@openchambery/web 2.0.0-beta.26 → 2.0.0-beta.28

package/server/lib/opencode/config-entity-routes.test.js

@@ -38,12 +38,6 @@ const createDependencies = (getCommandSources, configDirectory, getAgentSources
   createMcpConfig: vi.fn(),
   updateMcpConfig: vi.fn(),
   deleteMcpConfig: vi.fn(),
-  listSnippets: vi.fn(),
-  getSnippet: vi.fn(),
-  createSnippet: vi.fn(),
-  updateSnippet: vi.fn(),
-  deleteSnippet: vi.fn(),
-  expandSnippets: vi.fn(),
   configDirectory,
   buildOpenCodeUrl: () => 'http://opencode-upstream:4096/',
   getOpenCodeAuthHeaders: () => ({ Authorization: 'Basic example' }),
@@ -459,6 +453,8 @@ describe('config entity agent metadata route', () => {
 });
 
 describe('global raw configuration routes', () => {
+  beforeEach(() => vi.stubEnv('OPENCODE_CONFIG', ''));
+  afterEach(() => vi.unstubAllEnvs());
   it('reads and validates the configured OpenCode and oh-my-opencode files', async () => {
     const app = express();
     app.use(express.json());
@@ -503,7 +499,7 @@ describe('global raw configuration routes', () => {
     await fs.rm(configDirectory, { recursive: true, force: true });
   });
 
-  it('discovers only existing configuration targets and prefers JSON files', async () => {
+  it('discovers only existing targets and edits the winning global JSONC document', async () => {
     const app = express();
     app.use(express.json());
     const configDirectory = await fs.mkdtemp(path.join(os.tmpdir(), 'openchamber-global-config-'));
@@ -516,20 +512,20 @@ describe('global raw configuration routes', () => {
     const available = await request(app).get('/api/config/global').expect(200);
     expect(available.body).toEqual({
       targets: [
-        { target: 'opencode', fileName: 'opencode.json' },
+        { target: 'opencode', fileName: 'opencode.jsonc' },
         { target: 'oh-my-openagent', fileName: 'oh-my-openagent.jsonc' },
       ],
     });
 
     const openCode = await request(app).get('/api/config/global/opencode').expect(200);
-    expect(openCode.body).toMatchObject({ fileName: 'opencode.json', content: '{ "model": "json-model" }' });
+    expect(openCode.body).toMatchObject({ fileName: 'opencode.jsonc', content: '{ "model": "jsonc-model" }' });
 
     await request(app)
       .put('/api/config/global/opencode')
       .send({ content: '{ "model": "updated-json-model" }' })
       .expect(200);
-    expect(await fs.readFile(path.join(configDirectory, 'opencode.json'), 'utf8')).toContain('updated-json-model');
-    expect(await fs.readFile(path.join(configDirectory, 'opencode.jsonc'), 'utf8')).toContain('jsonc-model');
+    expect(await fs.readFile(path.join(configDirectory, 'opencode.json'), 'utf8')).toContain('json-model');
+    expect(await fs.readFile(path.join(configDirectory, 'opencode.jsonc'), 'utf8')).toContain('updated-json-model');
 
     await fs.rm(configDirectory, { recursive: true, force: true });
   });

package/server/lib/opencode/config-files.d.ts

@@ -0,0 +1,17 @@
+export type ConfigObject = Record<string, unknown>;
+export type ConfigDocument = { path: string; scope: 'user' | 'project' | 'custom'; config: ConfigObject };
+export type ConfigLayers = {
+  userConfig: ConfigObject; projectConfig: ConfigObject; customConfig: ConfigObject; mergedConfig: ConfigObject;
+  userLayers: ConfigDocument[]; projectLayers: ConfigDocument[]; documents: ConfigDocument[];
+  paths: { userPath: string; projectPath: string | null; customPath: string | null };
+};
+export function getGlobalConfigDirectory(): string;
+export function isPlainObject(value: unknown): value is ConfigObject;
+export function readConfigFile(filePath?: string | null): ConfigObject;
+export function readConfigLayers(workingDirectory?: string): ConfigLayers;
+export function readConfig(workingDirectory?: string): ConfigObject;
+export function getConfigForPath(layers: ConfigLayers, targetPath?: string | null): ConfigObject;
+export function getJsonEntrySource(layers: ConfigLayers, sectionKey: string, entryName: string): { section: unknown; config: ConfigObject | null; path: string | null; exists: boolean };
+export function getJsonWriteTarget(layers: ConfigLayers, preferredScope: string): { config: ConfigObject; path: string };
+export function writeConfig(config: ConfigObject, filePath?: string): void;
+export function writeConfigText(content: string, filePath: string): void;

