@openchambery/web 1.19.22-beta.1 → 2.0.0-beta.3

package/server/lib/opencode/v1-migration-gate.js

@@ -0,0 +1,157 @@
+export const OPENCODE_V1_MIGRATION_PATH = '/api/experimental/migration/v1';
+
+// Backfill notes must stay readable by UI and docs. Do not drop them when the
+// gate blocks or later admits a migrated library.
+export const V1_MIGRATION_USER_NOTICE = [
+  'V1 history is backfilled in the opencode2 process.',
+  'Message ids are reused.',
+  'In-progress tools become interrupted.',
+  'V1 subtasks do not appear in v2.',
+].join(' ');
+
+const MIGRATION_PHASES = new Set(['required', 'running', 'completed', 'error']);
+
+const stringifyError = (error) => {
+  if (error instanceof Error && error.message) {
+    return error.message;
+  }
+  if (typeof error === 'string' && error.trim()) {
+    return error;
+  }
+  return 'V1 migration status request failed';
+};
+
+const blocked = (phase, extra = {}) => ({
+  admitTranscript: false,
+  phase,
+  userNotice: V1_MIGRATION_USER_NOTICE,
+  ...extra,
+});
+
+const admitted = (phase, extra = {}) => ({
+  admitTranscript: true,
+  phase,
+  ...extra,
+});
+
+const normalizeProgress = (progress) => {
+  if (!progress || typeof progress !== 'object' || Array.isArray(progress)) {
+    return undefined;
+  }
+  const result = {
+    label: typeof progress.label === 'string' ? progress.label : '',
+  };
+  if (Number.isFinite(progress.numerator) && progress.numerator >= 0) {
+    result.numerator = progress.numerator;
+  }
+  if (Number.isFinite(progress.denominator) && progress.denominator >= 0) {
+    result.denominator = progress.denominator;
+  }
+  return result;
+};
+
+const resolveHttpStatus = (input) => {
+  if (typeof input.httpStatus === 'number') {
+    return input.httpStatus;
+  }
+  if (typeof input.status === 'number') {
+    return input.status;
+  }
+  return undefined;
+};
+
+const resolveBody = (input) => {
+  if (input.body !== undefined) {
+    return input.body;
+  }
+  if (typeof input.status === 'string') {
+    return input;
+  }
+  return null;
+};
+
+const resolveTransportError = (input) => {
+  if (input instanceof Error || typeof input === 'string') {
+    return input;
+  }
+  if (input?.error instanceof Error || typeof input?.error === 'string') {
+    if (input.body === undefined && typeof input.status !== 'string') {
+      return input.error;
+    }
+  }
+  return null;
+};
+
+// Pure admission decision for GET /api/experimental/migration/v1.
+// required/running/error never become an empty-list success.
+export const evaluateV1MigrationGate = (input = {}) => {
+  if (input == null) {
+    return blocked('error', { error: 'V1 migration status is missing or invalid' });
+  }
+
+  const transportError = resolveTransportError(input);
+  if (transportError) {
+    return blocked('error', { error: stringifyError(transportError) });
+  }
+
+  const httpStatus = resolveHttpStatus(input);
+  if (httpStatus === 404) {
+    return admitted('absent');
+  }
+  if (Number.isInteger(httpStatus) && httpStatus >= 400) {
+    return blocked('error', { error: `V1 migration status HTTP ${httpStatus}` });
+  }
+
+  const body = resolveBody(input);
+  const phase = body && typeof body === 'object' ? body.status : undefined;
+
+  if (phase === 'required') {
+    return blocked('required');
+  }
+  if (phase === 'running') {
+    return blocked('running', { progress: normalizeProgress(body.progress) });
+  }
+  if (phase === 'completed') {
+    return admitted('completed', { userNotice: V1_MIGRATION_USER_NOTICE });
+  }
+  if (phase === 'error') {
+    return blocked('error', {
+      error: typeof body.error === 'string' && body.error.trim()
+        ? body.error
+        : 'V1 migration failed',
+    });
+  }
+
+  if (MIGRATION_PHASES.has(phase) === false) {
+    return blocked('error', { error: 'V1 migration status is missing or invalid' });
+  }
+
+  return blocked('error', { error: 'V1 migration status is missing or invalid' });
+};
+
+// Official protocol only publishes GET status. Backfill is owned by opencode2;
+// clients poll this helper and do not POST unless a later API requires it.
+export const fetchV1MigrationGate = async ({
+  url,
+  headers = {},
+  signal,
+  fetchImpl = globalThis.fetch,
+} = {}) => {
+  try {
+    const response = await fetchImpl(url, {
+      method: 'GET',
+      headers: {
+        Accept: 'application/json',
+        ...headers,
+      },
+      signal,
+    });
+    const body = await response.json().catch(() => null);
+    return evaluateV1MigrationGate({
+      httpStatus: response.status,
+      body,
+    });
+  } catch (error) {
+    return evaluateV1MigrationGate({ error });
+  }
+};

