@opencode-cloud/core 8.0.0 → 10.1.0

package/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "opencode-cloud-core"
-version = "8.0.0"
+version = "10.1.0"
 edition = "2024"
 rust-version = "1.88"
 license = "MIT"

package/README.md

@@ -196,6 +196,9 @@ occ stop
 # Restart the service
 occ restart
 
+# Check for updates and choose what to update
+occ update
+
 # Update the opencode-cloud CLI binary
 occ update cli
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencode-cloud/core",
-  "version": "8.0.0",
+  "version": "10.1.0",
   "description": "Core NAPI bindings for opencode-cloud (internal package)",
   "main": "index.js",
   "types": "index.d.ts",

package/src/docker/Dockerfile

@@ -30,9 +30,9 @@
 # -----------------------------------------------------------------------------
 
 # -----------------------------------------------------------------------------
-# Stage 1: Runtime
+# Stage 1: Base
 # -----------------------------------------------------------------------------
-FROM ubuntu:24.04 AS runtime
+FROM ubuntu:24.04 AS base
 
 # OCI Labels for image metadata
 LABEL org.opencontainers.image.title="opencode-cloud"
@@ -236,6 +236,11 @@ ENV PNPM_HOME="/home/opencode/.local/share/pnpm"
 ENV PATH="${PNPM_HOME}:${PATH}"
 RUN mkdir -p "${PNPM_HOME}"
 
+# bun - self-managing installer, trusted to handle versions
+RUN curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.5" \
+    && rm -rf /home/opencode/.bun/install/cache /home/opencode/.bun/cache /home/opencode/.cache/bun
+
+ENV PATH="/home/opencode/.bun/bin:${PATH}"
 
 # uv - self-managing installer, trusted to handle versions (fast Python package manager)
 RUN curl -LsSf https://astral.sh/uv/install.sh | sh
@@ -495,6 +500,11 @@ RUN printf '%s\n' \
 # Set up pipx path
 RUN echo 'export PATH="/home/opencode/.local/bin:$PATH"' >> /home/opencode/.zshrc
 
+# -----------------------------------------------------------------------------
+# Stage 2: opencode build
+# -----------------------------------------------------------------------------
+FROM base AS opencode-build
+
 # -----------------------------------------------------------------------------
 # opencode Setup (Fork + Broker + Proxy)
 # -----------------------------------------------------------------------------
@@ -504,11 +514,9 @@ RUN echo 'export PATH="/home/opencode/.local/bin:$PATH"' >> /home/opencode/.zshr
 # This block includes:
 # - opencode build (backend binary) + app build (frontend dist)
 # - opencode-broker build
-# - opencode web build + runtime
-# - PAM configuration + systemd services
-# - opencode config file
 #
-# NOTE: This section switches between opencode and root users as needed.
+# NOTE: This stage uses opencode user + sudo for privileged installs.
+USER opencode
 
 # -----------------------------------------------------------------------------
 # opencode Installation (Fork from pRizz/opencode)
@@ -516,18 +524,15 @@ RUN echo 'export PATH="/home/opencode/.local/bin:$PATH"' >> /home/opencode/.zshr
 # Clone the fork and build opencode from source (as non-root user)
 # Pin to specific commit for reproducibility
 # Build opencode from source (BuildKit cache mounts disabled for now)
-RUN OPENCODE_COMMIT="ecaebed0934eeda267a66226eb8c2106beaf68c8" \
+RUN OPENCODE_COMMIT="8a63844a3d3166273a83d5e94d8820d62ad82510" \
     && rm -rf /tmp/opencode-repo \
     && git clone --depth 1 https://github.com/pRizz/opencode.git /tmp/opencode-repo \
     && cd /tmp/opencode-repo \
     && git fetch --depth 1 origin "${OPENCODE_COMMIT}" \
     && git checkout "${OPENCODE_COMMIT}" \
-    && curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.5" \
-    && export PATH="/home/opencode/.bun/bin:${PATH}" \
     && bun install --frozen-lockfile \
     && cd packages/opencode \
     && bun run build-single-ui \
-    && rm -rf /home/opencode/.bun/install/cache /home/opencode/.bun/cache /home/opencode/.cache/bun \
     && cd /tmp/opencode-repo \
     && sudo mkdir -p /opt/opencode/bin /opt/opencode/ui \
     && echo "${OPENCODE_COMMIT}" | sudo tee /opt/opencode/COMMIT >/dev/null \
@@ -536,30 +541,21 @@ RUN OPENCODE_COMMIT="ecaebed0934eeda267a66226eb8c2106beaf68c8" \
     && sudo cp -R /tmp/opencode-repo/packages/opencode/dist/opencode-*/ui/. /opt/opencode/ui/ \
     && sudo chown -R opencode:opencode /opt/opencode \
     && sudo chmod +x /opt/opencode/bin/opencode \
-    && /opt/opencode/bin/opencode --version
-
-# Add opencode to PATH
-ENV PATH="/opt/opencode/bin:${PATH}"
+    && cd /tmp/opencode-repo/packages/opencode-broker \
+    && cargo build --release \
+    && sudo mkdir -p /usr/local/bin \
+    && sudo cp target/release/opencode-broker /usr/local/bin/opencode-broker \
+    && sudo chmod 4755 /usr/local/bin/opencode-broker \
+    && rm -rf /tmp/opencode-repo \
+    && rm -rf /home/opencode/.bun/install/cache /home/opencode/.bun/cache /home/opencode/.cache/bun
 
