@openchambery/web 1.18.2-beta.2 → 1.18.2-beta.21

package/server/lib/config-sync/engine.js

@@ -0,0 +1,108 @@
+import path from 'node:path';
+
+import { assertPlanDirection } from './contract.js';
+import { assertCredentialSyncAuthorized } from './credential-auth.js';
+import { collectLocalTarBuffer } from './tar.js';
+
+/**
+ * Run a source-side plan against a TargetExecutor (probe → prepare → putTar* → finalize).
+ * Direction-agnostic orchestration; ticket 02 only drives push from a local home snapshot.
+ * Credential-bearing plans require an explicit per-target grant (ticket 03).
+ *
+ * @param {{
+ *   plan: object,
+ *   executor: import('./contract.js').TargetExecutor,
+ *   syncRunId: string,
+ *   sourceHomedir: string,
+ *   collectTar?: typeof collectLocalTarBuffer,
+ *   credentialSyncAuthorized?: boolean,
+ * }} args
+ */
+export const applyConfigSyncPlan = async ({
+  plan,
+  executor,
+  syncRunId,
+  sourceHomedir,
+  collectTar = collectLocalTarBuffer,
+  credentialSyncAuthorized = false,
+}) => {
+  assertPlanDirection(plan);
+  assertCredentialSyncAuthorized(plan, {
+    targetId: plan?.targetId || 'unknown',
+    authorized: credentialSyncAuthorized === true,
+  });
+  const home = String(sourceHomedir || '');
+  const configDir = path.join(home, '.config', 'opencode');
+  const tarEntries = [
+    ...plan.files.map((entry) => entry.path),
+    ...plan.directories.map((entry) => entry.path),
+  ];
+  const hasConfigPayload = tarEntries.length > 0;
+  const hasAgentsPayload = Boolean(plan.agentsRoot);
+  const hasAuthPayload = Boolean(plan.authFile);
+
+  if (!hasConfigPayload && !hasAgentsPayload && !hasAuthPayload) {
+    // Nothing to upload — preserve the historical short-circuit (no remote prepare).
+    return {
+      ok: true,
+      files: plan.files.length,
+      directories: plan.directories.length,
+      deletes: plan.deletes.length,
+      totalBytes: plan.totalBytes,
+      agentsRoot: null,
+      authFile: null,
+      plan,
+    };
+  }
+
+  const windowsHide = process.platform === 'win32';
+  const configTarBuffer = hasConfigPayload
+    ? await collectTar(['-h', '-czf', '-', '-C', configDir, ...tarEntries], { windowsHide })
+    : null;
+  const agentsTarBuffer = hasAgentsPayload
+    ? await collectTar(['-h', '-czf', '-', '-C', home, '.agents'], { windowsHide })
+    : null;
+  const authShareDir = path.join(home, '.local', 'share', 'opencode');
+  const authTarBuffer = hasAuthPayload
+    ? await collectTar(['-h', '-czf', '-', '-C', authShareDir, 'auth.json'], { windowsHide })
+    : null;
+
+  await executor.prepare(plan, { syncRunId });
+
+  if (configTarBuffer) {
+    await executor.putTar({ kind: 'config', payload: configTarBuffer });
+  }
+  if (agentsTarBuffer) {
+    await executor.putTar({ kind: 'agents', payload: agentsTarBuffer });
+  }
+  if (authTarBuffer) {
+    // Only auth.json — never the rest of ~/.local/share/opencode (session DBs live there).
+    await executor.putTar({ kind: 'auth', payload: authTarBuffer });
+  }
+
+  await executor.finalize(plan, { syncRunId });
+
+  return {
+    ok: true,
+    files: plan.files.length,
+    directories: plan.directories.length,
+    deletes: plan.deletes.length,
+    totalBytes: plan.totalBytes,
+    agentsRoot: plan.agentsRoot ? { fileCount: plan.agentsRoot.fileCount } : null,
+    authFile: plan.authFile ? { bytes: plan.authFile.bytes } : null,
+    plan,
+  };
+};
+
+/**
+ * Preview helper: compute probe path list from a plan.