package/server/lib/opencode/v1-migration-gate.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import {
+  OPENCODE_V1_MIGRATION_PATH,
+  V1_MIGRATION_USER_NOTICE,
+  evaluateV1MigrationGate,
+  fetchV1MigrationGate,
+} from './v1-migration-gate.js';
+
+describe('V1 migration gate', () => {
+  it('denies transcript while V1 migration is required', () => {
+    expect(evaluateV1MigrationGate({ status: 'required' })).toMatchObject({
+      admitTranscript: false,
+      phase: 'required',
+      userNotice: V1_MIGRATION_USER_NOTICE,
+    });
+  });
+
+  it('denies transcript while V1 migration is running and keeps progress', () => {
+    expect(evaluateV1MigrationGate({
+      status: 'running',
+      progress: { label: 'Sessions', numerator: 3, denominator: 10 },
+    })).toEqual({
+      admitTranscript: false,
+      phase: 'running',
+      progress: { label: 'Sessions', numerator: 3, denominator: 10 },
+      userNotice: V1_MIGRATION_USER_NOTICE,
+    });
+  });
+
+  it('admits transcript when V1 migration is completed', () => {
+    expect(evaluateV1MigrationGate({ status: 'completed' })).toMatchObject({
+      admitTranscript: true,
+      phase: 'completed',
+    });
+  });
+
+  it('admits transcript when V1 library is absent (HTTP 404)', () => {
+    expect(evaluateV1MigrationGate({ httpStatus: 404 })).toEqual({
+      admitTranscript: true,
+      phase: 'absent',
+    });
+    expect(evaluateV1MigrationGate({ status: 404 })).toEqual({
+      admitTranscript: true,
+      phase: 'absent',
+    });
+  });
+
+  it('admits transcript when completed with no remaining work', () => {
+    expect(evaluateV1MigrationGate({
+      body: { status: 'completed' },
+      httpStatus: 200,
+    })).toMatchObject({
+      admitTranscript: true,
+      phase: 'completed',
+    });
+  });
+
+  it('denies transcript on V1 migration error instead of treating an empty list as success', () => {
+    expect(evaluateV1MigrationGate({
+      status: 'error',
+      error: 'disk full',
+    })).toEqual({
+      admitTranscript: false,
+      phase: 'error',
+      error: 'disk full',
+      userNotice: V1_MIGRATION_USER_NOTICE,
+    });
+    expect(evaluateV1MigrationGate({})).toMatchObject({
+      admitTranscript: false,
+      phase: 'error',
+    });
+  });
+
+  it('denies transcript on network failure instead of treating an empty list as success', () => {
+    expect(evaluateV1MigrationGate({ error: new Error('offline') })).toMatchObject({
+      admitTranscript: false,
+      phase: 'error',
+      error: 'offline',
+    });
+  });
+
+  it('exposes backfill userNotice for UI and docs', () => {
+    expect(V1_MIGRATION_USER_NOTICE).toContain('Message ids are reused');
+    expect(V1_MIGRATION_USER_NOTICE).toContain('interrupted');
+    expect(V1_MIGRATION_USER_NOTICE).toContain('V1 subtasks do not appear in v2');
+    expect(evaluateV1MigrationGate({ status: 'required' }).userNotice).toBe(V1_MIGRATION_USER_NOTICE);
+    expect(evaluateV1MigrationGate({ status: 'completed' }).userNotice).toBe(V1_MIGRATION_USER_NOTICE);
+  });
+
+  it('polls GET migration status and does not POST', async () => {
+    const fetchImpl = vi.fn(async () => new Response(JSON.stringify({ status: 'completed' }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+
+    await expect(fetchV1MigrationGate({
+      url: `http://127.0.0.1:4096${OPENCODE_V1_MIGRATION_PATH}`,
+      headers: { Authorization: 'Basic test' },
+      fetchImpl,
+    })).resolves.toMatchObject({
+      admitTranscript: true,
+      phase: 'completed',
+    });
+
+    expect(fetchImpl).toHaveBeenCalledTimes(1);
+    expect(fetchImpl.mock.calls[0][0]).toContain(OPENCODE_V1_MIGRATION_PATH);
+    expect(fetchImpl.mock.calls[0][1].method).toBe('GET');
+    expect(fetchImpl.mock.calls[0][1].headers.Authorization).toBe('Basic test');
+  });
+});