package/server/lib/opencode/config-files.js

@@ -0,0 +1,187 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { parse, parseTree, findNodeAtLocation, createScanner, SyntaxKind, modify, applyEdits } from 'jsonc-parser';
+
+export const getGlobalConfigDirectory = () => process.env.OPENCODE_CONFIG_DIR
+  ? path.resolve(process.env.OPENCODE_CONFIG_DIR)
+  : path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'opencode');
+export const isPlainObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+function parseConfigObject(content, filePath) {
+  const errors = [];
+  const value = parse(content.replace(/^\uFEFF/, ''), errors, { allowTrailingComma: true, allowEmptyContent: true });
+  if (errors.length || (value !== undefined && !isPlainObject(value))) {
+    throw Object.assign(new Error(`Invalid JSONC configuration: ${filePath}`), { code: 'INVALID_JSONC' });
+  }
+  return value ?? {};
+}
+
+function readText(filePath) {
+  try {
+    return fs.readFileSync(filePath, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+export function readConfigFile(filePath) {
+  if (!filePath) return {};
+  const text = readText(filePath);
+  return text === null ? {} : parseConfigObject(text, filePath);
+}
+
+function mergeConfigs(base, override) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    Object.defineProperty(result, key, {
+      value: isPlainObject(result[key]) && isPlainObject(value) ? mergeConfigs(result[key], value) : value,
+      enumerable: true, configurable: true, writable: true,
+    });
+  }
+  return result;
+}
+
+const names = ['opencode.json', 'opencode.jsonc'];
+
+export function readConfigLayers(workingDirectory) {
+  const directory = getGlobalConfigDirectory();
+  const userPaths = names.map((name) => path.join(directory, name));
+  const customPath = process.env.OPENCODE_CONFIG ? path.resolve(process.env.OPENCODE_CONFIG) : null;
+  const ancestors = [];
+  if (workingDirectory && path.resolve(workingDirectory) !== path.resolve(directory)) {
+    let current = path.resolve(workingDirectory);
+    while (true) {
+      ancestors.unshift(current);
+      const parent = path.dirname(current);
+      if (parent === current) break;
+      current = parent;
+    }
+  }
+  const projectPaths = [
+    ...ancestors.flatMap((dir) => names.map((name) => path.join(dir, name))),
+    ...ancestors.flatMap((dir) => names.map((name) => path.join(dir, '.opencode', name))),
+  ].filter((filePath) => !userPaths.includes(filePath));
+  const load = (paths, scope) => paths.flatMap((filePath) => {
+    const text = readText(filePath);
+    return text === null ? [] : [{ path: filePath, scope, config: parseConfigObject(text, filePath) }];
+  });
+  const userLayers = load(userPaths, 'user');
+  const projectLayers = load(projectPaths, 'project');
+  const customConfig = readConfigFile(customPath);
+  const documents = [...userLayers, ...(customPath ? [{ path: customPath, scope: 'custom', config: customConfig }] : []), ...projectLayers];
+  const merge = (layers) => layers.reduce((config, layer) => mergeConfigs(config, layer.config), {});
+  return {
+    userConfig: merge(userLayers), projectConfig: merge(projectLayers), customConfig,
+    mergedConfig: merge(documents), userLayers, projectLayers, documents,
+    paths: {
+      userPath: userLayers.at(-1)?.path ?? path.join(directory, 'opencode.jsonc'),
+      projectPath: projectLayers.at(-1)?.path ?? (workingDirectory ? path.join(workingDirectory, '.opencode', 'opencode.jsonc') : null),
+      customPath,
+    },
+  };
+}
+
+export const readConfig = (workingDirectory) => readConfigLayers(workingDirectory).mergedConfig;
+
+export function getConfigForPath(layers, targetPath) {
+  const filePath = targetPath || layers.paths.userPath;
+  return layers.documents.findLast((layer) => layer.path === filePath)?.config ?? readConfigFile(filePath);
+}
+
+export function getJsonEntrySource(layers, sectionKey, entryName) {
+  for (const layer of layers.documents.toReversed()) {
+    const section = layer.config?.[sectionKey]?.[entryName];
+    if (section !== undefined) return { section, config: layer.config, path: layer.path, exists: true };
+  }
+  return { section: null, config: null, path: null, exists: false };