+ * @param {object} plan
+ */
+export const probePathsForPlan = (plan) => {
+  const probePaths = [
+    ...(Array.isArray(plan?.files) ? plan.files.map((entry) => entry.path) : []),
+    ...(Array.isArray(plan?.directories) ? plan.directories.map((entry) => entry.path) : []),
+    ...(Array.isArray(plan?.deletes) ? plan.deletes : []),
+  ];
+  return [...new Set(probePaths)];
+};

package/server/lib/config-sync/index.js

@@ -0,0 +1,67 @@
+export {
+  OPENCODE_CONFIG_SYNC_ALLOWLIST,
+  OPENCODE_CONFIG_SYNC_BACKUP_DIR,
+  OPENCODE_AGENTS_SYNC_BACKUP_DIR,
+  OPENCODE_AUTH_SYNC_BACKUP_DIR,
+  OPENCODE_AGENTS_ROOT_PROBE_MARKER,
+  OPENCODE_AUTH_FILE_PROBE_MARKER,
+  OPENCODE_CONFIG_SYNC_MAX_BYTES,
+  OPENCODE_CONFIG_SYNC_MAX_FILES,
+  OPENCODE_CONFIG_SYNC_BACKUP_GENERATIONS,
+  SYNC_DIRECTION_PUSH,
+  SYNC_DIRECTION_PULL,
+  SYNC_DIRECTIONS,
+} from './constants.js';
+
+export {
+  EMPTY_SYNC_CAPABILITIES,
+  MANAGED_SSH_SYNC_CAPABILITIES,
+  DIRECT_HOST_SYNC_CAPABILITIES,
+  RELAY_HOST_SYNC_CAPABILITIES,
+  createSshSyncTarget,
+  createDirectHostSyncTarget,
+  createRelayHostSyncTarget,
+  assertTargetCapability,
+  assertPlanDirection,
+} from './contract.js';
+
+export {
+  syncTargetIdForSshInstance,
+  syncTargetIdForDirectHost,
+  syncTargetIdForRelayServer,
+} from './target-id.js';
+export {
+  planOpenCodeConfigSync,
+  planOpenCodeConfigSyncFromInventory,
+  walkAllowlistDirectory,
+} from './plan.js';
+export {
+  buildRemoteSyncPrepareScript,
+  buildRemoteSyncProbeScript,
+  buildRemoteSyncFinalizeScript,
+  buildRemoteSyncInventoryScript,
+  buildRemoteConfigTarScript,
+  buildRemoteAgentsTarScript,
+  buildRemoteAuthTarScript,
+  sanitizeSyncRunIdForPath,
+  shellQuote,
+} from './scripts.js';
+export { collectLocalTarBuffer } from './tar.js';
+export { applyConfigSyncPlan, probePathsForPlan } from './engine.js';
+export {
+  CREDENTIAL_SYNC_UNAUTHORIZED_CODE,
+  CREDENTIAL_SYNC_GRANT_CHANNEL_INSTANCE_SETTINGS,
+  CredentialSyncUnauthorizedError,
+  planIncludesCredentials,
+  assertCredentialSyncAuthorized,
+} from './credential-auth.js';
+export {
+  buildDefaultSyncSelections,
+  normalizeSyncSelections,
+  filterPlanBySelections,
+} from './selections.js';
+export {
+  prepareLocalSyncDestination,
+  finalizeLocalSyncDestination,
+  extractTarGzBuffer,
+} from './local-backup.js';

package/server/lib/config-sync/local-backup.js

@@ -0,0 +1,171 @@
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+import {
+  OPENCODE_AGENTS_SYNC_BACKUP_DIR,
+  OPENCODE_AUTH_SYNC_BACKUP_DIR,
+  OPENCODE_CONFIG_SYNC_ALLOWLIST,
+  OPENCODE_CONFIG_SYNC_BACKUP_DIR,
+  OPENCODE_CONFIG_SYNC_BACKUP_GENERATIONS,
+} from './constants.js';
+import { sanitizeSyncRunIdForPath } from './scripts.js';
+
+const copyPathIfExists = async (from, to) => {
+  try {
+    await fsp.access(from);
+  } catch {
+    return false;
+  }
+  await fsp.mkdir(path.dirname(to), { recursive: true });
+  await fsp.cp(from, to, { recursive: true, force: true });
+  return true;
+};
+
+const pruneGenerations = async (backupRoot, syncRunId, generations) => {
+  await fsp.mkdir(backupRoot, { recursive: true });
+  let entries = [];
+  try {
+    entries = await fsp.readdir(backupRoot, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  const dirs = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const abs = path.join(backupRoot, entry.name);
+    let mtimeMs = 0;
+    try {
+      mtimeMs = (await fsp.stat(abs)).mtimeMs;
+    } catch {
+      mtimeMs = 0;
+    }
+    dirs.push({ name: entry.name, abs, mtimeMs });
+  }
+  dirs.sort((left, right) => right.mtimeMs - left.mtimeMs);
+  for (const [index, entry] of dirs.entries()) {
+    if (index < generations) continue;
+    if (entry.name === syncRunId) continue;
+    await fsp.rm(entry.abs, { recursive: true, force: true });
+  }
+};
+
+/**
+ * Local (pull destination) generational backup + delete stale counterparts.
