      if (options.body === undefined) headers.delete(\"content-type\")\n    } else if (request.body) {\n      options.body = await request.arrayBuffer()\n    }\n    const response = await fetcher(url, options)\n    if (!response.ok && !response.headers.get(\"content-type\")?.includes(\"application/json\")) {\n      await response.body?.cancel()\n      return Response.json({\n        _tag: \"OpenCodeContractError\", message: `OpenCode ${identity?.version ?? profile}: ${request.method} ${originalPath} returned HTTP ${response.status}`,\n        status: response.status, profile, method: request.method, path: originalPath,\n      }, { status: response.status })\n    }\n    if (profile === \"legacy\" && response.ok && originalPath === \"/api/status\") {\n      const health = await response.json() as { version: string; pid: number }\n      return Response.json({ version: health.version, pid: health.pid, urls: [endpoint.url] })\n    }\n    if (profile !== \"legacy\" || !response.ok || !/^\\/api\\/session\\/[^/]+\\/(?:inbox|prompt|synthetic|compact)$/.test(originalPath)\n      || response.status === 204) return response\n    const value: unknown = await response.json()\n    if (!object(value)) throw new Error(\"Invalid native inbox response\")\n    const normalized = { ...value, data: Array.isArray(value.data) ? value.data.map(normalizeInbox) : normalizeInbox(value.data) }\n    const responseHeaders = new Headers(response.headers)\n    responseHeaders.delete(\"content-length\")\n    responseHeaders.delete(\"content-encoding\")\n    return new Response(JSON.stringify(normalized), { status: response.status, headers: responseHeaders })\n  }\n  return { fetch: adaptedFetch, profile: resolveProfile }\n}\n\n// A cancelled subscriber must not cancel the connection's negotiation or wait\n// for another subscriber's request to finish before observing its own abort.\nfunction awaitLocal<T>(pending: Promise<T>, signal?: AbortSignal): Promise<T> {\n  if (!signal) return pending\n  return new Promise<T>((resolve, reject) => {\n    const abort = () => { signal.removeEventListener(\"abort\", abort); reject(signal.reason) }\n    if (signal.aborted) { reject(signal.reason); return }\n    signal.addEventListener(\"abort\", abort, { once: true })\n    pending.then(value => { signal.removeEventListener(\"abort\", abort); resolve(value) }, error => {\n      signal.removeEventListener(\"abort\", abort); reject(error)\n    })\n  })\n}\n"]}

package/dist/opencode/compatibility/transport.test.js

@@ -0,0 +1,83 @@
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { once } from "node:events";
+import { test } from "node:test";
+import { OpenCode } from "@opencode/client";
+import { rememberRuntime } from "./runtime";
+import { createRuntimeFetch } from "./transport";
+test("the pinned client uses the earlier wire contract and retains admission/list timestamps", async () => {
+    const seen = [];
+    const item = { id: "inbox-fixture", sessionID: "s", type: "user", payload: { text: "fixture" }, delivery: "queue", timeCreated: 123 };
+    const server = createServer(async (req, res) => {
+        let raw = "";
+        for await (const data of req)
+            raw += data;
+        assert.equal(req.headers.authorization, `Basic ${Buffer.from("opencode:fixture").toString("base64")}`);
+        seen.push({ method: req.method, path: req.url, body: raw ? JSON.parse(raw) : undefined });
+        res.setHeader("content-type", "application/json");
+        if (req.url === "/api/session/s/prompt")
+            return res.end(JSON.stringify({ data: item }));
+        if (req.url === "/api/session/s/inbox")
+            return res.end(JSON.stringify({ data: [item] }));
+        if (req.url === "/api/session/s/fork")
+            return res.end(JSON.stringify({ data: { id: "fork" } }));
+        if (req.url?.startsWith("/api/session/s/interrupt"))
+            return res.end("{}");
+        res.writeHead(204).end();
+    });
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    const endpoint = { url: `http://127.0.0.1:${server.address().port}`, auth: { type: "basic", username: "opencode", password: "fixture" } };
+    rememberRuntime(endpoint, { version: "2.0.3", pid: 1, discovery: "health" });
+    const client = OpenCode.make({ baseUrl: endpoint.url, fetch: createRuntimeFetch(endpoint) });
+    try {
+        assert.equal((await client.session.prompt({ sessionID: "s", text: "fixture" })).time.created, 123);
+        assert.equal((await client.session.inbox.list({ sessionID: "s" }))[0].time.created, 123);
+        await client.permission.reply({ sessionID: "s", requestID: "p", decision: "once" });
+        await client.session.command({ sessionID: "s", name: "test", text: "args", delivery: "queue" });