 # -----------------------------------------------------------------------------
-# opencode-broker Installation
+# Stage 3: Runtime
 # -----------------------------------------------------------------------------
-# Build opencode-broker from source (Rust service for PAM authentication)
-# The broker handles PAM authentication and user process spawning
-# NOTE: Requires root privileges for setuid bit (chmod 4755) to allow broker
-# to run with elevated privileges for PAM authentication
-USER root
-RUN cd /tmp/opencode-repo/packages/opencode-broker \
-    && runuser -u opencode -- bash -c '. /home/opencode/.cargo/env && cargo build --release' \
-    && mkdir -p /usr/local/bin \
-    && cp target/release/opencode-broker /usr/local/bin/opencode-broker \
-    && chmod 4755 /usr/local/bin/opencode-broker \
-    && rm -rf /tmp/opencode-repo
+FROM base AS runtime
 
-# Verify broker binary exists and is executable
-RUN ls -la /usr/local/bin/opencode-broker \
-    && test -x /usr/local/bin/opencode-broker \
-    && echo "Broker installed"
+# Add opencode to PATH
+ENV PATH="/opt/opencode/bin:${PATH}"
 
 # -----------------------------------------------------------------------------
 # PAM Configuration
@@ -567,6 +563,7 @@ RUN ls -la /usr/local/bin/opencode-broker \
 # Install PAM configuration for opencode authentication
 # This allows opencode to authenticate users via PAM (same users as Cockpit)
 # NOTE: Requires root privileges to write to /etc/pam.d/
+USER root
 RUN printf '%s\n' \
     '# PAM configuration for OpenCode authentication' \
     '# Install to /etc/pam.d/opencode' \
@@ -625,24 +622,11 @@ RUN printf '%s\n' \
 RUN mkdir -p /etc/systemd/system/multi-user.target.wants \
     && ln -sf /etc/systemd/system/opencode-broker.service /etc/systemd/system/multi-user.target.wants/opencode-broker.service
 
-USER opencode
-
-# -----------------------------------------------------------------------------
-# GSD Plugin Installation
-# -----------------------------------------------------------------------------
-# Install the GSD (Get Shit Done) plugin for opencode
-# Note: If this fails in container builds due to "~" path resolution, retry with
-# OPENCODE_CONFIG_DIR=/home/opencode/.config/opencode set explicitly.
-RUN mkdir -p /home/opencode/.npm \
-    && npx --yes get-shit-done-cc --opencode --global \
-    && rm -rf /home/opencode/.npm/_cacache /home/opencode/.npm/_npx
-
 # -----------------------------------------------------------------------------
 # opencode systemd Service (2026-01-22)
 # -----------------------------------------------------------------------------
 # Create opencode as a systemd service for Cockpit integration
 # NOTE: Requires root privileges to write to /etc/systemd/system/
-USER root
 RUN printf '%s\n' \
     '[Unit]' \
     'Description=opencode Web Interface' \
@@ -655,7 +639,7 @@ RUN printf '%s\n' \
     'ExecStart=/opt/opencode/bin/opencode web --port 3000 --hostname 0.0.0.0' \
     'Restart=always' \
     'RestartSec=5' \
-    'Environment=PATH=/opt/opencode/bin:/home/opencode/.local/bin:/home/opencode/.cargo/bin:/home/opencode/.local/share/mise/shims:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
+    'Environment=PATH=/opt/opencode/bin:/home/opencode/.local/bin:/home/opencode/.cargo/bin:/home/opencode/.local/share/mise/shims:/home/opencode/.bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
     '' \
     '[Install]' \
     'WantedBy=multi-user.target' \
@@ -683,15 +667,12 @@ RUN mkdir -p /home/opencode/.config/opencode \
 # Verify config file exists
 RUN ls -la /home/opencode/.config/opencode/opencode.jsonc && cat /home/opencode/.config/opencode/opencode.jsonc
 
