@openchambery/web 1.19.22-beta.1 → 2.0.0-beta.3

package/server/lib/opencode/server-opencode-fetch.js

@@ -0,0 +1,242 @@
+/**
+ * Host-side OpenCode transport boundary (ticket 11).
+ *
+ * Proxy gates browser → OpenChamber → OpenCode. Background Host work
+ * (queue / goal / scheduled / assistants / session-title) often calls OpenCode
+ * directly and must share the same execution admission: verified contract only
+ * for writes; diagnostics, reads, and stop-task stay available.
+ */
+
+import {
+  runtimeContractExecutionBlockedBody,
+  shouldBlockRuntimeContractExecution,
+} from './runtime-contract.js';
+
+/** @type {(() => (object | null | undefined)) | null} */
+let registeredGetRuntimeContract = null;
+
+/** @type {{ allowMissingContract?: boolean }} */
+let registeredGateOptions = {};
+
+/**
+ * Wire once from the composition root so makeOpenCodeV2Client + serverOpenCodeFetch
+ * share the live lifecycle contract without each caller threading deps.
+ *
+ * Production must not pass `allowMissingContract: true` — missing contract blocks
+ * writes. Unit/DI factories may opt in when no lifecycle is configured.
+ * @param {(() => (object | null | undefined)) | null} getter
+ * @param {{ allowMissingContract?: boolean }} [options]
+ */
+export function configureServerOpenCodeFetchGate(getter, options = {}) {
+  registeredGetRuntimeContract = typeof getter === 'function' ? getter : null;
+  registeredGateOptions = {
+    allowMissingContract: options?.allowMissingContract === true,
+  };
+}
+
+export function getRegisteredRuntimeContract() {
+  try {
+    return registeredGetRuntimeContract ? registeredGetRuntimeContract() : null;
+  } catch {
+    return null;
+  }
+}
+
+export function getRegisteredRuntimeContractGateOptions() {
+  return { ...registeredGateOptions };
+}
+
+/**
+ * @param {string | URL | Request} input
+ * @param {RequestInit | undefined} init
+ * @returns {{ method: string, pathWithQuery: string }}
+ */
+export function resolveFetchMethodAndPath(input, init) {
+  const method = String(
+    (init && typeof init.method === 'string' && init.method)
+    || (typeof Request !== 'undefined' && input instanceof Request && input.method)
+    || 'GET',
+  ).toUpperCase();
+
+  let urlString = '';
+  if (typeof input === 'string') {
+    urlString = input;
+  } else if (typeof URL !== 'undefined' && input instanceof URL) {
+    urlString = input.toString();
+  } else if (typeof Request !== 'undefined' && input instanceof Request) {
+    urlString = input.url;
+  } else {
+    urlString = String(input || '');
+  }
+
+  let pathWithQuery = urlString;
+  try {
+    const parsed = new URL(urlString, 'http://opencode.local');
+    pathWithQuery = `${parsed.pathname}${parsed.search || ''}`;
+  } catch {
+    const stripped = urlString.replace(/^https?:\/\/[^/]+/i, '');
+    pathWithQuery = stripped.startsWith('/') ? stripped : `/${stripped}`;
+  }
+
+  return { method, pathWithQuery };
+}
+
+/**
+ * @param {{
+ *   getRuntimeContract?: (() => (object | null | undefined)) | null,
+ *   method: string,
+ *   pathWithQuery: string,
+ *   allowMissingContract?: boolean,
+ * }} input
+ */
+export function assertServerOpenCodeExecutionAllowed(input) {
+  const getter = input.getRuntimeContract || registeredGetRuntimeContract;
+  let contract = null;
+  try {
+    contract = typeof getter === 'function' ? getter() : null;
+  } catch {
+    contract = null;
+  }
+  const allowMissingContract = typeof input.allowMissingContract === 'boolean'
+    ? input.allowMissingContract
+    : registeredGateOptions.allowMissingContract === true;
+  if (!shouldBlockRuntimeContractExecution(input.method, input.pathWithQuery, contract, {
+    allowMissingContract,
+  })) {
+    return null;
+  }
+  return runtimeContractExecutionBlockedBody(contract);
+}
+
+/**
+ * Wrap fetch so host OpenCode SDK clients share proxy write admission.
+ * @param {typeof fetch} [fetchImpl]
+ * @param {{
+ *   getRuntimeContract?: () => (object | null | undefined),
+ *   allowMissingContract?: boolean,
+ * }} [options]