+        await client.session.fork({ sessionID: "s", before: "m" });
+        await client.session.interrupt({ sessionID: "s", resume: true });
+        await client.session.inbox.update({ sessionID: "s", inboxID: "i", delivery: "steer" });
+        await client.session.form.cancel({ sessionID: "s", formID: "f" });
+        await client.session.instructions.entry.remove({ sessionID: "s", key: "voice" });
+        assert.deepEqual(seen.slice(2), [
+            { method: "POST", path: "/api/session/s/permission/p/reply", body: { reply: "once" } },
+            { method: "POST", path: "/api/session/s/command", body: { command: "test", text: "args", delivery: "queue" } },
+            { method: "POST", path: "/api/session/s/fork", body: { boundary: { type: "before", messageID: "m" } } },
+            { method: "POST", path: "/api/session/s/interrupt?continue=true", body: undefined },
+            { method: "POST", path: "/api/session/s/inbox/i/steer", body: undefined },
+            { method: "POST", path: "/api/session/s/form/f/cancel", body: undefined },
+            { method: "DELETE", path: "/api/session/s/instructions/entries/voice", body: undefined },
+        ]);
+    }
+    finally {
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+});
+test("errors never retry a mutation, unsupported fields are rejected, and abort/auth are preserved", async () => {
+    const endpoint = { url: "http://127.0.0.1:4321" };
+    rememberRuntime(endpoint, { version: "2.0.3", pid: 2, discovery: "health" });
+    let calls = 0;
+    for (const status of [400, 401, 404, 500]) {
+        const client = OpenCode.make({ baseUrl: endpoint.url, fetch: createRuntimeFetch(endpoint, async () => { calls++; return new Response(null, { status }); }) });
+        await assert.rejects(client.session.update({ sessionID: "s", title: "title" }));
+    }
+    assert.equal(calls, 4);
+    const client = OpenCode.make({ baseUrl: endpoint.url, fetch: createRuntimeFetch(endpoint, async () => { calls++; return new Response(null, { status: 204 }); }) });
+    await assert.rejects(client.session.update({ sessionID: "s", title: "title", permissions: [] }), (error) => {
+        assert.match(String(error.cause), /title-only/);
+        return true;
+    });
+    assert.equal(calls, 4);
+    const controller = new AbortController();
+    controller.abort();
+    const transport = createRuntimeFetch(endpoint, async (_url, init) => {
+        assert.equal(init?.redirect, "error");
+        init?.signal?.throwIfAborted();
+        throw new Error("unexpected live request");
+    });
+    await assert.rejects(transport(new Request(`${endpoint.url}/api/session/s/wait`, { method: "POST", signal: controller.signal })), { name: "AbortError" });
+    await assert.rejects(transport("http://127.0.0.1:4322/api/session"), /origin mismatch/);
+});
+//# sourceMappingURL=transport.test.js.map

package/dist/opencode/compatibility/transport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.test.js","sourceRoot":"","sources":["../../../src/opencode/compatibility/transport.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,IAAI,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;IACxG,MAAM,IAAI,GAA2D,EAAE,CAAA;IACvE,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAA;IACrI,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,GAAG;YAAE,GAAG,IAAI,IAAI,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACtG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAO,EAAE,IAAI,EAAE,GAAG,CAAC,GAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;QAC3F,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;QACjD,IAAI,GAAG,CAAC,GAAG,KAAK,uBAAuB;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACvF,IAAI,GAAG,CAAC,GAAG,KAAK,sBAAsB;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACxF,IAAI,GAAG,CAAC,GAAG,KAAK,qBAAqB;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/F,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,0BAA0B,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAC7B,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC/B,MAAM,QAAQ,GAAa,EAAE,GAAG,EAAE,oBAAqB,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAA;IACzK,eAAe,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC5F,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAClG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACxF,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QACnF,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/F,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAChE,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QACtF,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACjE,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAChF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC9B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC9G,