+ * Mirrors remote prepare semantics under the local home.
+ *
+ * @param {string} homedir
+ * @param {object} plan
+ * @param {{ syncRunId: string, generations?: number }} options
+ */
+export const prepareLocalSyncDestination = async (homedir, plan, options) => {
+  const home = String(homedir || '');
+  const syncRunId = sanitizeSyncRunIdForPath(options?.syncRunId);
+  const generations = Number.isFinite(options?.generations) && Number(options.generations) > 0
+    ? Math.trunc(Number(options.generations))
+    : OPENCODE_CONFIG_SYNC_BACKUP_GENERATIONS;
+  const configDir = path.join(home, '.config', 'opencode');
+  const backupRoot = path.join(configDir, OPENCODE_CONFIG_SYNC_BACKUP_DIR);
+  const runBackup = path.join(backupRoot, syncRunId);
+
+  await fsp.mkdir(configDir, { recursive: true });
+  await fsp.rm(runBackup, { recursive: true, force: true });
+  await fsp.mkdir(runBackup, { recursive: true });
+  await pruneGenerations(backupRoot, syncRunId, generations);
+
+  const backupPaths = [
+    ...(Array.isArray(plan?.files) ? plan.files.map((entry) => entry.path) : []),
+    ...(Array.isArray(plan?.directories) ? plan.directories.map((entry) => entry.path) : []),
+  ];
+  for (const rel of backupPaths) {
+    await copyPathIfExists(path.join(configDir, rel), path.join(runBackup, rel));
+  }
+
+  const directoryDeleteNames = new Set();
+  for (const dirSpec of OPENCODE_CONFIG_SYNC_ALLOWLIST.directories) {
+    directoryDeleteNames.add(dirSpec.path);
+    if (typeof dirSpec.legacy === 'string' && dirSpec.legacy) {
+      directoryDeleteNames.add(dirSpec.legacy);
+    }
+  }
+  for (const rel of Array.isArray(plan?.deletes) ? plan.deletes : []) {
+    const abs = path.join(configDir, rel);
+    if (directoryDeleteNames.has(rel)) {
+      await fsp.rm(abs, { recursive: true, force: true });
+    } else {
+      await fsp.rm(abs, { force: true });
+    }
+  }
+
+  if (plan?.agentsRoot) {
+    const agentsBackupRoot = path.join(home, OPENCODE_AGENTS_SYNC_BACKUP_DIR);
+    const agentsRun = path.join(agentsBackupRoot, syncRunId);
+    await fsp.rm(agentsRun, { recursive: true, force: true });
+    await fsp.mkdir(agentsRun, { recursive: true });
+    await pruneGenerations(agentsBackupRoot, syncRunId, generations);
+    await copyPathIfExists(path.join(home, '.agents'), path.join(agentsRun, 'agents'));
+    await fsp.rm(path.join(home, '.agents'), { recursive: true, force: true });
+  }
+
+  if (plan?.authFile) {
+    const authBackupRoot = path.join(home, OPENCODE_AUTH_SYNC_BACKUP_DIR);
+    const authRun = path.join(authBackupRoot, syncRunId);
+    await fsp.rm(authRun, { recursive: true, force: true });
+    await fsp.mkdir(authRun, { recursive: true });
+    await pruneGenerations(authBackupRoot, syncRunId, generations);
+    await copyPathIfExists(
+      path.join(home, '.local', 'share', 'opencode', 'auth.json'),
+      path.join(authRun, 'auth.json'),
+    );
+  }
+
+  return { runBackup };
+};
+
+/**
+ * Confirm local pull backup generation exists.
+ * @param {string} homedir
+ * @param {{ syncRunId: string }} options
+ */
+export const finalizeLocalSyncDestination = async (homedir, options) => {
+  const syncRunId = sanitizeSyncRunIdForPath(options?.syncRunId);
+  const runBackup = path.join(
+    String(homedir || ''),
+    '.config',
+    'opencode',
+    OPENCODE_CONFIG_SYNC_BACKUP_DIR,
+    syncRunId,
+  );
+  const st = await fsp.stat(runBackup);
+  if (!st.isDirectory()) {
+    throw new Error('Local sync finalize missing backup generation');
+  }
+  return { ok: true };
+};
+
+/**
+ * Extract a tar.gz buffer into a destination directory.