+}
+
+export function getJsonWriteTarget(layers, preferredScope) {
+  const filePath = preferredScope === 'project' && layers.paths.projectPath
+    ? layers.paths.projectPath : layers.paths.customPath || layers.paths.userPath;
+  return { config: getConfigForPath(layers, filePath), path: filePath };
+}
+
+function removalEdits(text, propertyPath) {
+  const node = findNodeAtLocation(parseTree(text), propertyPath)?.parent;
+  const parent = node?.parent;
+  if (!node || parent?.type !== 'object') throw new Error('Cannot locate configuration property');
+  const siblings = parent.children;
+  const index = siblings.indexOf(node);
+  const end = node.offset + node.length;
+  const scanner = createScanner(text, true);
+  const comma = (start, stop) => {
+    scanner.setPosition(start);
+    return scanner.scan() === SyntaxKind.CommaToken && scanner.getTokenOffset() < stop ? scanner.getTokenOffset() : -1;
+  };
+  let separator = comma(end, siblings[index + 1]?.offset ?? parent.offset + parent.length - 1);
+  if (separator < 0) {
+    const previous = siblings[index - 1];
+    separator = comma(previous ? previous.offset + previous.length : parent.offset + 1, node.offset);
+  }
+  return [{ offset: node.offset, length: node.length, content: '' }, ...(separator < 0 ? [] : [{ offset: separator, length: 1, content: '' }])];
+}
+
+function editConfig(existing, desired, filePath) {
+  const current = parseConfigObject(existing, filePath);
+  const bom = existing.startsWith('\uFEFF') ? '\uFEFF' : '';
+  let text = existing.slice(bom.length);
+  if (!parseTree(text)) return `${existing}${existing && !existing.endsWith('\n') ? '\n' : ''}${JSON.stringify(desired, null, 2)}\n`;
+  const indentation = text.match(/\n([\t ]+)"/)?.[1] ?? '  ';
+  const formattingOptions = { insertSpaces: !indentation.includes('\t'), tabSize: indentation.length, eol: text.includes('\r\n') ? '\r\n' : '\n' };
+  const visit = (before, after, keys) => {
+    if (isDeepStrictEqual(before, after)) return;
+    if (isPlainObject(before) && isPlainObject(after)) {
+      for (const key of Object.keys(before)) {
+        if (!Object.hasOwn(after, key)) text = applyEdits(text, removalEdits(text, [...keys, key]));
+      }
+      for (const key of Object.keys(after)) visit(before[key], after[key], [...keys, key]);
+    } else {
+      text = applyEdits(text, modify(text, keys, after, { formattingOptions }));
+    }
+  };
+  visit(current, desired, []);
+  if (!isDeepStrictEqual(parseConfigObject(text, filePath), desired)) throw new Error('Configuration edit did not round-trip');
+  return bom + text;
+}
+
+// Shared by structured entity edits and the raw editor; failure never truncates the original.
+export function writeConfigText(content, filePath) {
+  parseConfigObject(content, filePath);
+  let exists = false;
+  try {
+    fs.lstatSync(filePath);
+    exists = true;
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  // Resolve before staging: rename must replace the dotfile target, not its link.
+  // lstat distinguishes new files from dangling links, whose realpath must fail.
+  const targetPath = exists ? fs.realpathSync(filePath) : filePath;
+  const original = readText(targetPath);
+  if (original !== null) parseConfigObject(original, filePath);
+  if (content === original) return;
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+  const temporaryPath = `${targetPath}.${randomUUID()}.tmp`;
+  try {
+    const mode = original === null ? 0o600 : fs.statSync(targetPath).mode & 0o777;
+    fs.writeFileSync(temporaryPath, content, { encoding: 'utf8', flag: 'wx', mode });
+    if (original !== null) {
+      fs.chmodSync(temporaryPath, mode);
+      fs.copyFileSync(targetPath, `${filePath}.openchamber.backup`);
+    }
+    fs.renameSync(temporaryPath, targetPath);
+  } finally {
+    fs.rmSync(temporaryPath, { force: true });
+  }
+}
+
+export function writeConfig(config, filePath = path.join(getGlobalConfigDirectory(), 'opencode.jsonc')) {
+  const desired = JSON.parse(JSON.stringify(config));
+  if (!isPlainObject(desired)) throw new Error('Configuration must be an object');
+  writeConfigText(editConfig(readText(filePath) ?? '', desired, filePath), filePath);
+}