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;YACvG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,IAAI,EAAE,SAAS,EAAE;YACnF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,EAAE;YACzE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,EAAE;YACzE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,SAAS,EAAE;SACzF,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAAC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAAC,CAAC;AAC/G,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;IAC9G,MAAM,QAAQ,GAAa,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAA;IAC3D,eAAe,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5E,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC5J,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACjK,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAY,EAAE,EAAE;QAChH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAE,KAAqC,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAA;QAChF,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,UAAU,CAAC,KAAK,EAAE,CAAA;IAClB,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QAC9B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,qBAAqB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;IACzJ,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,mCAAmC,CAAC,EAAE,iBAAiB,CAAC,CAAA;AACzF,CAAC,CAAC,CAAA","sourcesContent":["import assert from \"node:assert/strict\"\nimport { createServer } from \"node:http\"\nimport { once } from \"node:events\"\nimport { test } from \"node:test\"\nimport { OpenCode } from \"@opencode/client\"\nimport type { Endpoint } from \"@opencode/client/service\"\nimport { rememberRuntime } from \"./runtime\"\nimport { createRuntimeFetch } from \"./transport\"\n\ntest(\"the pinned client uses the earlier wire contract and retains admission/list timestamps\", async () => {\n  const seen: Array<{ method: string; path: string; body: unknown }> = []\n  const item = { id: \"inbox-fixture\", sessionID: \"s\", type: \"user\", payload: { text: \"fixture\" }, delivery: \"queue\", timeCreated: 123 }\n  const server = createServer(async (req, res) => {\n    let raw = \"\"\n    for await (const data of req) raw += data\n    assert.equal(req.headers.authorization, `Basic ${Buffer.from(\"opencode:fixture\").toString(\"base64\")}`)\n    seen.push({ method: req.method!, path: req.url!, body: raw ? JSON.parse(raw) : undefined })\n    res.setHeader(\"content-type\", \"application/json\")\n    if (req.url === \"/api/session/s/prompt\") return res.end(JSON.stringify({ data: item }))\n    if (req.url === \"/api/session/s/inbox\") return res.end(JSON.stringify({ data: [item] }))\n    if (req.url === \"/api/session/s/fork\") return res.end(JSON.stringify({ data: { id: \"fork\" } }))\n    if (req.url?.startsWith(\"/api/session/s/interrupt\")) return res.end(\"{}\")\n    res.writeHead(204).end()\n  })\n  server.listen(0, \"127.0.0.1\")\n  await once(server, \"listening\")\n  const endpoint: Endpoint = { url: `http://127.0.0.1:${(server.address() as { port: number }).port}`, auth: { type: \"basic\", username: \"opencode\", password: \"fixture\" } }\n  rememberRuntime(endpoint, { version: \"2.0.3\", pid: 1, discovery: \"health\" })\n  const client = OpenCode.make({ baseUrl: endpoint.url, fetch: createRuntimeFetch(endpoint) })\n  try {\n    assert.equal((await client.session.prompt({ sessionID: \"s\", text: \"fixture\" })).time.created, 123)\n    assert.equal((await client.session.inbox.list({ sessionID: \"s\" }))[0].time.created, 123)\n    await client.permission.reply({ sessionID: \"s\", requestID: \"p\", decision: \"once\" })\n    await client.session.command({ sessionID: \"s\", name: \"test\", text: \"args\", delivery: \"queue\" })\n    await client.session.fork({ sessionID: \"s\", before: \"m\" })\n    await client.session.interrupt({ sessionID: \"s\", resume: true })\n    await client.session.inbox.update({ sessionID: \"s\", inboxID: \"i\", delivery: \"steer\" })\n    await client.session.form.cancel({ sessionID: \"s\", formID: \"f\" })\n    await client.session.instructions.entry.remove({ sessionID: \"s\", key: \"voice\" })\n    assert.deepEqual(seen.slice(2), [\n      { method: \"POST\", path: \"/api/session/s/permission/p/reply\", body: { reply: \"once\" } },\n      { method: \"POST\", path: \"/api/session/s/command\", body: { command: \"test\", text: \"args\", delivery: \"queue\" } },\n      { method: \"POST\", path: \"/api/session/s/fork\", body: { boundary: { type: \"before\", messageID: \"m\" } } },\n      { method: \"POST\", path: \"/api/session/s/interrupt?continue=true\", body: undefined },\n      { method: \"POST\", path: \"/api/session/s/inbox/i/steer\", body: undefined },\n      { method: \"POST\", path: \"/api/session/s/form/f/cancel\", body: undefined },\n      { method: \"DELETE\", path: \"/api/session/s/instructions/entries/voice\", body: undefined },\n    ])\n  } finally { server.closeAllConnections(); await new Promise<void>(resolve => server.close(() => resolve())) }\n})\n\ntest(\"errors never retry a mutation, unsupported fields are rejected, and abort/auth are preserved\", async () => {\n  const endpoint: Endpoint = { url: \"http://127.0.0.1:4321\" }\n  rememberRuntime(endpoint, { version: \"2.0.3\", pid: 2, discovery: \"health\" })\n  let calls = 0\n  for (const status of [400, 401, 404, 500]) {\n    const client = OpenCode.make({ baseUrl: endpoint.url, fetch: createRuntimeFetch(endpoint, async () => { calls++; return new Response(null, { status }) }) })\n    await assert.rejects(client.session.update({ sessionID: \"s\", title: \"title\" }))\n  }\n  assert.equal(calls, 4)\n  const client = OpenCode.make({ baseUrl: endpoint.url, fetch: createRuntimeFetch(endpoint, async () => { calls++; return new Response(null, { status: 204 }) }) })\n  await assert.rejects(client.session.update({ sessionID: \"s\", title: \"title\", permissions: [] }), (error: Error) => {\n    assert.match(String((error as Error & { cause?: unknown }).cause), /title-only/)\n    return true\n  })\n  assert.equal(calls, 4)\n  const controller = new AbortController()\n  controller.abort()\n  const transport = createRuntimeFetch(endpoint, async (_url, init) => {\n    assert.equal(init?.redirect, \"error\")\n    init?.signal?.throwIfAborted()\n    throw new Error(\"unexpected live request\")\n  })\n  await assert.rejects(transport(new Request(`${endpoint.url}/api/session/s/wait`, { method: \"POST\", signal: controller.signal })), { name: \"AbortError\" })\n  await assert.rejects(transport(\"http://127.0.0.1:4322/api/session\"), /origin mismatch/)\n})\n"]}

package/dist/opencode/session-pruning/location.js

@@ -0,0 +1,16 @@
+// Keep identity primitives inside the standalone plugin's package boundary.
+// The HTTP compatibility adapter reuses these without making the plugin depend on it.
+export function readLocationRef(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Invalid location");
+    const input = value;
+    if (typeof input.directory !== "string" || !input.directory.trim() || input.directory.includes("\0")
+        || (input.workspaceID !== undefined && (typeof input.workspaceID !== "string"
+            || !input.workspaceID.trim() || input.workspaceID.includes("\0"))))
+        throw new Error("Invalid location");
+    return { directory: input.directory, ...(input.workspaceID === undefined ? {} : { workspaceID: input.workspaceID }) };
+}
+export function sameLocation(left, right) {
+    return left.directory === right.directory && left.workspaceID === right.workspaceID;
+}
+//# sourceMappingURL=location.js.map

package/dist/opencode/session-pruning/location.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"location.js","sourceRoot":"","sources":["../../../src/opencode/session-pruning/location.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACpG,MAAM,KAAK,GAAG,KAAgC,CAAA;IAC9C,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;WAC/F,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;eACxE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC3G,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;AACvH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAiB,EAAE,KAAkB;IAChE,OAAO,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAA;AACrF,CAAC","sourcesContent":["import type { LocationRef } from \"@opencode/client\"\n\n// Keep identity primitives inside the standalone plugin's package boundary.\n// The HTTP compatibility adapter reuses these without making the plugin depend on it.\nexport function readLocationRef(value: unknown): LocationRef {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"Invalid location\")\n  const input = value as Record<string, unknown>\n  if (typeof input.directory !== \"string\" || !input.directory.trim() || input.directory.includes(\"\\0\")\n    || (input.workspaceID !== undefined && (typeof input.workspaceID !== \"string\"\n      || !input.workspaceID.trim() || input.workspaceID.includes(\"\\0\")))) throw new Error(\"Invalid location\")\n  return { directory: input.directory, ...(input.workspaceID === undefined ? {} : { workspaceID: input.workspaceID }) }\n}\n\nexport function sameLocation(left: LocationRef, right: LocationRef): boolean {\n  return left.directory === right.directory && left.workspaceID === right.workspaceID\n}\n"]}

package/dist/opencode/session-pruning/package.test.js

@@ -0,0 +1,37 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { copyFile, mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { build } from "esbuild";
+test("every packed plugin entrypoint resolves without sibling checkout sources", async () => {