+ * @param {Buffer} buffer
+ * @param {string} destinationDir
+ */
+export const extractTarGzBuffer = (buffer, destinationDir) => new Promise((resolve, reject) => {
+  fs.mkdirSync(destinationDir, { recursive: true });
+  const child = spawn('tar', ['-xzf', '-', '-C', destinationDir], {
+    stdio: ['pipe', 'ignore', 'pipe'],
+    ...(process.platform === 'win32' ? { windowsHide: true } : {}),
+  });
+  let stderr = '';
+  child.stderr?.on('data', (chunk) => {
+    stderr += chunk.toString();
+  });
+  child.on('error', reject);
+  child.on('close', (code) => {
+    if (code !== 0) {
+      reject(new Error((stderr || 'Local tar extract failed').trim()));
+      return;
+    }
+    resolve();
+  });
+  child.stdin?.end(buffer);
+});

package/server/lib/config-sync/plan.js

@@ -0,0 +1,318 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import {
+  OPENCODE_CONFIG_SYNC_ALLOWLIST,
+  OPENCODE_CONFIG_SYNC_MAX_BYTES,
+  OPENCODE_CONFIG_SYNC_MAX_FILES,
+  SYNC_DIRECTION_PUSH,
+  SYNC_DIRECTIONS,
+} from './constants.js';
+import { filterPlanBySelections, normalizeSyncSelections } from './selections.js';
+
+/**
+ * Walk an allowlist directory with symlink dereference (fs.stat), cycle-guard, excludeNames, and `.backup` skip.
+ * @param {string} absPath
+ * @param {Set<string>} excludeNames
+ * @param {Set<string>} seenRealpaths
+ * @returns {{ fileCount: number, bytes: number }}
+ */
+export const walkAllowlistDirectory = (absPath, excludeNames, seenRealpaths) => {
+  let real;
+  try {
+    real = fs.realpathSync(absPath);
+  } catch {
+    return { fileCount: 0, bytes: 0 };
+  }
+  if (seenRealpaths.has(real)) return { fileCount: 0, bytes: 0 };
+  seenRealpaths.add(real);
+
+  let fileCount = 0;
+  let bytes = 0;
+  let names;
+  try {
+    names = fs.readdirSync(absPath);
+  } catch {
+    return { fileCount: 0, bytes: 0 };
+  }
+
+  for (const name of names) {
+    if (excludeNames.has(name) || name === 'node_modules') continue;
+    if (/\.backup$/.test(name)) continue;
+    const childAbs = path.join(absPath, name);
+    let st;
+    try {
+      st = fs.statSync(childAbs);
+    } catch {
+      // Broken symlink or unreadable entry — skip.
+      continue;
+    }
+    if (st.isDirectory()) {
+      const nested = walkAllowlistDirectory(childAbs, excludeNames, seenRealpaths);
+      fileCount += nested.fileCount;
+      bytes += nested.bytes;
+    } else if (st.isFile()) {
+      fileCount += 1;
+      bytes += st.size;
+    }
+  }
+  return { fileCount, bytes };
+};
+
+/**
+ * Pure planner: source-home allowlist + optional `~/.agents` + optional provider auth.json.
+ * Plan is computed on the source side; executors run it on the target side.
+ * `direction` is a first-class field (`push` today; `pull` reuses the same shape).
+ *
+ * @param {string} sourceHomedir
+ * @param {{
+ *   direction?: 'push' | 'pull',
+ *   syncRunId?: string,
+ *   sourceTargetId?: string,
+ *   targetId?: string,
+ *   includeAuthFile?: boolean,
+ *   selections?: import('./selections.js').SyncSelections,
+ * }} [options]
+ * @returns {{
+ *   direction: 'push' | 'pull',
+ *   syncRunId?: string,
+ *   sourceTargetId?: string,
+ *   targetId?: string,
+ *   files: { path: string, bytes: number }[],
+ *   directories: { path: string, fileCount: number, bytes: number }[],
+ *   agentsRoot: { fileCount: number, bytes: number } | null,
+ *   authFile: { bytes: number } | null,
+ *   deletes: string[],
+ *   totalBytes: number,
+ *   selections?: import('./selections.js').SyncSelections,
+ * }}
+ */
+export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
+  const home = String(sourceHomedir || '');
+  const direction = options.direction || SYNC_DIRECTION_PUSH;
+  if (!SYNC_DIRECTIONS.includes(direction)) {
+    throw new Error(`Unsupported sync direction: ${String(direction)}`);
+  }
+  // Credential transfer requires an explicit per-target grant (ticket 03).