+ * @returns {typeof fetch}
+ */
+export function wrapFetchWithRuntimeContractGate(fetchImpl = fetch, options = {}) {
+  const getRuntimeContract = options.getRuntimeContract || (() => getRegisteredRuntimeContract());
+  const allowMissingContract = typeof options.allowMissingContract === 'boolean'
+    ? options.allowMissingContract
+    : registeredGateOptions.allowMissingContract === true;
+
+  return async (input, init) => {
+    const { method, pathWithQuery } = resolveFetchMethodAndPath(input, init);
+    const blocked = assertServerOpenCodeExecutionAllowed({
+      getRuntimeContract,
+      method,
+      pathWithQuery,
+      allowMissingContract,
+    });
+    if (blocked) {
+      return new Response(JSON.stringify(blocked), {
+        status: 409,
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      });
+    }
+    return fetchImpl(input, init);
+  };
+}
+
+/**
+ * High-level Host OpenCode JSON helper used by goal / title and tests.
+ * @param {{
+ *   buildOpenCodeUrl: (pathname: string, prefix?: string) => string,
+ *   getOpenCodeAuthHeaders: () => Record<string, string>,
+ *   getRuntimeContract?: () => (object | null | undefined),
+ *   allowMissingContract?: boolean,
+ *   fetchImpl?: typeof fetch,
+ * }} deps
+ */
+export function createServerOpenCodeFetch(deps) {
+  const {
+    buildOpenCodeUrl,
+    getOpenCodeAuthHeaders,
+    getRuntimeContract = () => getRegisteredRuntimeContract(),
+    allowMissingContract,
+    fetchImpl = fetch,
+  } = deps;
+
+  const gatedFetch = wrapFetchWithRuntimeContractGate(fetchImpl, {
+    getRuntimeContract,
+    allowMissingContract,
+  });
+
+  /**
+   * @param {string} fetchPath
+   * @param {{
+   *   directory?: string | null,
+   *   method?: string,
+   *   body?: unknown,
+   *   query?: Record<string, string> | URLSearchParams | null,
+   *   signal?: AbortSignal,
+   *   timeoutMs?: number,
+   * }} [options]
+   */
+  const serverOpenCodeFetch = async (fetchPath, options = {}) => {
+    const method = String(options.method || 'GET').toUpperCase();
+    const base = buildOpenCodeUrl(fetchPath, '');
+    const params = new URLSearchParams(options.query || {});
+    if (options.directory) params.set('directory', options.directory);
+    const search = params.toString();
+    const url = search ? `${base}${base.includes('?') ? '&' : '?'}${search}` : base;
+
+    const pathOnly = String(fetchPath || '').split('?')[0] || '';
+    const blocked = assertServerOpenCodeExecutionAllowed({
+      getRuntimeContract,
+      method,
+      pathWithQuery: pathOnly,
+      allowMissingContract,
+    });
+    if (blocked) {
+      const error = new Error(blocked.error);
+      error.code = blocked.errorCode;
+      error.status = 409;
+      error.body = blocked;
+      throw error;
+    }
+
+    const signal = options.signal
+      || (typeof options.timeoutMs === 'number' && options.timeoutMs > 0
+        ? AbortSignal.timeout(options.timeoutMs)
+        : undefined);
+
+    const response = await gatedFetch(url, {
+      method,
+      headers: {
+        Accept: 'application/json',
+        ...(options.body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+        ...getOpenCodeAuthHeaders(),
+      },
+      ...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
+      ...(signal ? { signal } : {}),
+    });
+
+    if (!response.ok) {
+      let body = null;
+      try {
+        body = await response.json();
+      } catch {
+        body = null;
+      }
+      if (body && body.errorCode === 'RUNTIME_CONTRACT_EXECUTION_BLOCKED') {
+        const error = new Error(body.error || 'OpenCode runtime contract blocked execution');
+        error.code = body.errorCode;
+        error.status = response.status;
+        error.body = body;
+        throw error;
+      }
+      const error = new Error(`OpenCode ${method} ${fetchPath} failed with ${response.status}`);
+      error.status = response.status;
+      error.body = body;
+      throw error;
+    }
+
+    return response.json().catch(() => null);
+  };
+
+  return serverOpenCodeFetch;
+}