package/server/lib/opencode/config-files.test.js

@@ -0,0 +1,201 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readConfigFile, readConfigLayers, getConfigForPath, getJsonEntrySource, getJsonWriteTarget, writeConfig, writeConfigText } from './config-files.js';
+
+let root;
+let globalDir;
+const put = (file, text) => {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, text);
+  return file;
+};
+beforeEach(() => {
+  root = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-config-files-'));
+  globalDir = path.join(root, 'xdg', 'opencode');
+  vi.stubEnv('XDG_CONFIG_HOME', path.dirname(globalDir));
+  vi.stubEnv('OPENCODE_CONFIG', '');
+  vi.stubEnv('OPENCODE_CONFIG_DIR', '');
+});
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllEnvs();
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+describe('physical configuration layers', () => {
+  it('resolves an explicit global directory at call time', () => {
+    const customDirectory = path.join(root, 'custom-directory');
+    put(path.join(customDirectory, 'opencode.jsonc'), '{"model":"custom-directory"}');
+    vi.stubEnv('OPENCODE_CONFIG_DIR', customDirectory);
+    expect(readConfigLayers().mergedConfig).toEqual({ model: 'custom-directory' });
+    expect(getJsonWriteTarget(readConfigLayers(), 'user').path).toBe(path.join(customDirectory, 'opencode.jsonc'));
+  });
+  it('merges both global documents and keeps each write target unmerged', () => {
+    const json = put(path.join(globalDir, 'opencode.json'), '{"model":"base","agent":{"base":{"model":"a"},"shared":{"model":"base","description":"kept"}}}');
+    const jsonc = put(path.join(globalDir, 'opencode.jsonc'), '{ // override\n "model":"override","agent":{"shared":{"model":"override"}},}');
+    put(path.join(globalDir, 'config.json'), '{"model":"legacy-not-loaded-by-v2"}');
+    const layers = readConfigLayers();
+    expect(layers.mergedConfig).toEqual({ model: 'override', agent: { base: { model: 'a' }, shared: { model: 'override', description: 'kept' } } });
+    expect(getJsonEntrySource(layers, 'agent', 'base').path).toBe(json);
+    expect(getJsonEntrySource(layers, 'agent', 'shared').path).toBe(jsonc);
+    expect(getConfigForPath(layers, jsonc)).toEqual({ model: 'override', agent: { shared: { model: 'override' } } });
+    expect(getJsonWriteTarget(layers, 'user').path).toBe(jsonc);
+  });
+
+  it('loads explicit config above global and below discovered project documents', () => {
+    put(path.join(globalDir, 'opencode.json'), '{"model":"global","global":true}');
+    const custom = put(path.join(root, 'custom.jsonc'), '{"model":"explicit","explicit":true}');
+    vi.stubEnv('OPENCODE_CONFIG', custom);
+    const workspace = path.join(root, 'workspace');
+    const nested = path.join(workspace, 'nested');
+    put(path.join(workspace, 'opencode.json'), '{"model":"parent","parent":true}');
+    put(path.join(nested, 'opencode.jsonc'), '{"model":"child"}');
+    put(path.join(workspace, '.opencode', 'opencode.json'), '{"model":"supplementary"}');
+    const layers = readConfigLayers(nested);
+    expect(layers.mergedConfig).toEqual({ model: 'supplementary', global: true, explicit: true, parent: true });
+    expect(getJsonWriteTarget(layers, 'user').path).toBe(custom);
+    expect(getJsonWriteTarget(layers, 'project').path).toBe(path.join(workspace, '.opencode', 'opencode.json'));
+    vi.stubEnv('OPENCODE_CONFIG', '');
+    expect(readConfigLayers().mergedConfig).toEqual({ model: 'global', global: true });
+  });
+
+  it.each(['opencode.json', 'opencode.jsonc'])('reads a single %s and treats missing, blank and comments-only documents explicitly as empty', (name) => {
+    expect(readConfigLayers().mergedConfig).toEqual({});
+    const file = put(path.join(globalDir, name), ' \n');
+    expect(readConfigLayers().mergedConfig).toEqual({});
+    put(file, '// empty config\n/* documented */');
+    expect(readConfigLayers().mergedConfig).toEqual({});
+    put(file, '{"model":"one"}');
+    expect(readConfigLayers().mergedConfig).toEqual({ model: 'one' });
+    expect(getJsonWriteTarget(readConfigLayers(), 'user').path).toBe(file);
+  });
+
+  it.each(['{"model":', '{"model":"x", broken}', '[]', 'null', 'plain text'])('rejects malformed/non-object content %s without changing it', (text) => {
+    const file = put(path.join(globalDir, 'opencode.jsonc'), text);
+    expect(() => readConfigLayers()).toThrow('Invalid JSONC');
+    expect(() => writeConfig({ model: 'new' }, file)).toThrow('Invalid JSONC');
+    expect(() => writeConfigText('{}', file)).toThrow('Invalid JSONC');
+    expect(fs.readFileSync(file, 'utf8')).toBe(text);
+    expect(fs.existsSync(`${file}.openchamber.backup`)).toBe(false);
+  });
+
+  it('propagates read failures instead of returning empty success', () => {
+    const original = fs.readFileSync;
+    vi.spyOn(fs, 'readFileSync').mockImplementation((file, ...args) => {
+      if (String(file) === path.join(globalDir, 'opencode.json')) throw Object.assign(new Error('denied'), { code: 'EACCES' });
+      return original(file, ...args);
+    });
+    expect(() => readConfigLayers()).toThrow('denied');
+  });
+});
+
+describe('structural JSONC writes', () => {
+  it.each(['absolute', 'relative'])('preserves a %s dotfiles symlink while updating its target, permissions and backup', (kind) => {
+    const original = '{ // dotfiles comment\n "model":"old"\n}';
+    const target = put(path.join(root, 'dotfiles', 'config.jsonc'), original);
+    fs.chmodSync(target, 0o664);
+    fs.mkdirSync(globalDir, { recursive: true });
+    const file = path.join(globalDir, 'opencode.jsonc');
