@vantran-se/openchamber-web 2.0.3 → 2.0.5

package/server/lib/opencode/network-runtime.js

@@ -2,10 +2,18 @@ import { readOpenCodeInfo, isSupportedOpenCodeVersion } from './compatibility.js
 export const createOpenCodeNetworkRuntime = (deps) => {
   const {
     state,
-    getOpenCodeAuthHeaders,
+    getOpenCodeBaseUrl,
+    getOpenCodeAuthHeaders: readOpenCodeAuthHeaders,
     configuredOpenCodeHostname = '127.0.0.1',
   } = deps;
 
+  const getOpenCodeAuthHeaders = () => Object.fromEntries(
+    Object.entries(readOpenCodeAuthHeaders?.() ?? {}).map(([key, value]) => [
+      key.toLowerCase() === 'authorization' ? 'Authorization' : key,
+      value,
+    ]),
+  );
+
   const resolveConnectHostname = () => {
     const raw = typeof configuredOpenCodeHostname === 'string' ? configuredOpenCodeHostname.trim() : '';
     const hostname = raw || '127.0.0.1';
@@ -83,14 +91,14 @@ export const createOpenCodeNetworkRuntime = (deps) => {
   };
 
   const buildOpenCodeUrl = (path, prefixOverride) => {
-    if (!state.openCodePort) {
-      throw new Error('OpenCode port is not available');
+    const base = getOpenCodeBaseUrl?.() ?? state.openCodeBaseUrl;
+    if (!base && !state.openCodePort) {
+      throw new Error('OpenCode endpoint is not available');
     }
     const normalizedPath = path.startsWith('/') ? path : `/${path}`;
-    const prefix = normalizeApiPrefix(prefixOverride !== undefined ? prefixOverride : '');
-    const fullPath = `${prefix}${normalizedPath}`;
-    const base = state.openCodeBaseUrl ?? `http://${resolveConnectHostname()}:${state.openCodePort}`;
-    return `${base}${fullPath}`;
+    const prefix = normalizeApiPrefix(prefixOverride ?? '');
+    const fallback = `http://${resolveConnectHostname()}:${state.openCodePort}`;
+    return `${String(base ?? fallback).replace(/\/+$/, '')}${prefix}${normalizedPath}`;
   };
 
   const detectOpenCodeApiPrefix = () => {
@@ -107,6 +115,7 @@ export const createOpenCodeNetworkRuntime = (deps) => {
 
   return {
     waitForReady,
+    getOpenCodeAuthHeaders,
     normalizeApiPrefix,
     setDetectedOpenCodeApiPrefix,
     buildOpenCodeUrl,

package/server/lib/opencode/network-runtime.test.js

@@ -13,7 +13,8 @@ const createRuntime = (overrides = {}) => createOpenCodeNetworkRuntime({
     openCodeApiDetectionTimer: null,
     ...overrides.state,
   },
-  getOpenCodeAuthHeaders: () => ({}),
+  getOpenCodeBaseUrl: overrides.getOpenCodeBaseUrl,
+  getOpenCodeAuthHeaders: overrides.getOpenCodeAuthHeaders ?? (() => ({})),
   configuredOpenCodeHostname: overrides.configuredOpenCodeHostname,
 });
 
@@ -48,6 +49,33 @@ describe('OpenCode network runtime', () => {
     expect(runtime.buildOpenCodeUrl('/provider')).toBe('http://remote.example:4096/provider');
   });
 