+  // Callers that have not authorized the target pass includeAuthFile: false so
+  // auth.json is skipped rather than failing the whole sync.
+  const selections = options.selections
+    ? normalizeSyncSelections(options.selections, { includeAuthFile: options.selections.authFile === true })
+    : null;
+  const includeAuthFile = selections
+    ? selections.authFile === true
+    : options.includeAuthFile !== false;
+
+  const root = path.join(home, '.config', 'opencode');
+  /** @type {{ path: string, bytes: number }[]} */
+  const files = [];
+  /** @type {{ path: string, fileCount: number, bytes: number }[]} */
+  const directories = [];
+  /** @type {string[]} */
+  const deletes = [];
+  let totalBytes = 0;
+  let totalFileCount = 0;
+
+  for (const group of OPENCODE_CONFIG_SYNC_ALLOWLIST.fileGroups) {
+    let winner = null;
+    for (const member of group) {
+      const abs = path.join(root, member);
+      let st;
+      try {
+        st = fs.statSync(abs);
+      } catch {
+        continue;
+      }
+      if (!st.isFile()) continue;
+      winner = { path: member, bytes: st.size };
+      break;
+    }
+    if (!winner) continue;
+    files.push(winner);
+    totalBytes += winner.bytes;
+    totalFileCount += 1;
+    for (const member of group) {
+      if (member !== winner.path) deletes.push(member);
+    }
+  }
+
+  for (const name of OPENCODE_CONFIG_SYNC_ALLOWLIST.singleFiles) {
+    const abs = path.join(root, name);
+    let st;
+    try {
+      st = fs.statSync(abs);
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    files.push({ path: name, bytes: st.size });
+    totalBytes += st.size;
+    totalFileCount += 1;
+  }
+
+  for (const dirSpec of OPENCODE_CONFIG_SYNC_ALLOWLIST.directories) {
+    const abs = path.join(root, dirSpec.path);
+    let st;
+    try {
+      st = fs.statSync(abs);
+    } catch {
+      continue;
+    }
+    if (!st.isDirectory()) continue;
+    const excludeNames = new Set(Array.isArray(dirSpec.excludeNames) ? dirSpec.excludeNames : []);
+    const walked = walkAllowlistDirectory(abs, excludeNames, new Set());
+    directories.push({
+      path: dirSpec.path,
+      fileCount: walked.fileCount,
+      bytes: walked.bytes,
+    });
+    totalBytes += walked.bytes;
+    totalFileCount += walked.fileCount;
+    deletes.push(dirSpec.path);
+    if (typeof dirSpec.legacy === 'string' && dirSpec.legacy) {
+      deletes.push(dirSpec.legacy);
+    }
+  }
+
+  /** @type {{ fileCount: number, bytes: number } | null} */
+  let agentsRoot = null;
+  const agentsAbs = path.join(home, '.agents');
+  let agentsStat;
+  try {
+    agentsStat = fs.statSync(agentsAbs);
+  } catch {
+    agentsStat = null;
+  }
+  if (agentsStat?.isDirectory()) {
+    const walked = walkAllowlistDirectory(agentsAbs, new Set(), new Set());
+    agentsRoot = { fileCount: walked.fileCount, bytes: walked.bytes };
+    totalBytes += walked.bytes;
+    totalFileCount += walked.fileCount;
+  }
+
+  /** @type {{ bytes: number } | null} */
+  let authFile = null;
+  if (includeAuthFile) {
+    const authAbs = path.join(home, '.local', 'share', 'opencode', 'auth.json');
+    let authStat;
+    try {
+      // fs.stat follows symlinks (auth.json is sometimes a symlink).
+      authStat = fs.statSync(authAbs);
+    } catch {
+      authStat = null;
+    }
+    if (authStat?.isFile()) {
+      authFile = { bytes: authStat.size };
+      totalBytes += authStat.size;
+      // Single credential file — does not count against the 20000 file-count cap.