+    const link = kind === 'relative' ? path.relative(globalDir, target) : target;
+    fs.symlinkSync(link, file);
+
+    writeConfig({ model: 'new' }, file);
+    expect(fs.lstatSync(file).isSymbolicLink()).toBe(true);
+    expect(fs.readlinkSync(file)).toBe(link);
+    expect(readConfigFile(target)).toEqual({ model: 'new' });
+    expect(fs.readFileSync(target, 'utf8')).toContain('// dotfiles comment');
+    expect(fs.statSync(target).mode & 0o777).toBe(0o664);
+    expect(fs.readFileSync(`${file}.openchamber.backup`, 'utf8')).toBe(original);
+    expect(fs.existsSync(`${target}.openchamber.backup`)).toBe(false);
+
+    const structured = fs.readFileSync(target, 'utf8');
+    writeConfigText('{"model":"raw"}', file);
+    expect(fs.readlinkSync(file)).toBe(link);
+    expect(readConfigFile(target)).toEqual({ model: 'raw' });
+    expect(fs.statSync(target).mode & 0o777).toBe(0o664);
+    expect(fs.readFileSync(`${file}.openchamber.backup`, 'utf8')).toBe(structured);
+  });
+
+  it.each(['writeFileSync', 'chmodSync', 'copyFileSync', 'renameSync'])('preserves a symlink and its original target when %s fails', (method) => {
+    const original = '{ // retained\n "model":"old"\n}';
+    const target = put(path.join(root, 'dotfiles', 'config.jsonc'), original);
+    fs.chmodSync(target, 0o640);
+    fs.mkdirSync(globalDir, { recursive: true });
+    const file = path.join(globalDir, 'opencode.jsonc');
+    const link = path.relative(globalDir, target);
+    fs.symlinkSync(link, file);
+    vi.spyOn(fs, method).mockImplementation(() => { throw new Error('simulated IO failure'); });
+    expect(() => writeConfig({ model: 'new' }, file)).toThrow('simulated IO failure');
+    expect(fs.readlinkSync(file)).toBe(link);
+    expect(fs.readFileSync(target, 'utf8')).toBe(original);
+    expect(fs.statSync(target).mode & 0o777).toBe(0o640);
+    for (const dir of [globalDir, path.dirname(target)]) {
+      expect(fs.readdirSync(dir).some((name) => name.endsWith('.tmp'))).toBe(false);
+    }
+  });
+
+  it.each(['structured', 'raw'])('rejects a dangling symlink during a %s write without replacing it', (kind) => {
+    fs.mkdirSync(globalDir, { recursive: true });
+    const file = path.join(globalDir, 'opencode.jsonc');
+    const link = '../../dotfiles/missing.jsonc';
+    fs.symlinkSync(link, file);
+    const write = () => kind === 'structured' ? writeConfig({ model: 'new' }, file) : writeConfigText('{}', file);
+    expect(write).toThrow(expect.objectContaining({ code: 'ENOENT' }));
+    expect(fs.readlinkSync(file)).toBe(link);
+    expect(fs.existsSync(path.resolve(globalDir, link))).toBe(false);
+    expect(fs.readdirSync(globalDir)).toEqual(['opencode.jsonc']);
+  });
+
+  it('edits nested values, adds fields and removes fields without losing surrounding comments or unrelated bytes', () => {
+    const original = '\uFEFF{\r\n\t// model comment\r\n\t"model": "old",\r\n\t"agent": {"review": {/* owned */ "model":"old", "remove":true, /* trailing */}},\r\n\t// unrelated field\r\n\t"unrelated" : [ 1, 2 ], // leave alone\r\n}\r\n';
+    const file = put(path.join(globalDir, 'opencode.jsonc'), original);
+    const config = readConfigFile(file);
+    config.model = 'new';
+    config.agent.review.model = 'new';
+    delete config.agent.review.remove;
+    config.agent.review.description = 'added';
+    writeConfig(config, file);
+    const saved = fs.readFileSync(file, 'utf8');
+    expect(readConfigFile(file)).toEqual(config);
+    for (const comment of ['// model comment', '/* owned */', '/* trailing */', '// unrelated field', '// leave alone']) expect(saved).toContain(comment);
+    expect(saved).toContain('\t"unrelated" : [ 1, 2 ], // leave alone\r\n');
+    expect(saved.startsWith('\uFEFF')).toBe(true);
+    expect(fs.readFileSync(`${file}.openchamber.backup`, 'utf8')).toBe(original);
+    writeConfig(config, file);
+    expect(fs.readFileSync(file, 'utf8')).toBe(saved);
+    expect(fs.readFileSync(`${file}.openchamber.backup`, 'utf8')).toBe(original);
+  });
+
+  it.each([
+    '{/* before */ "only":1, /* after , */}',
+    '{"keep":2, /* before */ "only":1 /* after */}',
+    '{/* before */ "only":1, /* after */ "keep":2}',
+  ])('removes a property and its comma from %s', (text) => {
+    const file = put(path.join(globalDir, 'opencode.jsonc'), text);
+    const desired = readConfigFile(file);
+    delete desired.only;
+    writeConfig(desired, file);
+    expect(readConfigFile(file)).toEqual(desired);
+    expect(fs.readFileSync(file, 'utf8')).toContain('/* before */');
+    expect(fs.readFileSync(file, 'utf8')).toContain('/* after');
+  });
+
+  it.each(['', '// notes without newline', '{"old":1}'])('supports new/empty/comment-only/JSON files (%s)', (text) => {
+    const file = path.join(globalDir, 'opencode.json');
+    if (text) put(file, text);
+    writeConfig({ model: 'new', nested: { enabled: true } }, file);
+    expect(readConfigFile(file)).toEqual({ model: 'new', nested: { enabled: true } });
+    if (text.startsWith('//')) expect(fs.readFileSync(file, 'utf8')).toContain(text);
+  });
+
+  it.each(['writeFileSync', 'copyFileSync', 'renameSync'])('keeps original content and cleans temporary files when %s fails', (method) => {
+    const original = '{ // retained\n "model":"old"\n}';
+    const file = put(path.join(globalDir, 'opencode.jsonc'), original);
+    vi.spyOn(fs, method).mockImplementation(() => { throw new Error('simulated IO failure'); });
+    expect(() => writeConfig({ model: 'new' }, file)).toThrow('simulated IO failure');
+    expect(fs.readFileSync(file, 'utf8')).toBe(original);
+    expect(fs.readdirSync(globalDir).some((name) => name.endsWith('.tmp'))).toBe(false);
+  });
+});