+  it('builds each request from the current shared-service base URL', () => {
+    let baseUrl = 'http://127.0.0.1:4096';
+    const runtime = createRuntime({
+      state: { openCodePort: null },
+      getOpenCodeBaseUrl: () => baseUrl,
+    });
+
+    expect(runtime.buildOpenCodeUrl('/api/session')).toBe('http://127.0.0.1:4096/api/session');
+    baseUrl = 'http://127.0.0.1:5096/';
+    expect(runtime.buildOpenCodeUrl('/api/session')).toBe('http://127.0.0.1:5096/api/session');
+  });
+
+  it('normalizes current service auth without dropping additional headers', () => {
+    let headers = { authorization: 'Basic first', 'x-service-header': 'one' };
+    const runtime = createRuntime({ getOpenCodeAuthHeaders: () => headers });
+
+    expect(runtime.getOpenCodeAuthHeaders()).toEqual({
+      Authorization: 'Basic first',
+      'x-service-header': 'one',
+    });
+    headers = { authorization: 'Basic replacement', 'x-service-header': 'two' };
+    expect(runtime.getOpenCodeAuthHeaders()).toEqual({
+      Authorization: 'Basic replacement',
+      'x-service-header': 'two',
+    });
+  });
+
   it('normalizes wildcard and IPv6 OpenCode bind hosts for local connects', () => {
     expect(createRuntime({ configuredOpenCodeHostname: '0.0.0.0' }).buildOpenCodeUrl('/provider'))
       .toBe('http://127.0.0.1:4096/provider');

package/server/lib/opencode/npm-registry-config.d.ts

@@ -0,0 +1 @@
+export function resolveNpmRegistryRequest(packageName: string): { url: string; headers: Record<string, string> };

package/server/lib/opencode/npm-registry-config.js

@@ -0,0 +1,123 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org';
+
+function configPath() {
+  const configured = [process.env.npm_config_userconfig, process.env.NPM_CONFIG_USERCONFIG]
+    .map((value) => value?.trim())
+    .find(Boolean);
+  return configured || path.join(os.homedir(), '.npmrc');
+}
+
+// npm's ini parser accepts `key = "value"`; the quotes are not part of the value.
+function unquote(value) {
+  const quoted = value.length >= 2 && (value[0] === '"' || value[0] === "'") && value.at(-1) === value[0];
+  return quoted ? value.slice(1, -1) : value;
+}
+
+function configValues() {
+  try {
+    const values = new Map();
+    for (const rawLine of fs.readFileSync(configPath(), 'utf8').split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (line === '' || line.startsWith('#') || line.startsWith(';')) continue;
+
+      const separator = line.indexOf('=');
+      if (separator < 1) continue;
+      values.set(line.slice(0, separator).trim(), unquote(line.slice(separator + 1).trim()));
+    }
+    return values;
+  } catch {
+    return new Map();
+  }
+}
+
+function configuredValue(values, key) {
+  const configured = values.get(key);
+  if (!configured) return configured;
+
+  return configured.replace(/\$\{([^}]+)\}/g, (_match, variable) => {
+    const value = process.env[variable];
+    if (value === undefined) throw new Error('Missing npm configuration environment variable');
+    return value;
+  });
+}
+
+function registryFor(packageName, values) {
+  const scope = packageName.startsWith('@') ? packageName.split('/', 1)[0] : null;
+  const scopedEnvironmentRegistry = scope && [
+    process.env[`npm_config_${scope}:registry`],
+    process.env[`NPM_CONFIG_${scope}:REGISTRY`],
+  ].map((value) => value?.trim()).find(Boolean);
+  if (scopedEnvironmentRegistry) return scopedEnvironmentRegistry;
+
+  const scopedRegistry = scope && configuredValue(values, `${scope}:registry`);
+  if (scopedRegistry) return scopedRegistry;
+
+  const environmentRegistry = [process.env.npm_config_registry, process.env.NPM_CONFIG_REGISTRY]
+    .map((value) => value?.trim())
+    .find(Boolean);
+  if (environmentRegistry) return environmentRegistry;
+
+  return configuredValue(values, 'registry') || DEFAULT_NPM_REGISTRY;
+}
+
+function authFor(registry, values) {
+  const registryScope = `//${registry.host}${registry.pathname.replace(/\/+$/, '')}/`;
+  let bestMatch = null;
+
+  for (const key of values.keys()) {
+    const match = /^(\/\/.*\/):(?:_authToken|_auth|username|_password)$/.exec(key);
+    if (match && registryScope.startsWith(match[1]) && (!bestMatch || match[1].length > bestMatch.length)) {
+      bestMatch = match[1];
+    }
+  }
+
+  if (!bestMatch) return {};
+
+  const token = configuredValue(values, `${bestMatch}:_authToken`);
+  if (token) return { Authorization: `Bearer ${token}` };
+
+  const authorization = configuredValue(values, `${bestMatch}:_auth`);
+  if (authorization) return { Authorization: `Basic ${authorization}` };
+
+  const username = configuredValue(values, `${bestMatch}:username`);
+  const password = configuredValue(values, `${bestMatch}:_password`);
+  if (username && password) {
+    const decodedPassword = Buffer.from(password, 'base64').toString('utf8');
+    return { Authorization: `Basic ${Buffer.from(`${username}:${decodedPassword}`).toString('base64')}` };
+  }
+
+  return {};
+}
+
+/**
+ * Build a credential-safe package metadata request using npm's standard user configuration.
+ *
+ * @param {string} packageName
+ * @returns {{ url: string, headers: Record<string, string> }}
+ */
+export function resolveNpmRegistryRequest(packageName) {
+  const values = configValues();
+  let registry;
+  try {
+    registry = new URL(registryFor(packageName, values));
+    if (!['http:', 'https:'].includes(registry.protocol) || registry.search || registry.hash) {
+      throw new Error('invalid registry');
+    }
+  } catch {
+    throw new Error('Invalid npm registry URL');
+  }
+
+  const headers = authFor(registry, values);
+  registry.username = '';
+  registry.password = '';
+  registry.pathname = `${registry.pathname.replace(/\/+$/, '')}/`;
+
+  return {
+    url: `${registry.toString()}${encodeURIComponent(packageName).replace(/^%40/i, '@')}`,
+    headers,
+  };
+}