package/server/lib/opencode/server-opencode-fetch.test.js

@@ -0,0 +1,130 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  assertServerOpenCodeExecutionAllowed,
+  configureServerOpenCodeFetchGate,
+  createServerOpenCodeFetch,
+  resolveFetchMethodAndPath,
+  wrapFetchWithRuntimeContractGate,
+} from './server-opencode-fetch.js';
+import { makeOpenCodeV2Client } from './v2-client.js';
+
+describe('serverOpenCodeFetch transport gate (ticket 11)', () => {
+  afterEach(() => {
+    configureServerOpenCodeFetchGate(null);
+  });
+
+  it('resolves method and path from URL strings', () => {
+    expect(resolveFetchMethodAndPath('http://127.0.0.1:4096/session/ses_1/prompt', { method: 'POST' }))
+      .toEqual({ method: 'POST', pathWithQuery: '/session/ses_1/prompt' });
+  });
+
+  it('blocks write execution when contract denies, keeps reads and stop-task', () => {
+    const contract = {
+      executionAllowed: false,
+      phase: 'ready-unverified',
+      reasons: ['unverified-newer'],
+      serveVersion: '2.1.0',
+      minVerifiedVersion: '2.0.12',
+      maxVerifiedVersion: '2.0.14',
+    };
+
+    expect(assertServerOpenCodeExecutionAllowed({
+      getRuntimeContract: () => contract,
+      method: 'POST',
+      pathWithQuery: '/session/ses_1/prompt_async',
+    })?.errorCode).toBe('RUNTIME_CONTRACT_EXECUTION_BLOCKED');
+
+    expect(assertServerOpenCodeExecutionAllowed({
+      getRuntimeContract: () => contract,
+      method: 'GET',
+      pathWithQuery: '/session/ses_1/message',
+    })).toBeNull();
+
+    expect(assertServerOpenCodeExecutionAllowed({
+      getRuntimeContract: () => contract,
+      method: 'POST',
+      pathWithQuery: '/session/ses_1/interrupt',
+    })).toBeNull();
+  });
+
+  it('production default blocks Host writes when contract is missing', () => {
+    expect(assertServerOpenCodeExecutionAllowed({
+      getRuntimeContract: () => null,
+      method: 'POST',
+      pathWithQuery: '/session/ses_1/prompt',
+    })?.errorCode).toBe('RUNTIME_CONTRACT_EXECUTION_BLOCKED');
+
+    expect(assertServerOpenCodeExecutionAllowed({
+      getRuntimeContract: () => null,
+      method: 'POST',
+      pathWithQuery: '/session/ses_1/prompt',
+      allowMissingContract: true,
+    })).toBeNull();
+  });
+
+  it('wrapFetch returns 409 JSON without calling upstream on blocked writes', async () => {
+    const upstream = vi.fn(async () => new Response('ok'));
+    configureServerOpenCodeFetchGate(() => ({
+      executionAllowed: false,
+      phase: 'incompatible',
+      reasons: ['below-min-verified'],
+      serveVersion: '2.0.5',
+      minVerifiedVersion: '2.0.12',
+    }));
+    const gated = wrapFetchWithRuntimeContractGate(upstream);
+    const response = await gated('http://opencode.test/session/ses_1/prompt', { method: 'POST', body: '{}' });
+    expect(response.status).toBe(409);
+    const body = await response.json();
+    expect(body.errorCode).toBe('RUNTIME_CONTRACT_EXECUTION_BLOCKED');
+    expect(upstream).not.toHaveBeenCalled();
+  });
+
+  it('createServerOpenCodeFetch throws structured error on blocked prompt', async () => {
+    const fetchImpl = vi.fn();
+    const serverOpenCodeFetch = createServerOpenCodeFetch({
+      buildOpenCodeUrl: (pathname) => `http://opencode.test${pathname}`,
+      getOpenCodeAuthHeaders: () => ({}),
+      getRuntimeContract: () => ({
+        executionAllowed: false,
+        phase: 'ready-unverified',
+        reasons: ['unverified-newer'],
+        serveVersion: '2.1.0',
+      }),
+      fetchImpl,
+    });
+
+    await expect(serverOpenCodeFetch('/session/ses_1/prompt_async', {
+      method: 'POST',
+      body: { parts: [] },
+    })).rejects.toMatchObject({
+      code: 'RUNTIME_CONTRACT_EXECUTION_BLOCKED',
+      status: 409,
+    });
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('makeOpenCodeV2Client uses gated fetch so host SDK cannot bypass admission', async () => {
+    const upstream = vi.fn(async () => new Response(JSON.stringify({ ok: true }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+    configureServerOpenCodeFetchGate(() => ({
+      executionAllowed: false,
+      phase: 'incompatible',
+      reasons: ['below-min-verified'],
+      serveVersion: '2.0.1',
+    }));
+
+    // Client construction must not throw; gate applies on network.
+    const client = makeOpenCodeV2Client({
+      baseUrl: 'http://opencode.test',
+      fetchImpl: upstream,
+    });
+    expect(client).toBeTruthy();
+
+    const gated = wrapFetchWithRuntimeContractGate(upstream);
+    const blocked = await gated('http://opencode.test/session', { method: 'POST', body: '{}' });
+    expect(blocked.status).toBe(409);
+    expect(upstream).not.toHaveBeenCalled();
+  });
+});