package/server/lib/opencode/core-routes.js

@@ -1179,7 +1179,6 @@ export const registerCommonRequestMiddleware = (app, dependencies) => {
       req.path.startsWith('/api/config/commands') ||
       req.path.startsWith('/api/config/global') ||
       req.path.startsWith('/api/config/mcp') ||
-      req.path.startsWith('/api/config/snippets') ||
       req.path.startsWith('/api/config/settings') ||
       req.path.startsWith('/api/config/skills') ||
       req.path.startsWith('/api/config/plugins') ||

package/server/lib/opencode/core-routes.test.js

@@ -310,21 +310,6 @@ describe('core-routes', () => {
     expect(dependencies.gracefulShutdown).not.toHaveBeenCalled();
   });
 
-  it('should parse JSON bodies for snippet config routes', async () => {
-    const app = express();
-    registerCommonRequestMiddleware(app, { express });
-    app.post('/api/config/snippets/example', (req, res) => {
-      res.json({ body: req.body });
-    });
-
-    const response = await request(app)
-      .post('/api/config/snippets/example')
-      .send({ content: 'Snippet body' })
-      .expect(200);
-
-    expect(response.body).toEqual({ body: { content: 'Snippet body' } });
-  });
-
   // Global raw config saves send { content: "<jsonc string>" }. Without this
   // prefix in the JSON middleware allowlist, PUT arrives with an empty body and
   // the handler rejects with "Configuration content must be a string".