+    const source = fileURLToPath(new URL("./", import.meta.url));
+    const temporaryRoot = path.join(os.tmpdir(), "opencode");
+    await mkdir(temporaryRoot, { recursive: true });
+    const isolated = await mkdtemp(path.join(temporaryRoot, "pruning-package-"));
+    try {
+        const output = execFileSync(process.platform === "win32" ? "npm.cmd" : "npm", [
+            "pack", "--dry-run", "--json", "--ignore-scripts",
+        ], { cwd: source, encoding: "utf8", shell: process.platform === "win32" });
+        const [archive] = JSON.parse(output);
+        for (const file of archive.files) {
+            const destination = path.join(isolated, file.path);
+            await mkdir(path.dirname(destination), { recursive: true });
+            await copyFile(path.join(source, file.path), destination);
+        }
+        const manifest = JSON.parse(await readFile(path.join(isolated, "package.json"), "utf8"));
+        const result = await build({
+            absWorkingDir: isolated,
+            entryPoints: Object.values(manifest.exports),
+            outdir: "dist", bundle: true, write: false, platform: "node", format: "esm",
+            packages: "external", logLevel: "silent",
+        });
+        assert.equal(result.outputFiles.length, Object.keys(manifest.exports).length);
+    }
+    finally {
+        await rm(isolated, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=package.test.js.map

package/dist/opencode/session-pruning/package.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.test.js","sourceRoot":"","sources":["../../../src/opencode/session-pruning/package.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAE/B,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAA;IACxD,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE;YAC5E,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,kBAAkB;SAClD,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAA;QAC1E,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAoC,CAAA;QACvE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAClD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3D,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QACxF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAa;YACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;YAC3E,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ;SACzC,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;IAC/E,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import assert from \"node:assert/strict\"\nimport { execFileSync } from \"node:child_process\"\nimport { copyFile, mkdir, mkdtemp, readFile, rm } from \"node:fs/promises\"\nimport os from \"node:os\"\nimport path from \"node:path\"\nimport { test } from \"node:test\"\nimport { fileURLToPath } from \"node:url\"\nimport { build } from \"esbuild\"\n\ntest(\"every packed plugin entrypoint resolves without sibling checkout sources\", async () => {\n  const source = fileURLToPath(new URL(\"./\", import.meta.url))\n  const temporaryRoot = path.join(os.tmpdir(), \"opencode\")\n  await mkdir(temporaryRoot, { recursive: true })\n  const isolated = await mkdtemp(path.join(temporaryRoot, \"pruning-package-\"))\n  try {\n    const output = execFileSync(process.platform === \"win32\" ? \"npm.cmd\" : \"npm\", [\n      \"pack\", \"--dry-run\", \"--json\", \"--ignore-scripts\",\n    ], { cwd: source, encoding: \"utf8\", shell: process.platform === \"win32\" })\n    const [archive] = JSON.parse(output) as { files: { path: string }[] }[]\n    for (const file of archive.files) {\n      const destination = path.join(isolated, file.path)\n      await mkdir(path.dirname(destination), { recursive: true })\n      await copyFile(path.join(source, file.path), destination)\n    }\n    const manifest = JSON.parse(await readFile(path.join(isolated, \"package.json\"), \"utf8\"))\n    const result = await build({\n      absWorkingDir: isolated,\n      entryPoints: Object.values(manifest.exports) as string[],\n      outdir: \"dist\", bundle: true, write: false, platform: \"node\", format: \"esm\",\n      packages: \"external\", logLevel: \"silent\",\n    })\n    assert.equal(result.outputFiles.length, Object.keys(manifest.exports).length)\n  } finally {\n    await rm(isolated, { recursive: true, force: true })\n  }\n})\n"]}

package/dist/opencode/session-pruning/plugin.js

@@ -5,6 +5,7 @@ import { previewContent } from "./planner";
 import { readPruningPreview } from "./preview-store";
 import { pruneBoundMessage } from "./service";
 import { pruningDatabasePath } from "./database-path";
+import { readLocationRef, sameLocation } from "./location";
 export const SessionPruningRpc = Rpc.define(pruningRpcDefinition);
 // Native local-plugin entry point. Only a user's pruning RPC changes content.