package/server/lib/opencode/server-utils-runtime.js

@@ -1,5 +1,10 @@
 import { registerOpenCodeProxy } from './proxy.js';
 import { pathLooksUserConfigured, mergePathValues } from './path-utils.js';
+import {
+  configureServerOpenCodeFetchGate,
+  createServerOpenCodeFetch,
+  wrapFetchWithRuntimeContractGate,
+} from './server-opencode-fetch.js';
 
 export const createServerUtilsRuntime = (dependencies) => {
   const {
@@ -21,8 +26,31 @@ export const createServerUtilsRuntime = (dependencies) => {
     setOpenCodeNotReadySince,
     clearLastOpenCodeError,
     getLoginShellPath,
+    getStoredSessionMetadata = null,
+    getStoredSessionMetadataSync = null,
+    ensureSessionMetadataReady = null,
+    onSessionDeleted = null,
   } = dependencies;
 
+  const getRuntimeContract = () => {
+    try {
+      return getRuntime()?.runtimeContract ?? null;
+    } catch {
+      return null;
+    }
+  };
+
+  // Shared Host transport gate for SDK clients + raw serverOpenCodeFetch.
+  configureServerOpenCodeFetchGate(getRuntimeContract);
+
+  const serverOpenCodeFetch = createServerOpenCodeFetch({
+    buildOpenCodeUrl,
+    getOpenCodeAuthHeaders,
+    getRuntimeContract,
+  });
+
+  const gatedOpenCodeFetchImpl = wrapFetchWithRuntimeContractGate(fetch, { getRuntimeContract });
+
   const setOpenCodePort = (port) => {
     if (!Number.isFinite(port) || port <= 0) {
       return;
@@ -215,6 +243,10 @@ export const createServerUtilsRuntime = (dependencies) => {
       getUiNotificationClients,
       onInteractiveSessionRequest: options.onInteractiveSessionRequest,
       onSessionTurnAdmission: options.onSessionTurnAdmission,
+      getStoredSessionMetadata,
+      getStoredSessionMetadataSync,
+      ensureSessionMetadataReady,
+      onSessionDeleted,
     });
   };
 