package/server/lib/opencode/credential-boundary.d.ts

@@ -0,0 +1 @@
+export function isSensitiveCredentialResponse(method: string, requestPath: string): boolean;

package/server/lib/opencode/credential-boundary.js

@@ -0,0 +1,11 @@
+/** Credential list/create replies contain raw keys in v2. Keep them host-only. */
+export function isSensitiveCredentialResponse(method, requestPath) {
+  let pathname;
+  try {
+    pathname = decodeURIComponent(new URL(requestPath, 'http://openchamber.invalid').pathname).replace(/\/+$/, '').toLowerCase();
+  } catch {
+    return true;
+  }
+  const root = pathname === '/credential' || pathname === '/api/credential';
+  return root && ['GET', 'HEAD', 'POST'].includes(String(method).toUpperCase());
+}

package/server/lib/opencode/ensure-cli.js

@@ -233,6 +233,9 @@ export async function ensurePinnedOpenCode2Cli(input = {}) {
   }
 
   const installedPath = await install({ ...input, version: pin });
-  const version = readVersion(installedPath) || pin;
+  const version = readVersion(installedPath);
+  if (version !== pin) {
+    throw new Error(`Installed OpenCode version mismatch: expected ${pin}, got ${version || 'unknown'}`);
+  }
   return { path: installedPath, version, source: 'installed', installed: true };
 }

package/server/lib/opencode/env-config.js

@@ -33,7 +33,10 @@ export const resolveOpenCodeEnvConfig = (options = {}) => {
       warnInvalidHost(`must use http or https scheme (got ${JSON.stringify(url.protocol)})`);
       return null;
     }
-    const port = parseInt(url.port, 10);
+    // WHATWG URL removes explicit default ports; inspect the authority before normalization.
+    const authority = raw.match(/^https?:\/\/([^/?#]+)/i)?.[1] ?? '';
+    const explicitPort = authority.match(/:(\d+)$/)?.[1];
+    const port = parseInt(url.port || explicitPort || '', 10);
     if (!Number.isFinite(port) || port <= 0) {
       warnInvalidHost('must include an explicit port (example: http://hostname:4096)');
       return null;

package/server/lib/opencode/env-config.test.js

@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from 'vitest';
+import { resolveOpenCodeEnvConfig } from './env-config.js';
+
+describe('explicit OpenCode host ports', () => {
+  it.each([
+    ['http://example.test:80', 'http://example.test', 80],
+    ['https://example.test:443/', 'https://example.test', 443],
+    ['http://[::1]:80', 'http://[::1]', 80],
+    ['https://[::1]:443', 'https://[::1]', 443],
+    ['http://[::1]:4096', 'http://[::1]:4096', 4096],
+    ['https://example.test:80', 'https://example.test:80', 80],
+  ])('preserves the effective port of %s', (host, origin, port) => {
+    const config = resolveOpenCodeEnvConfig({ env: { OPENCODE_HOST: host, OPENCODE_PORT: '1234' } });
+    expect(config.configuredOpenCodeHost).toEqual({ origin, port });
+    expect(config.effectivePort).toBe(port);
+    expect(new URL('/api/info', config.configuredOpenCodeHost.origin).href).toBe(`${origin}/api/info`);
+  });
+
+  it.each(['http://example.test', 'https://example.test', 'http://[::1]', 'http://example.test:',
+    'ftp://example.test:80', 'http://example.test:80/path', 'http://example.test:80?q=1',
+    'http://example.test:80#hash', 'http://example.test:0', 'http://example.test:65536', 'invalid'])('retains rejection of %s', (host) => {
+    const logger = { warn: vi.fn() };
+    const config = resolveOpenCodeEnvConfig({ env: { OPENCODE_HOST: host, OPENCODE_PORT: '1234' }, logger });
+    expect(config.configuredOpenCodeHost).toBeNull();
+    expect(config.effectivePort).toBe(1234);
+    expect(logger.warn).toHaveBeenCalledOnce();
+  });
+});

package/server/lib/opencode/env-runtime.test.js

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
 import { createOpenCodeEnvRuntime } from './env-runtime.js';
+import { PINNED_OPENCODE2_VERSION } from './opencode2-pin.js';
 