package/server/lib/opencode/v2-client.js

@@ -0,0 +1,60 @@
+import { OpenCode } from '@opencode/client';
+import { wrapFetchWithRuntimeContractGate } from './server-opencode-fetch.js';
+
+/**
+ * @typedef {import('@opencode/client').OpenCodeClient} OpenCodeV2ClientRaw
+ */
+
+/**
+ * Compatibility client: official 2.x nests exact message lookup under
+ * `session.message.get`, while OpenChamber callers still use
+ * `session.message(input, requestOptions)`.
+ *
+ * @typedef {Omit<OpenCodeV2ClientRaw, 'session'> & {
+ *   session: Omit<OpenCodeV2ClientRaw['session'], 'message'> & {
+ *     message: ((input: Parameters<OpenCodeV2ClientRaw['session']['message']['get']>[0], requestOptions?: Parameters<OpenCodeV2ClientRaw['session']['message']['get']>[1]) => ReturnType<OpenCodeV2ClientRaw['session']['message']['get']>)
+ *       & OpenCodeV2ClientRaw['session']['message']
+ *   }
+ * }} OpenCodeV2Client
+ */
+
+/**
+ * Create the single server-side client for official OpenCode v2 APIs.
+ * Fetch is always wrapped with runtime-contract write admission so Host
+ * background clients (queue / scheduled / assistants) cannot bypass the proxy gate.
+ *
+ * @param {{
+ *   baseUrl: string,
+ *   authHeaders?: Record<string, string>,
+ *   fetchImpl?: typeof fetch,
+ *   getRuntimeContract?: () => (object | null | undefined),
+ * }} input
+ * @returns {OpenCodeV2Client}
+ */
+export function makeOpenCodeV2Client({ baseUrl, authHeaders, fetchImpl, getRuntimeContract }) {
+  const gatedFetch = wrapFetchWithRuntimeContractGate(fetchImpl || fetch, {
+    ...(typeof getRuntimeContract === 'function' ? { getRuntimeContract } : {}),
+  });
+  const client = OpenCode.make({
+    baseUrl: baseUrl.replace(/\/$/, ''),
+    ...(authHeaders ? { headers: authHeaders } : {}),
+    fetch: gatedFetch,
+  });
+
+  const messageGet = client.session.message?.get?.bind(client.session.message);
+  if (typeof messageGet === 'function') {
+    const messageCompat = Object.assign(
+      (input, requestOptions) => messageGet(input, requestOptions),
+      client.session.message,
+    );
+    return {
+      ...client,
+      session: {
+        ...client.session,
+        message: messageCompat,
+      },
+    };
+  }
+
+  return client;
+}