package/server/lib/opencode/npm-registry-config.test.js

@@ -0,0 +1,167 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+
+import { resolveNpmRegistryRequest } from './npm-registry-config.js';
+
+const originalLowerRegistry = process.env.npm_config_registry;
+const originalUpperRegistry = process.env.NPM_CONFIG_REGISTRY;
+const originalUserConfig = process.env.NPM_CONFIG_USERCONFIG;
+const originalLowerUserConfig = process.env.npm_config_userconfig;
+const originalPrivateRegistry = process.env.PRIVATE_NPM_REGISTRY;
+const originalPrivateToken = process.env.PRIVATE_NPM_TOKEN;
+const originalScopedRegistry = process.env['npm_config_@scope:registry'];
+let userConfigPath;
+
+describe('npm registry configuration', () => {
+  beforeEach(() => {
+    userConfigPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-npmrc-')), '.npmrc');
+    process.env.NPM_CONFIG_USERCONFIG = userConfigPath;
+    delete process.env.npm_config_userconfig;
+    delete process.env.npm_config_registry;
+    delete process.env.NPM_CONFIG_REGISTRY;
+    delete process.env.PRIVATE_NPM_REGISTRY;
+    delete process.env.PRIVATE_NPM_TOKEN;
+    delete process.env['npm_config_@scope:registry'];
+  });
+
+  afterEach(() => {
+    fs.rmSync(path.dirname(userConfigPath), { recursive: true, force: true });
+    if (originalLowerRegistry === undefined) delete process.env.npm_config_registry;
+    else process.env.npm_config_registry = originalLowerRegistry;
+    if (originalUpperRegistry === undefined) delete process.env.NPM_CONFIG_REGISTRY;
+    else process.env.NPM_CONFIG_REGISTRY = originalUpperRegistry;
+    if (originalUserConfig === undefined) delete process.env.NPM_CONFIG_USERCONFIG;
+    else process.env.NPM_CONFIG_USERCONFIG = originalUserConfig;
+    if (originalLowerUserConfig === undefined) delete process.env.npm_config_userconfig;
+    else process.env.npm_config_userconfig = originalLowerUserConfig;
+    if (originalPrivateRegistry === undefined) delete process.env.PRIVATE_NPM_REGISTRY;
+    else process.env.PRIVATE_NPM_REGISTRY = originalPrivateRegistry;
+    if (originalPrivateToken === undefined) delete process.env.PRIVATE_NPM_TOKEN;
+    else process.env.PRIVATE_NPM_TOKEN = originalPrivateToken;
+    if (originalScopedRegistry === undefined) delete process.env['npm_config_@scope:registry'];
+    else process.env['npm_config_@scope:registry'] = originalScopedRegistry;
+  });
+
+  test('uses the default public registry without npm configuration', () => {
+    expect(resolveNpmRegistryRequest('@scope/pkg')).toEqual({
+      url: 'https://registry.npmjs.org/@scope%2Fpkg',
+      headers: {},
+    });
+  });
+
+  test('uses the user npm registry for an unscoped package', () => {
+    fs.writeFileSync(userConfigPath, 'registry=https://mirror.example.com/custom/npm/\n');
+
+    expect(resolveNpmRegistryRequest('private-plugin')).toEqual({
+      url: 'https://mirror.example.com/custom/npm/private-plugin',
+      headers: {},
+    });
+  });
+
+  test('prefers a scoped user registry', () => {
+    fs.writeFileSync(userConfigPath, [
+      'registry=https://mirror.example.com/npm/',
+      '@scope:registry=https://packages.example.com/npm/',
+    ].join('\n'));
+
+    expect(resolveNpmRegistryRequest('@scope/plugin').url).toBe('https://packages.example.com/npm/@scope%2Fplugin');
+  });
+
+  test('prefers a scoped user registry over an inherited general registry', () => {
+    fs.writeFileSync(userConfigPath, '@scope:registry=https://packages.example.com/npm/\n');
+    process.env.NPM_CONFIG_REGISTRY = 'https://inherited.example.com/npm/';
+
+    expect(resolveNpmRegistryRequest('@scope/plugin').url).toBe('https://packages.example.com/npm/@scope%2Fplugin');
+  });
+
+  test('prefers a scoped inherited registry over user npm configuration', () => {