-USER opencode
-
 # -----------------------------------------------------------------------------
 # Entrypoint Script (Hybrid Init Support)
 # -----------------------------------------------------------------------------
 # Supports both tini (default, works everywhere) and systemd (for Cockpit on Linux)
 # Set USE_SYSTEMD=1 environment variable to use systemd init
 # Note: Entrypoint runs as root to support both modes; tini mode drops to opencode user
-USER root
 RUN printf '%s\n' \
     '#!/bin/bash' \
     'if [ "${USE_SYSTEMD}" = "1" ]; then' \
@@ -716,6 +697,34 @@ RUN printf '%s\n' \
 HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
     CMD curl -f -H "Accept: text/html" http://localhost:3000/ || exit 1
 
+# -----------------------------------------------------------------------------
+# opencode Artifacts
+# -----------------------------------------------------------------------------
+COPY --from=opencode-build /opt/opencode /opt/opencode
+COPY --from=opencode-build /usr/local/bin/opencode-broker /usr/local/bin/opencode-broker
+
+RUN chown -R opencode:opencode /opt/opencode \
+    && chmod +x /opt/opencode/bin/opencode \
+    && chmod 4755 /usr/local/bin/opencode-broker
+
+# Verify broker binary exists and is executable
+RUN ls -la /usr/local/bin/opencode-broker \
+    && test -x /usr/local/bin/opencode-broker \
+    && echo "Broker installed"
+
+USER opencode
+RUN /opt/opencode/bin/opencode --version
+
+# -----------------------------------------------------------------------------
+# GSD Plugin Installation
+# -----------------------------------------------------------------------------
+# Install the GSD (Get Shit Done) plugin for opencode
+# Note: If this fails in container builds due to "~" path resolution, retry with
+# OPENCODE_CONFIG_DIR=/home/opencode/.config/opencode set explicitly.
+RUN mkdir -p /home/opencode/.npm \
+    && npx --yes get-shit-done-cc --opencode --global \
+    && rm -rf /home/opencode/.npm/_cacache /home/opencode/.npm/_npx
+
 # -----------------------------------------------------------------------------
 # Version File
 # -----------------------------------------------------------------------------

package/src/docker/mod.rs

@@ -21,6 +21,7 @@ mod health;
 pub mod image;
 pub mod mount;
 pub mod progress;
+mod registry;
 pub mod state;
 pub mod update;
 pub mod users;
@@ -47,7 +48,10 @@ pub use image::{build_image, image_exists, pull_image};
 pub use update::{UpdateResult, has_previous_image, rollback_image, update_image};
 
 // Version detection
-pub use version::{VERSION_LABEL, get_cli_version, get_image_version, versions_compatible};
+pub use version::{
+    VERSION_LABEL, get_cli_version, get_image_version, get_registry_latest_version,
+    versions_compatible,
+};
 