 export default Plugin.define({
@@ -16,11 +17,13 @@ export default Plugin.define({
                 const session = await ctx.session.get({ sessionID: target.sessionID });
                 // Location membership must be checked again inside the plugin: clients
                 // other than CodeNomad may invoke this RPC directly.
-                if (session.location.directory !== ctx.location.directory)
+                const location = readLocationRef(session.location);
+                if (!sameLocation(location, readLocationRef(ctx.location)) || session.projectID !== ctx.location.project.id) {
                     return { status: "blocked", reason: "not_deletable" };
+                }
                 // Plugin Context does not expose session.message in beta-19398. Read
                 // the explicit DB in query-only mode, including pre-compaction history.
-                const data = await readPruningPreview(pruningDatabasePath(ctx.options.databasePath, ctx.app.channel), target, session.location.directory);
+                const data = await readPruningPreview(pruningDatabasePath(ctx.options.databasePath, ctx.app.channel), target, location, session.projectID);
                 const preview = data ? previewContent(data) : { status: "blocked", reason: "unavailable" };
                 return preview.status === "preview"
                     ? { ...preview, liveMutation: true }

package/dist/opencode/session-pruning/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/opencode/session-pruning/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;AAEjE,8EAA8E;AAC9E,eAAe,MAAM,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,2BAA2B;IAC/B,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAE;YAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;gBACtE,uEAAuE;gBACvE,qDAAqD;gBACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,CAAC,SAAS;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAW,CAAA;gBACzH,qEAAqE;gBACrE,wEAAwE;gBACxE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;gBACzI,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAW,CAAA;gBACnG,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;oBACpC,CAAC,CAAC,OAAO,CAAA;YACb,CAAC;YACD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC3B,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC/B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,sEAAsE;oBACtE,mEAAmE;oBACnE,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;qBAClF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACpB,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC;SACF,CAAC,CAAA;QACF,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAA;IACrC,CAAC;CACF,CAAC,CAAA","sourcesContent":["import { Plugin } from \"@opencode/plugin\"\nimport { Rpc } from \"@opencode/plugin/rpc\"\nimport { messageTargetSchema, pruneRequestSchema, pruningRpcDefinition } from \"./contract\"\nimport { previewContent } from \"./planner\"\nimport { readPruningPreview } from \"./preview-store\"\nimport { pruneBoundMessage } from \"./service\"\nimport { pruningDatabasePath } from \"./database-path\"\n\nexport const SessionPruningRpc = Rpc.define(pruningRpcDefinition)\n\n// Native local-plugin entry point. Only a user's pruning RPC changes content.\nexport default Plugin.define({\n  id: \"codenomad-session-pruning\",\n  async setup(ctx) {\n    const registration = await ctx.rpc.register(SessionPruningRpc, {\n      preview: async (input) => {\n        const target = messageTargetSchema.parse(input)\n        const session = await ctx.session.get({ sessionID: target.sessionID })\n        // Location membership must be checked again inside the plugin: clients\n        // other than CodeNomad may invoke this RPC directly.\n        if (session.location.directory !== ctx.location.directory) return { status: \"blocked\", reason: \"not_deletable\" } as const\n        // Plugin Context does not expose session.message in beta-19398. Read\n        // the explicit DB in query-only mode, including pre-compaction history.\n        const data = await readPruningPreview(pruningDatabasePath(ctx.options.databasePath, ctx.app.channel), target, session.location.directory)\n        const preview = data ? previewContent(data) : { status: \"blocked\", reason: \"unavailable\" } as const\n        return preview.status === \"preview\"\n          ? { ...preview, liveMutation: true }\n          : preview\n      },\n      prune: async (input, call) => {\n        pruneRequestSchema.parse(input)\n        const result = await pruneBoundMessage(ctx, input, call.signal)\n        if (result.status === \"pruned\") {\n          // Retrying the same input returns its atomic receipt and re-emits the\n          // notification. An emission failure cannot undo a committed write.