+    fs.writeFileSync(userConfigPath, 'registry=https://mirror.example.com/npm/\n');
+    process.env['npm_config_@scope:registry'] = 'https://packages.example.com/npm/';
+
+    expect(resolveNpmRegistryRequest('@scope/plugin').url).toBe('https://packages.example.com/npm/@scope%2Fplugin');
+  });
+
+  test('prefers an inherited npm registry over user configuration', () => {
+    fs.writeFileSync(userConfigPath, 'registry=https://mirror.example.com/npm/\n');
+    process.env.NPM_CONFIG_REGISTRY = 'https://inherited.example.com/npm/';
+
+    expect(resolveNpmRegistryRequest('plugin').url).toBe('https://inherited.example.com/npm/plugin');
+  });
+
+  test('uses a matching npm token without exposing it in the request URL', () => {
+    fs.writeFileSync(userConfigPath, [
+      'registry=https://packages.example.com/npm/',
+      '//packages.example.com/npm/:_authToken=private-token',
+    ].join('\n'));
+
+    const request = resolveNpmRegistryRequest('private-plugin');
+
+    expect(request.url).toBe('https://packages.example.com/npm/private-plugin');
+    expect(request.url).not.toContain('private-token');
+    expect(request.headers).toEqual({ Authorization: 'Bearer private-token' });
+  });
+
+  test('uses npm basic authentication with its base64-encoded password', () => {
+    fs.writeFileSync(userConfigPath, [
+      'registry=https://packages.example.com/npm/',
+      '//packages.example.com/npm/:username=registry-user',
+      '//packages.example.com/npm/:_password=c2VjcmV0',
+    ].join('\n'));
+
+    expect(resolveNpmRegistryRequest('private-plugin').headers).toEqual({
+      Authorization: 'Basic cmVnaXN0cnktdXNlcjpzZWNyZXQ=',
+    });
+  });
+
+  test('expands environment variables in user npm configuration', () => {
+    process.env.PRIVATE_NPM_TOKEN = 'expanded-token';
+    fs.writeFileSync(userConfigPath, [
+      'registry=${PRIVATE_NPM_REGISTRY}',
+      '//packages.example.com/npm/:_authToken=${PRIVATE_NPM_TOKEN}',
+    ].join('\n'));
+    process.env.PRIVATE_NPM_REGISTRY = 'https://packages.example.com/npm/';
+
+    expect(resolveNpmRegistryRequest('private-plugin')).toEqual({
+      url: 'https://packages.example.com/npm/private-plugin',
+      headers: { Authorization: 'Bearer expanded-token' },
+    });
+  });
+
+  test('reads quoted values the way npm does', () => {
+    fs.writeFileSync(userConfigPath, [
+      '@scope:registry = "https://packages.example.com/npm/"',
+      "//packages.example.com/npm/:_authToken='quoted-token'",
+    ].join('\n'));
+
+    expect(resolveNpmRegistryRequest('@scope/plugin')).toEqual({
+      url: 'https://packages.example.com/npm/@scope%2Fplugin',
+      headers: { Authorization: 'Bearer quoted-token' },
+    });
+  });
+
+  test('honors the lowercase userconfig variable npm sets for child processes', () => {
+    delete process.env.NPM_CONFIG_USERCONFIG;
+    process.env.npm_config_userconfig = userConfigPath;
+    fs.writeFileSync(userConfigPath, 'registry=https://mirror.example.com/npm/\n');
+
+    try {
+      expect(resolveNpmRegistryRequest('plugin').url).toBe('https://mirror.example.com/npm/plugin');
+    } finally {
+      delete process.env.npm_config_userconfig;
+    }
+  });
+
+  test('rejects unresolved npm configuration environment variables', () => {
+    fs.writeFileSync(userConfigPath, 'registry=${MISSING_NPM_REGISTRY}\n');
+
+    expect(() => resolveNpmRegistryRequest('private-plugin')).toThrow('Invalid npm registry URL');
+  });
+
+  test('rejects malformed registry values without exposing their contents', () => {
+    fs.writeFileSync(userConfigPath, 'registry=not-a-url-private-token\n');
+
+    expect(() => resolveNpmRegistryRequest('plugin')).toThrow('Invalid npm registry URL');
+  });
+});