package/server/lib/opencode/v2-plugin-host-shim/index.mjs

@@ -0,0 +1,155 @@
+import { readdirSync, readFileSync, statSync } from "node:fs"
+import { homedir } from "node:os"
+import path from "node:path"
+import { pathToFileURL } from "node:url"
+
+const stripJsonc = (text) => text
+  .replace(/\/\*[\s\S]*?\*\//g, "")
+  .replace(/(^|[^:\\])\/\/.*$/gm, "$1")
+
+const readConfigPlugins = () => {
+  const specs = []
+  const files = []
+  if (process.env.OPENCODE_CONFIG) files.push(process.env.OPENCODE_CONFIG)
+  const dirs = [process.env.OPENCODE_CONFIG_DIR, path.join(homedir(), ".config", "opencode")].filter(Boolean)
+  for (const dir of dirs) {
+    files.push(path.join(dir, "opencode.jsonc"), path.join(dir, "opencode.json"), path.join(dir, "config.json"))
+  }
+  for (const file of files) {
+    try {
+      const parsed = JSON.parse(stripJsonc(readFileSync(file, "utf8")))
+      const plugin = parsed?.plugin
+      const list = Array.isArray(plugin) ? plugin : plugin ? [plugin] : []
+      for (const entry of list) {
+        if (typeof entry === "string") specs.push(entry)
+        else if (Array.isArray(entry) && typeof entry[0] === "string") specs.push(entry[0])
+      }
+    } catch {
+      // Missing or invalid config files are skipped; OpenCode still loads the ones it can parse.
+    }
+  }
+  return [...new Set(specs)]
+}
+
+const packageName = (spec) => {
+  const slash = spec.startsWith("@") ? spec.indexOf("/", 1) : -1
+  const versionAt = spec.lastIndexOf("@")
+  if (versionAt > 0 && versionAt > slash) return spec.slice(0, versionAt)
+  return spec
+}
+
+const resolvePackageEntry = (spec) => {
+  const name = packageName(spec)
+  const roots = [
+    path.join(homedir(), ".cache", "opencode", "npm"),
+    path.join(homedir(), ".cache", "opencode", "packages"),
+  ]
+  const candidates = []
+  for (const root of roots) {
+    let entries = []
+    try {
+      entries = readdirSync(root)
+    } catch {
+      continue
+    }
+    for (const entry of entries) {
+      if (entry !== name && !entry.startsWith(`${name}@`)) continue
+      const base = path.join(root, entry)
+      const packageDirs = [path.join(base, "node_modules", name)]
+      try {
+        for (const child of readdirSync(base)) {
+          if (/^\d+$/.test(child)) packageDirs.push(path.join(base, child, "node_modules", name))
+        }
+      } catch {
+        // The cache entry may be the package directory itself.
+      }
+      for (const pkgDir of packageDirs) {
+        try {
+          const pkg = JSON.parse(readFileSync(path.join(pkgDir, "package.json"), "utf8"))
+          if (pkg.name !== name) continue
+          const exported = pkg.exports?.["."]
+          const rel = typeof exported === "string" ? exported : pkg.module || pkg.main || "index.mjs"
+          candidates.push({
+            dir: pkgDir,
+            entry: path.resolve(pkgDir, rel),
+            mtime: statSync(path.join(pkgDir, "package.json")).mtimeMs,
+          })
+        } catch {
+          // Not a readable package directory.
+        }
+      }
+    }
+  }
+  candidates.sort((left, right) => right.mtime - left.mtime)
+  return candidates[0] || null
+}
+
+const usesCatalog = (dir) => {
+  const stack = [dir]
+  let seen = 0
+  while (stack.length > 0 && seen < 80) {
+    const current = stack.pop()
+    let names = []
+    try {
+      names = readdirSync(current)
+    } catch {
+      continue
+    }
+    for (const name of names) {
+      if (name === "node_modules" || name === ".git") continue
+      const full = path.join(current, name)
+      let info
+      try {
+        info = statSync(full)
+      } catch {
+        continue
+      }
+      if (info.isDirectory()) {
+        stack.push(full)
+        continue
+      }
+      if (!/\.(?:mjs|cjs|js)$/.test(name) || info.size > 2_000_000) continue
+      seen += 1
+      try {
+        if (readFileSync(full, "utf8").includes(".catalog")) return true
+      } catch {
+        // Unreadable files are not catalog callers.
+      }
+    }
+  }
+  return false
+}
+
+const catalogFor = (ctx) => ({
+  // OpenCode 2.0.12 removed ctx.catalog. Model plugins still call
+  // draft.provider.update / draft.model.update inside catalog.transform.
+  transform: (fn) => ctx.provider?.transform?.((draft) => fn({
+    provider: {
+      update: (id, updater) => draft.update(id, updater),
+      add: (...args) => draft.add?.(...args),
+    },
+    model: {
+      update: (providerID, modelID, updater) => draft.models?.update?.(providerID, modelID, updater),
+      set: (providerID, modelID, value) => draft.models?.set?.(providerID, modelID, value),
+    },
+  })),
+  reload: () => ctx.provider?.reload?.() ?? ctx.model?.reload?.(),
+})
+
+export default {
+  id: "openchamber-v2-plugin-host-shim",
+  setup: async (ctx) => {
+    if (typeof ctx?.catalog?.transform === "function") return
+    const patched = { ...ctx, catalog: catalogFor(ctx) }
+    for (const spec of readConfigPlugins()) {
+      const resolved = resolvePackageEntry(spec)
+      if (!resolved || !usesCatalog(resolved.dir)) continue
+      try {
+        const mod = await import(pathToFileURL(resolved.entry).href)
+        if (typeof mod.default?.setup === "function") await mod.default.setup(patched)
+      } catch (error) {
+        console.error(`[openchamber] v2 plugin host shim skipped ${spec}: ${error instanceof Error ? error.message : String(error)}`)
+      }
+    }
+  },
+}