\n          await registration.events.emit(\"pruned\", {\n            sessionID: input.sessionID, messageID: input.messageID, revision: result.revision,\n          }).catch(() => {})\n        }\n        return result\n      },\n    })\n    return () => registration.dispose()\n  },\n})\n"]}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/opencode/session-pruning/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;AAEjE,8EAA8E;AAC9E,eAAe,MAAM,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,2BAA2B;IAC/B,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAE;YAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;gBACtE,uEAAuE;gBACvE,qDAAqD;gBACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAClD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAC5G,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAW,CAAA;gBAChE,CAAC;gBACD,qEAAqE;gBACrE,wEAAwE;gBACxE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;gBAC1I,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAW,CAAA;gBACnG,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;oBACpC,CAAC,CAAC,OAAO,CAAA;YACb,CAAC;YACD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC3B,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC/B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,sEAAsE;oBACtE,mEAAmE;oBACnE,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;qBAClF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACpB,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC;SACF,CAAC,CAAA;QACF,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAA;IACrC,CAAC;CACF,CAAC,CAAA","sourcesContent":["import { Plugin } from \"@opencode/plugin\"\nimport { Rpc } from \"@opencode/plugin/rpc\"\nimport { messageTargetSchema, pruneRequestSchema, pruningRpcDefinition } from \"./contract\"\nimport { previewContent } from \"./planner\"\nimport { readPruningPreview } from \"./preview-store\"\nimport { pruneBoundMessage } from \"./service\"\nimport { pruningDatabasePath } from \"./database-path\"\nimport { readLocationRef, sameLocation } from \"./location\"\n\nexport const SessionPruningRpc = Rpc.define(pruningRpcDefinition)\n\n// Native local-plugin entry point. Only a user's pruning RPC changes content.\nexport default Plugin.define({\n  id: \"codenomad-session-pruning\",\n  async setup(ctx) {\n    const registration = await ctx.rpc.register(SessionPruningRpc, {\n      preview: async (input) => {\n        const target = messageTargetSchema.parse(input)\n        const session = await ctx.session.get({ sessionID: target.sessionID })\n        // Location membership must be checked again inside the plugin: clients\n        // other than CodeNomad may invoke this RPC directly.\n        const location = readLocationRef(session.location)\n        if (!sameLocation(location, readLocationRef(ctx.location)) || session.projectID !== ctx.location.project.id) {\n          return { status: \"blocked\", reason: \"not_deletable\" } as const\n        }\n        // Plugin Context does not expose session.message in beta-19398. Read\n        // the explicit DB in query-only mode, including pre-compaction history.\n        const data = await readPruningPreview(pruningDatabasePath(ctx.options.databasePath, ctx.app.channel), target, location, session.projectID)\n        const preview = data ? previewContent(data) : { status: \"blocked\", reason: \"unavailable\" } as const\n        return preview.status === \"preview\"\n          ? { ...preview, liveMutation: true }\n          : preview\n      },\n      prune: async (input, call) => {\n        pruneRequestSchema.parse(input)\n        const result = await pruneBoundMessage(ctx, input, call.signal)\n        if (result.status === \"pruned\") {\n          // Retrying the same input returns its atomic receipt and re-emits the\n          // notification. An emission failure cannot undo a committed write.\n          await registration.events.emit(\"pruned\", {\n            sessionID: input.sessionID, messageID: input.messageID, revision: result.revision,\n          }).catch(() => {})\n        }\n        return result\n      },\n    })\n    return () => registration.dispose()\n  },\n})\n"]}

package/dist/opencode/session-pruning/preview-store.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { storageDirectory } from "./storage-path";
-export async function readPruningPreview(filename, target, directory) {
+export async function readPruningPreview(filename, target, location, projectID) {
     // Deliberately no default ~/.local/share path or UI-supplied override.
     if (typeof filename !== "string" || !path.isAbsolute(filename))
         return undefined;
@@ -11,7 +11,8 @@ export async function readPruningPreview(filename, target, directory) {
         const row = db.prepare(`SELECT m.data FROM session_message m
       JOIN session_v2 s ON s.id = m.session_id
       WHERE m.id = ? AND m.session_id = ? AND m.type = 'assistant' AND s.directory = ?