 const originalOpencodeBinary = process.env.OPENCODE_BINARY;
 const originalComSpec = process.env.ComSpec;
@@ -305,7 +306,7 @@ describe('OpenCode env runtime', () => {
 
   it('discovers a previously installed pin from the OpenChamber data dir', () => {
     const dataDir = createTempDir('openchamber-installed-cli-');
-    const installedDir = path.join(dataDir, 'opencode-cli', '2.0.12');
+    const installedDir = path.join(dataDir, 'opencode-cli', PINNED_OPENCODE2_VERSION);
     const installedBinary = path.join(installedDir, process.platform === 'win32' ? 'opencode.exe' : 'opencode');
     fs.mkdirSync(installedDir, { recursive: true });
     fs.writeFileSync(installedBinary, '#!/bin/sh\nexit 0\n');

package/server/lib/opencode/feature-routes-runtime.js

@@ -5,6 +5,8 @@ import { registerSessionGoalRoutes } from '../session-goal/routes.js';
 import { registerSessionMetadataRoutes } from '../session-metadata/routes.js';
 import { registerGitHubRoutes } from '../github/routes.js';
 import { registerGitRoutes } from '../git/routes.js';
+import { makeOpenCodeV2Client } from './v2-client.js';
+import { releaseDeletedWorktreeLocation } from './location-release.js';
 import { registerMagicPromptRoutes } from '../magic-prompts/routes.js';
 import { registerSessionFoldersRoutes } from '../session-folders/routes.js';
 import { registerPermissionAutoAcceptRoutes } from '../permission-auto-accept/runtime.js';
@@ -31,7 +33,6 @@ import { getProviderSources, removeProviderConfig } from './providers.js';
 import { getAgentSources, getAgentConfig, listDisabledAgentOverrides, createAgent, updateAgent, deleteAgent } from './agents.js';
 import { getCommandSources, createCommand, updateCommand, deleteCommand } from './commands.js';
 import { listMcpConfigs, getMcpConfig, createMcpConfig, updateMcpConfig, deleteMcpConfig } from './mcp.js';
-import { listSnippets, getSnippet, createSnippet, updateSnippet, deleteSnippet, expandSnippets } from './snippets.js';
 import {
   listPluginEntries,
   getPluginEntry,
@@ -359,12 +360,6 @@ export const createFeatureRoutesRuntime = (dependencies) => {
       createMcpConfig,
       updateMcpConfig,
       deleteMcpConfig,
-      listSnippets,
-      getSnippet,
-      createSnippet,
-      updateSnippet,
-      deleteSnippet,
-      expandSnippets,
     });
 
     registerPluginRoutes(app, {
@@ -492,6 +487,13 @@ export const createFeatureRoutesRuntime = (dependencies) => {
     registerGitRoutes(app, {
       messageQueueService,
       broadcastWorktreeTopologyChanged,
+      releaseWorktreeLocation: (directory) => releaseDeletedWorktreeLocation({
+        directory,
+        getClient: () => makeOpenCodeV2Client({
+          baseUrl: buildOpenCodeUrl('/', '').replace(/\/$/, ''),
+          authHeaders: getOpenCodeAuthHeaders(),
+        }),
+      }),
     });
     registerMagicPromptRoutes(app, {
       fsPromises,

package/server/lib/opencode/hmr-state-runtime.js

@@ -35,9 +35,9 @@ export const createHmrStateRuntime = (dependencies) => {
     if (typeof hmrState.userProvidedOpenCodePassword !== 'undefined') {
       return;
     }
-    const initialPassword = typeof processLike.env.OPENCODE_SERVER_PASSWORD === 'string'
-      ? processLike.env.OPENCODE_SERVER_PASSWORD.trim()
-      : '';
+    const initialPassword = processLike.env.OPENCODE_PASSWORD?.trim()
+      || processLike.env.OPENCODE_SERVER_PASSWORD?.trim()
+      || '';
     hmrState.userProvidedOpenCodePassword = initialPassword || null;
   };
 
@@ -51,7 +51,7 @@ export const createHmrStateRuntime = (dependencies) => {
     openCodeAuthPassword:
       typeof hmrState.openCodeAuthPassword === 'string' && hmrState.openCodeAuthPassword.length > 0
         ? hmrState.openCodeAuthPassword
-        : userProvidedOpenCodePassword,
+        : hmrState.openCodeAuthSource === 'shared-service' ? null : userProvidedOpenCodePassword,
     openCodeAuthSource:
       typeof hmrState.openCodeAuthSource === 'string' && hmrState.openCodeAuthSource.length > 0
         ? hmrState.openCodeAuthSource