@@ -228,5 +260,8 @@ export const createServerUtilsRuntime = (dependencies) => {
     fetchProvidersSnapshot,
     fetchModelsSnapshot,
     setupProxy,
+    serverOpenCodeFetch,
+    gatedOpenCodeFetchImpl,
+    getRuntimeContract,
   };
 };

package/server/lib/opencode/shared-service.integration.test.js

@@ -0,0 +1,66 @@
+import { expect, test } from 'vitest';
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { createSharedOpenCodeService, isProcessAlive } from './shared-service.js';
+
+// Opt-in real service, with isolated registration, config and database. No model calls.
+test.skipIf(!process.env.OPENCHAMBER_TEST_OPENCODE_BINARY)('shared service survives its launcher, is reused, and can be replaced explicitly', async () => {
+  const temporary = path.join(os.tmpdir(), 'opencode');
+  await fs.mkdir(temporary, { recursive: true });
+  const root = await fs.mkdtemp(path.join(temporary, 'shared-service-'));
+  const config = path.join(root, 'config', 'opencode');
+  await fs.mkdir(config, { recursive: true });
+  const listener = net.createServer();
+  await new Promise((resolve) => listener.listen(0, '127.0.0.1', resolve));
+  const port = listener.address().port;
+  await new Promise((resolve) => listener.close(resolve));
+  await fs.writeFile(path.join(config, 'service.json'), JSON.stringify({ hostname: '127.0.0.1', port }));
+  const env = {
+    PATH: process.env.PATH,
+    HOME: root,
+    TMPDIR: os.tmpdir(),
+    XDG_CONFIG_HOME: path.join(root, 'config'),
+    XDG_DATA_HOME: path.join(root, 'data'),
+    XDG_STATE_HOME: path.join(root, 'state'),
+    XDG_CACHE_HOME: path.join(root, 'cache'),
+    OPENCODE_CONFIG_DIR: config,
+    OPENCODE_DISABLE_MODELS_FETCH: '1',
+  };
+  const binary = process.env.OPENCHAMBER_TEST_OPENCODE_BINARY;
+  const service = createSharedOpenCodeService({
+    envLike: env,
+    spawnImpl: (command, args, options) => spawn(command, args, { ...options, cwd: root }),
+  });
+  const probe = async (registration) => {
+    const response = await fetch(`${registration.origin}/api/info`, {
+      headers: { Authorization: `Basic ${Buffer.from(`opencode:${registration.password}`).toString('base64')}` },
+      signal: AbortSignal.timeout(5000),
+    });
+    expect(response.ok).toBe(true);
+    return response.json();
+  };
+  try {
+    await service.start({ binary, env });
+    const first = await service.readRegistration();
+    expect(first?.pid).toBeGreaterThan(0);
+    expect(isProcessAlive(first.pid)).toBe(true);
+    expect((await probe(first)).version).toBe(first.version);
+
+    await service.start({ binary, env });
+    const reused = await service.readRegistration();
+    expect(reused.pid).toBe(first.pid);
+
+    await service.start({ binary, env, replace: true });
+    const replacement = await service.readRegistration();
+    expect(replacement.pid).not.toBe(first.pid);
+    expect(isProcessAlive(first.pid)).toBe(false);
+    expect((await probe(replacement)).version).toBe(replacement.version);
+  } finally {
+    await promisify(execFile)(binary, ['service', 'stop'], { env, cwd: root, timeout: 20_000, windowsHide: true });
+    await fs.rm(root, { recursive: true, force: true });
+  }
+}, 120_000);