-      AND length(CAST(m.data AS BLOB)) <= 16777216`).get(target.messageID, target.sessionID, storageDirectory(directory));
+       AND s.project_id = ? AND s.workspace_id IS ?
+       AND length(CAST(m.data AS BLOB)) <= 16777216`).get(target.messageID, target.sessionID, storageDirectory(location.directory), projectID, location.workspaceID ?? null);
         return typeof row?.data === "string" ? JSON.parse(row.data) : undefined;
     }
     finally {

package/dist/opencode/session-pruning/preview-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"preview-store.js","sourceRoot":"","sources":["../../../src/opencode/session-pruning/preview-store.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAG5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAiB,EAAE,MAA2C,EAAE,SAAiB;IAEjF,uEAAuE;IACvE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAChF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;IACpD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;mDAGwB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAA;QACrH,OAAO,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAC1B,CAAC","sourcesContent":["import path from \"node:path\"\nimport type { z } from \"zod\"\nimport type { messageTargetSchema } from \"./contract\"\nimport { storageDirectory } from \"./storage-path\"\n\nexport async function readPruningPreview(\n  filename: unknown, target: z.infer<typeof messageTargetSchema>, directory: string,\n): Promise<unknown | undefined> {\n  // Deliberately no default ~/.local/share path or UI-supplied override.\n  if (typeof filename !== \"string\" || !path.isAbsolute(filename)) return undefined\n  const { DatabaseSync } = await import(\"node:sqlite\")\n  const db = new DatabaseSync(filename, { readOnly: true, timeout: 1000 })\n  try {\n    db.exec(\"PRAGMA query_only=ON\")\n    const row = db.prepare(`SELECT m.data FROM session_message m\n      JOIN session_v2 s ON s.id = m.session_id\n      WHERE m.id = ? AND m.session_id = ? AND m.type = 'assistant' AND s.directory = ?\n      AND length(CAST(m.data AS BLOB)) <= 16777216`).get(target.messageID, target.sessionID, storageDirectory(directory))\n    return typeof row?.data === \"string\" ? JSON.parse(row.data) : undefined\n  } finally { db.close() }\n}\n"]}
+{"version":3,"file":"preview-store.js","sourceRoot":"","sources":["../../../src/opencode/session-pruning/preview-store.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAG5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAiB,EAAE,MAA2C,EAAE,QAAqB,EAAE,SAAiB;IAExG,uEAAuE;IACvE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAChF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;IACpD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;;oDAIyB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EACnF,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;QACnF,OAAO,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAC1B,CAAC","sourcesContent":["import path from \"node:path\"\nimport type { z } from \"zod\"\nimport type { messageTargetSchema } from \"./contract\"\nimport { storageDirectory } from \"./storage-path\"\nimport type { LocationRef } from \"@opencode/client\"\n\nexport async function readPruningPreview(\n  filename: unknown, target: z.infer<typeof messageTargetSchema>, location: LocationRef, projectID: string,\n): Promise<unknown | undefined> {\n  // Deliberately no default ~/.local/share path or UI-supplied override.\n  if (typeof filename !== \"string\" || !path.isAbsolute(filename)) return undefined\n  const { DatabaseSync } = await import(\"node:sqlite\")\n  const db = new DatabaseSync(filename, { readOnly: true, timeout: 1000 })\n  try {\n    db.exec(\"PRAGMA query_only=ON\")\n    const row = db.prepare(`SELECT m.data FROM session_message m\n      JOIN session_v2 s ON s.id = m.session_id\n      WHERE m.id = ? AND m.session_id = ? AND m.type = 'assistant' AND s.directory = ?\n       AND s.project_id = ? AND s.workspace_id IS ?\n       AND length(CAST(m.data AS BLOB)) <= 16777216`).get(target.messageID, target.sessionID,\n         storageDirectory(location.directory), projectID, location.workspaceID ?? null)\n    return typeof row?.data === \"string\" ? JSON.parse(row.data) : undefined\n  } finally { db.close() }\n}\n"]}