+    }
+  }
+
+  if (totalBytes > OPENCODE_CONFIG_SYNC_MAX_BYTES || totalFileCount > OPENCODE_CONFIG_SYNC_MAX_FILES) {
+    throw new Error('OpenCode config sync exceeds size limit (512MB)');
+  }
+
+  const full = {
+    direction,
+    ...(typeof options.syncRunId === 'string' && options.syncRunId ? { syncRunId: options.syncRunId } : {}),
+    ...(typeof options.sourceTargetId === 'string' && options.sourceTargetId
+      ? { sourceTargetId: options.sourceTargetId }
+      : {}),
+    ...(typeof options.targetId === 'string' && options.targetId ? { targetId: options.targetId } : {}),
+    files,
+    directories,
+    agentsRoot,
+    authFile,
+    deletes,
+    totalBytes,
+  };
+  return selections ? filterPlanBySelections(full, selections) : full;
+};
+
+/**
+ * Build a pull plan from a remote inventory payload (no local filesystem walk).
+ * @param {object} inventory
+ * @param {{
+ *   direction?: 'pull',
+ *   syncRunId?: string,
+ *   sourceTargetId?: string,
+ *   targetId?: string,
+ *   includeAuthFile?: boolean,
+ *   selections?: import('./selections.js').SyncSelections,
+ * }} [options]
+ */
+export const planOpenCodeConfigSyncFromInventory = (inventory, options = {}) => {
+  const direction = options.direction || 'pull';
+  if (!SYNC_DIRECTIONS.includes(direction)) {
+    throw new Error(`Unsupported sync direction: ${String(direction)}`);
+  }
+  const selections = options.selections
+    ? normalizeSyncSelections(options.selections, { includeAuthFile: options.selections.authFile === true })
+    : null;
+  const includeAuthFile = selections
+    ? selections.authFile === true
+    : options.includeAuthFile !== false;
+
+  const files = Array.isArray(inventory?.files) ? inventory.files.filter((entry) => entry?.path) : [];
+  const directories = Array.isArray(inventory?.directories)
+    ? inventory.directories.filter((entry) => entry?.path)
+    : [];
+  const agentsRoot = inventory?.agentsRoot && typeof inventory.agentsRoot === 'object'
+    ? inventory.agentsRoot
+    : null;
+  const authFile = includeAuthFile && inventory?.authFile && typeof inventory.authFile === 'object'
+    ? inventory.authFile
+    : null;
+
+  /** @type {string[]} */
+  const deletes = [];
+  for (const group of OPENCODE_CONFIG_SYNC_ALLOWLIST.fileGroups) {
+    const winner = files.find((entry) => group.includes(entry.path));
+    if (!winner) continue;
+    for (const member of group) {
+      if (member !== winner.path) deletes.push(member);
+    }
+  }
+  for (const dir of directories) {
+    deletes.push(dir.path);
+    const spec = OPENCODE_CONFIG_SYNC_ALLOWLIST.directories.find((entry) => entry.path === dir.path);
+    if (typeof spec?.legacy === 'string' && spec.legacy) deletes.push(spec.legacy);
+  }
+
+  let totalBytes = 0;
+  let totalFileCount = 0;
+  for (const entry of files) {
+    totalBytes += Number(entry.bytes) || 0;
+    totalFileCount += 1;
+  }
+  for (const entry of directories) {
+    totalBytes += Number(entry.bytes) || 0;
+    totalFileCount += Number(entry.fileCount) || 0;
+  }
+  if (agentsRoot) {
+    totalBytes += Number(agentsRoot.bytes) || 0;
+    totalFileCount += Number(agentsRoot.fileCount) || 0;
+  }
+  if (authFile) {
+    totalBytes += Number(authFile.bytes) || 0;
+  }
+  if (totalBytes > OPENCODE_CONFIG_SYNC_MAX_BYTES || totalFileCount > OPENCODE_CONFIG_SYNC_MAX_FILES) {
+    throw new Error('OpenCode config sync exceeds size limit (512MB)');
+  }
+
+  const full = {
+    direction,
+    ...(typeof options.syncRunId === 'string' && options.syncRunId ? { syncRunId: options.syncRunId } : {}),
+    ...(typeof options.sourceTargetId === 'string' && options.sourceTargetId
+      ? { sourceTargetId: options.sourceTargetId }
+      : {}),
+    ...(typeof options.targetId === 'string' && options.targetId ? { targetId: options.targetId } : {}),
+    files,
+    directories,
+    agentsRoot,
+    authFile,
+    deletes,
+    totalBytes,
+  };
+  return selections ? filterPlanBySelections(full, selections) : full;
+};