package/server/lib/opencode/v2-plugin-host-shim/package.json

@@ -0,0 +1,4 @@
+{
+  "type": "module",
+  "name": "openchamber-v2-plugin-host-shim"
+}

package/server/lib/opencode/watcher.js

@@ -65,7 +65,8 @@ export const createOpenCodeWatcherRuntime = (deps) => {
 
     reader = createUpstreamSseReader({
       signal,
-      buildUrl: () => buildOpenCodeUrl('/global/event', ''),
+      // v2 serves the event stream at `/api/event`; `/api/global/event` is gone.
+      buildUrl: () => buildOpenCodeUrl('/event', ''),
       getHeaders: getOpenCodeAuthHeaders,
       fetchImpl,
       stallTimeoutMs: upstreamStallTimeoutMs,

package/server/lib/opencode/watcher.test.js

@@ -74,7 +74,7 @@ describe('createOpenCodeWatcherRuntime', () => {
 
     expect(fetchCalls).toEqual([
       {
-        url: 'http://127.0.0.1:4096/global/event',
+        url: 'http://127.0.0.1:4096/event',
         headers: {
           Accept: 'text/event-stream',
           'Cache-Control': 'no-cache',

package/server/lib/permission-auto-accept/DOCUMENTATION.md

@@ -8,13 +8,13 @@ This module owns the authoritative permission auto-accept policy for web, deskto
 
 `permissionAutoAccept.sessions` contains explicit per-session boolean policies.
 
-Policy inheritance uses the nearest explicit session value. A child `false` therefore overrides a parent `true`; descendants without an explicit value inherit from their nearest configured ancestor.
+Policy inheritance uses the nearest explicit session value. A child `false` therefore overrides a parent `true`. Sessions with no explicit value, including a missing ancestor lookup, default to allow. A failed settings load still fails closed and does not approve.
 
 ## Runtime
 
-`createPermissionAutoAcceptRuntime` loads and serializes policy writes, subscribes to the global OpenCode event hub, caches session lineage, retries transient replies, and reconciles pending permissions after startup, reconnect, and policy enablement. Enabling Auto-Accept for a session immediately accepts matching pending requests and keeps handling future requests without requiring a connected UI.
+`createPermissionAutoAcceptRuntime` loads and serializes policy writes, subscribes to the global OpenCode event hub, caches session lineage, retries transient replies, and reconciles pending permissions after startup, reconnect, and policy enablement. Pending requests are listed at `GET /permission/request` and approved with `POST /session/:sessionID/permission/:requestID/reply` body `{ decision: "always" }`. OpenCode 2.0.12 rejects the legacy `{ reply }` body and the unscoped `/permission/:id/reply` path.
 
-Unknown lineage and failed policy loads fail closed. A failed pending-permission fetch is distinct from an empty successful response and never clears policy state.
+A failed settings load fails closed and does not approve. A failed pending-permission fetch is distinct from an empty successful response and never clears policy state.
 