package/server/lib/opencode/shared-service.js

@@ -0,0 +1,147 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+// Official OpenCode background service (`opencode serve --service`). Every
+// official client on this machine — TUI, CLI, Desktop — finds it through one
+// registration file and shares its process, database, and config watchers, so
+// providers connected or plugins changed elsewhere are live here too.
+
+const SERVICE_START_TIMEOUT_MS = 45_000;
+
+/** Stable-channel registration file (`latest`/`beta`/`next`/`dev` share it). */
+export const resolveSharedServiceRegistrationPath = (envLike = process.env, homeDir = os.homedir()) => {
+  const stateHome = typeof envLike.XDG_STATE_HOME === 'string' && envLike.XDG_STATE_HOME.trim()
+    ? envLike.XDG_STATE_HOME.trim()
+    : path.join(homeDir, '.local', 'state');
+  return path.join(stateHome, 'opencode', 'service.json');
+};
+
+/** `OPENCHAMBER_OPENCODE_SHARED_SERVICE=0` opts back into a private managed `opencode serve`. */
+export const isSharedServiceEnabled = (envLike = process.env) => {
+  const raw = String(envLike.OPENCHAMBER_OPENCODE_SHARED_SERVICE ?? '').trim().toLowerCase();
+  return raw !== '0' && raw !== 'false' && raw !== 'off';
+};
+
+/** @returns {{ origin: string, port: number, pid: number | null, password: string | null, version: string | null } | null} */
+export const parseSharedServiceRegistration = (text) => {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== 'object' || typeof value.url !== 'string') return null;
+  let url;
+  try {
+    url = new URL(value.url);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+  const port = Number.parseInt(url.port, 10);
+  if (!Number.isInteger(port) || port <= 0) return null;
+  return {
+    origin: url.origin,
+    port,
+    pid: Number.isInteger(value.pid) && value.pid > 0 ? value.pid : null,
+    password: typeof value.password === 'string' && value.password.trim() ? value.password.trim() : null,
+    version: typeof value.version === 'string' ? value.version : null,
+  };
+};
+
+export const readSharedServiceRegistration = async ({ file = resolveSharedServiceRegistrationPath(), fsLike = fs } = {}) => {
+  const text = await fsLike.readFile(file, 'utf8').catch(() => null);
+  return text == null ? null : parseSharedServiceRegistration(text);
+};
+
+/**
+ * Environment inherited by a service OpenChamber starts. The service outlives
+ * OpenChamber and passes its env to every tool, so OpenChamber credentials
+ * (`OPENCHAMBER_*`, the managed-serve password) never travel with it; the
+ * service owns its own persistent password.
+ */
+export const buildSharedServiceStartEnv = (baseEnv = {}) => {
+  const env = {};
+  for (const [key, value] of Object.entries(baseEnv)) {
+    if (typeof value !== 'string') continue;
+    if (key.startsWith('OPENCHAMBER_')) continue;
+    if (key === 'OPENCODE_SERVER_PASSWORD' || key === 'OPENCODE_PASSWORD') continue;
+    env[key] = value;
+  }
+  return env;
+};
+
+/**
+ * `opencode service start` reuses a healthy compatible service or spawns a
+ * detached one, then exits once it is ready. Normal recovery does not replace
+ * a healthy service; explicit upgrades use `service restart` with the target.
+ */
+export const startSharedOpenCodeService = ({
+  binary,
+  args = [],
+  env,
+  spawnImpl = spawn,
+  timeoutMs = SERVICE_START_TIMEOUT_MS,
+  replace = false,
+}) => new Promise((resolve, reject) => {
+  const action = replace ? 'restart' : 'start';
+  const child = spawnImpl(binary, [...args, 'service', action], {
+    env,
+    stdio: ['ignore', 'ignore', 'pipe'],
+    windowsHide: true,
+  });
+  let stderr = '';
+  let settled = false;
+  const finish = (error) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    if (error) reject(error);
+    else resolve();
+  };
+  const timer = setTimeout(() => {
+    try {
+      child.kill('SIGTERM');
+    } catch {
+    }
+    finish(new Error(`Timed out waiting for \`opencode service ${action}\``));
+  }, timeoutMs);
+  child.stderr?.on('data', (chunk) => {
+    stderr = (stderr + chunk.toString()).slice(-2000);
+  });
+  child.once('error', (error) => finish(error));
+  child.once('exit', (code) => {
+    if (code === 0) {
+      finish(null);
+      return;
+    }
+    const detail = stderr.trim();
+    finish(new Error(`\`opencode service ${action}\` exited with code ${code}${detail ? `: ${detail}` : ''}`));
+  });
+});
+
+export const isProcessAlive = (pid) => {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+};
+
+export const createSharedOpenCodeService = ({
+  envLike = process.env,
+  fsLike = fs,
+  spawnImpl = spawn,
+} = {}) => {
+  const file = resolveSharedServiceRegistrationPath(envLike);
+  return {
+    registrationFile: file,
+    buildStartEnv: buildSharedServiceStartEnv,
+    start: ({ binary, args, env, replace }) => startSharedOpenCodeService({ binary, args, env, replace, spawnImpl }),
+    readRegistration: () => readSharedServiceRegistration({ file, fsLike }),
+  };
+};