 // Container exec operations
 pub use exec::{

package/src/docker/registry.rs

@@ -0,0 +1,214 @@
+//! Docker registry API helpers.
+//!
+//! Provides lightweight helpers for querying registry manifests and configs
+//! without pulling images.
+
+use super::DockerError;
+use reqwest::header::ACCEPT;
+use serde::Deserialize;
+use std::collections::HashMap;
+
+#[derive(Deserialize)]
+struct TokenResponse {
+    token: Option<String>,
+    access_token: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct ManifestConfig {
+    digest: String,
+}
+
+#[derive(Deserialize)]
+struct Manifest {
+    config: ManifestConfig,
+}
+
+#[derive(Deserialize)]
+struct ManifestList {
+    manifests: Vec<ManifestDescriptor>,
+}
+
+#[derive(Deserialize)]
+struct ManifestDescriptor {
+    digest: String,
+    platform: Option<ManifestPlatform>,
+}
+
+#[derive(Deserialize)]
+struct ManifestPlatform {
+    architecture: Option<String>,
+    os: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(untagged)]
+enum ManifestResponse {
+    Single(Manifest),
+    List(ManifestList),
+}
+
+#[derive(Deserialize)]
+struct ImageConfig {
+    config: Option<ImageConfigDetails>,
+}
+
+#[derive(Deserialize)]
+struct ImageConfigDetails {
+    #[serde(rename = "Labels")]
+    labels: Option<HashMap<String, String>>,
+}
+
+pub async fn fetch_registry_version(
+    registry_base: &str,
+    token_url: &str,
+    repo: &str,
+    tag: &str,
+    maybe_manifest_digest: Option<&str>,
+    label_key: &str,
+) -> Result<Option<String>, DockerError> {
+    let client = reqwest::Client::new();
+    let token = fetch_registry_token(&client, token_url).await?;
+    let manifest = if let Some(digest) = maybe_manifest_digest {
+        match fetch_registry_manifest(&client, registry_base, repo, digest, &token).await {
+            Ok(manifest) => manifest,
+            Err(digest_err) => fetch_registry_manifest(&client, registry_base, repo, tag, &token)
+                .await
+                .map_err(|tag_err| {
+                    DockerError::Connection(format!(
+                        "Failed to fetch registry manifest. Digest error: {digest_err}. Tag error: {tag_err}"
+                    ))
+                })?,
+        }
+    } else {
+        fetch_registry_manifest(&client, registry_base, repo, tag, &token).await?
+    };
+    let image_config = fetch_registry_image_config(
+        &client,
+        registry_base,
+        repo,
+        &manifest.config.digest,
+        &token,
+    )
+    .await?;
+
+    let maybe_version = image_config
+        .config
+        .and_then(|details| details.labels)
+        .and_then(|labels| labels.get(label_key).cloned());
+
+    Ok(maybe_version)
+}
+
+async fn fetch_registry_token(
+    client: &reqwest::Client,
+    token_url: &str,
+) -> Result<String, DockerError> {
+    let response = client
+        .get(token_url)
+        .send()
+        .await
+        .map_err(|e| DockerError::Connection(format!("Failed to fetch registry token: {e}")))?;
+
+    let token_response: TokenResponse = response
+        .json()
+        .await
+        .map_err(|e| DockerError::Connection(format!("Failed to decode registry token: {e}")))?;
+    let token = token_response
+        .token
+        .or(token_response.access_token)
+        .ok_or_else(|| DockerError::Connection("Registry token missing".to_string()))?;
+
+    Ok(token)
+}
+
+async fn fetch_registry_manifest(
+    client: &reqwest::Client,
+    registry_base: &str,
+    repo: &str,
+    reference: &str,
+    token: &str,
+) -> Result<Manifest, DockerError> {
+    let mut current_reference = reference.to_string();
+    loop {
+        let manifest_url = format!("{registry_base}/v2/{repo}/manifests/{current_reference}");
+        let response = client
+            .get(&manifest_url)
+            .header(
+                ACCEPT,
+                "application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json",
+            )
+            .bearer_auth(token)
+            .send()
+            .await
+            .map_err(|e| {
+                DockerError::Connection(format!("Failed to fetch registry manifest: {e}"))
+            })?;
+
+        if response.status() == reqwest::StatusCode::NOT_FOUND {
+            return Err(DockerError::Connection(format!(
+                "Manifest not found for {repo}:{current_reference}"
+            )));
+        }
+
+        let manifest_response: ManifestResponse = response
+            .json()
+            .await
+            .map_err(|e| DockerError::Connection(format!("Failed to decode manifest: {e}")))?;
+
+        match manifest_response {
+            ManifestResponse::Single(manifest) => return Ok(manifest),
+            ManifestResponse::List(list) => {
+                let digest = select_manifest_digest(&list).ok_or_else(|| {
+                    DockerError::Connection(format!(
+                        "No manifests available for {repo}:{current_reference}"
+                    ))
+                })?;
+                current_reference = digest;
+            }
+        }
+    }
+}
+
+fn select_manifest_digest(list: &ManifestList) -> Option<String> {
+    let preferred = list.manifests.iter().find(|manifest| {
+        let Some(platform) = &manifest.platform else {
+            return false;
+        };
+        platform.os.as_deref() == Some("linux") && platform.architecture.as_deref() == Some("amd64")
+    });
+
+    preferred
+        .or_else(|| list.manifests.first())
+        .map(|manifest| manifest.digest.clone())
+}
+
+async fn fetch_registry_image_config(
+    client: &reqwest::Client,
+    registry_base: &str,
+    repo: &str,
+    digest: &str,
+    token: &str,
+) -> Result<ImageConfig, DockerError> {
+    let config_url = format!("{registry_base}/v2/{repo}/blobs/{digest}");
+    let response = client
+        .get(&config_url)
+        .bearer_auth(token)
+        .send()
+        .await
+        .map_err(|e| DockerError::Connection(format!("Failed to fetch image config: {e}")))?;
+
+    if !response.status().is_success() {
+        return Err(DockerError::Connection(format!(
+            "Failed to fetch image config: HTTP {}",
+            response.status()
+        )));
+    }
+
+    let config = response
+        .json()
+        .await
+        .map_err(|e| DockerError::Connection(format!("Failed to decode image config: {e}")))?;
+
+    Ok(config)
+}