 ## Routes
 
@@ -27,9 +27,9 @@ These are normal authenticated OpenChamber runtime routes. They must not be adde
 
 `packages/ui/src/stores/permissionStore.ts` is a projection of server policy and does not persist an independent policy. The server is the sole responder and the UI renders pending requests until the authoritative `permission.replied` event arrives.
 
-`ChatInput` derives control visibility from the persisted, directory-scoped `useConfigStore` agent snapshot. A selected agent with a final global `allow` or `deny` rule has no remaining prompt path and hides the control. Unknown snapshots, missing selected agents, and rules that can ask keep the control visible. This path issues no additional request.
+`ChatInput` derives control visibility from the persisted, directory-scoped `useConfigStore` agent snapshot via `shouldShowPermissionAutoAcceptControl`. It reads the V2 wire `permissions` field when present (OpenCode `AgentInfo.permissions`), otherwise the legacy singular `permission` document. Rule normalization reuses `toPermissionRuleset` so both V2 `{ action, resource, effect }` and V1 `{ permission, pattern, action }` / tool-map shapes are recognized. A selected agent with a final global `allow` or `deny` rule has no remaining prompt path and hides the control. Unknown snapshots, missing selected agents, unparseable rules, and rules that can still ask keep the control visible. This path issues no additional request and does not change server auto-accept policy.
 
-VS Code retains its foreground-only implementation because it does not run the web server runtime.
+VS Code retains its foreground-only implementation because it does not run the web server runtime (`isVSCodeRuntime()` always shows the control).
 
 ## Tests
 

package/server/lib/permission-auto-accept/runtime.js

@@ -123,6 +123,7 @@ export function createPermissionAutoAcceptRuntime({
 
   const isSessionAutoAccepting = async (sessionId, directory) => {
     await load();
+    if (!sessionId) return false;
     const seen = new Set();
     let current = sessionId;
     let currentDirectory = directory;
@@ -133,22 +134,23 @@ export function createPermissionAutoAcceptRuntime({
       try {
         info = await getSession(current, currentDirectory);
       } catch {
-        return false;
+        // Lineage lookup failed. No explicit deny was found, so keep the default allow.
+        return true;
       }
       current = info?.parentID ?? null;
       currentDirectory = info?.directory ?? currentDirectory;
     }
-    return false;
+    return true;
   };
 
   const replyOnce = async (permission, directory) => {
     if (!permission?.id || !permission?.sessionID) return false;
     await load();
     if (!(await isSessionAutoAccepting(permission.sessionID, directory))) return false;
-    await request(`/permission/${encodeURIComponent(permission.id)}/reply`, {
+    await request(`/session/${encodeURIComponent(permission.sessionID)}/permission/${encodeURIComponent(permission.id)}/reply`, {
       directory,
       method: 'POST',
-      body: { reply: 'once' },
+      body: { decision: 'always' },
     });
     return true;
   };
@@ -187,7 +189,7 @@ export function createPermissionAutoAcceptRuntime({
       for (const directory of scopes) {
         let payload;
         try {
-          payload = await request('/permission', { directory });
+          payload = await request('/permission/request', { directory });
         } catch {
           continue;
         }
@@ -209,12 +211,17 @@ export function createPermissionAutoAcceptRuntime({
     const raw = event?.payload;
     const payload = raw?.payload && typeof raw.payload === 'object' ? raw.payload : raw;
     const directory = typeof event?.directory === 'string' && event.directory !== 'global' ? event.directory : undefined;
+    const body = payload?.properties && typeof payload.properties === 'object'
+      ? payload.properties
+      : payload?.data && typeof payload.data === 'object'
+        ? payload.data
+        : payload;
     if (payload?.type === 'session.created' || payload?.type === 'session.updated') {
-      rememberSession(payload.properties?.info, directory);
+      rememberSession(body?.info ?? payload.properties?.info, directory);
       return;
     }
     if (payload?.type === 'permission.asked') {
-      void processPermission(payload.properties, directory);
+      void processPermission(body, directory);
     }
   };