package/src/docker/version.rs

@@ -2,7 +2,8 @@
 //!
 //! Reads version information from Docker image labels.
 
-use super::{DockerClient, DockerError};
+use super::registry::fetch_registry_version;
+use super::{DockerClient, DockerError, IMAGE_NAME_DOCKERHUB, IMAGE_NAME_GHCR, IMAGE_TAG_DEFAULT};
 
 /// Version label key in Docker image
 pub const VERSION_LABEL: &str = "org.opencode-cloud.version";
@@ -38,6 +39,64 @@ pub async fn get_image_version(
     Ok(version)
 }
 
+pub async fn get_registry_latest_version(
+    client: &DockerClient,
+) -> Result<Option<String>, DockerError> {
+    match fetch_ghcr_registry_version(client).await {
+        Ok(version) => Ok(version),
+        Err(ghcr_err) => fetch_dockerhub_registry_version(client).await.map_err(|dockerhub_err| {
+            DockerError::Connection(format!(
+                "Failed to fetch registry version. GHCR: {ghcr_err}. Docker Hub: {dockerhub_err}"
+            ))
+        }),
+    }
+}
+
+async fn fetch_ghcr_registry_version(client: &DockerClient) -> Result<Option<String>, DockerError> {
+    let repo = IMAGE_NAME_GHCR
+        .strip_prefix("ghcr.io/")
+        .unwrap_or(IMAGE_NAME_GHCR);
+    let reference = format!("{IMAGE_NAME_GHCR}:{IMAGE_TAG_DEFAULT}");
+    let digest = fetch_registry_digest(client, &reference).await;
+    fetch_registry_version(
+        "https://ghcr.io",
+        &format!("https://ghcr.io/token?scope=repository:{repo}:pull"),
+        repo,
+        IMAGE_TAG_DEFAULT,
+        digest.as_deref(),
+        VERSION_LABEL,
+    )
+    .await
+}
+
+async fn fetch_dockerhub_registry_version(
+    client: &DockerClient,
+) -> Result<Option<String>, DockerError> {
+    let repo = IMAGE_NAME_DOCKERHUB;
+    let reference = format!("{IMAGE_NAME_DOCKERHUB}:{IMAGE_TAG_DEFAULT}");
+    let digest = fetch_registry_digest(client, &reference).await;
+    fetch_registry_version(
+        "https://registry-1.docker.io",
+        &format!(
+            "https://auth.docker.io/token?service=registry.docker.io&scope=repository:{repo}:pull"
+        ),
+        repo,
+        IMAGE_TAG_DEFAULT,
+        digest.as_deref(),
+        VERSION_LABEL,
+    )
+    .await
+}
+
+async fn fetch_registry_digest(client: &DockerClient, reference: &str) -> Option<String> {
+    client
+        .inner()
+        .inspect_registry_image(reference, None)
+        .await
+        .ok()
+        .and_then(|info| info.descriptor.digest)
+}
+
 /// CLI version from Cargo.toml
 pub fn get_cli_version() -> &'static str {
     env!("CARGO_PKG_VERSION")