package/server/lib/opencode/npm-registry.js

@@ -2,9 +2,10 @@ import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+import { resolveNpmRegistryRequest } from './npm-registry-config.js';
+
 const NPM_CACHE_TTL_MS = 3_600_000;
 const NPM_FETCH_TIMEOUT_MS = 5_000;
-const NPM_REGISTRY_BASE = 'https://registry.npmjs.org';
 
 /**
  * @typedef {Object} NpmPackagePayload
@@ -50,10 +51,6 @@ function _getUserAgent() {
   return _userAgent;
 }
 
-function encodeName(name) {
-  return encodeURIComponent(name).replace(/^%40/, '@');
-}
-
 function parseDistTags(value) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
     return {};
@@ -87,10 +84,12 @@ function cacheResult(name, payload) {
  */
 export async function lookupNpmPackage(name) {
   try {
-    const response = await fetch(`${NPM_REGISTRY_BASE}/${encodeName(name)}`, {
+    const request = resolveNpmRegistryRequest(name);
+    const response = await fetch(request.url, {
       headers: {
         'User-Agent': _getUserAgent(),
         Accept: 'application/json',
+        ...request.headers,
       },
       signal: AbortSignal.timeout(NPM_FETCH_TIMEOUT_MS),
     });

package/server/lib/opencode/npm-registry.test.js

@@ -1,10 +1,18 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
 import * as npm from './npm-registry.js';
 
 const originalFetch = globalThis.fetch;
 const originalDateNow = Date.now;
+const originalUserConfig = process.env.NPM_CONFIG_USERCONFIG;
+const originalLowerUserConfig = process.env.npm_config_userconfig;
+const originalLowerRegistry = process.env.npm_config_registry;
+const originalUpperRegistry = process.env.NPM_CONFIG_REGISTRY;
 
 let fetchMock;
+let userConfigPath;
 
 function jsonResponse(body, status = 200) {
   return Promise.resolve(new Response(JSON.stringify(body), {
@@ -17,6 +25,11 @@ describe('npm registry client', () => {
   beforeEach(() => {
     npm.clearCache();
     Date.now = originalDateNow;
+    userConfigPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-npmrc-')), '.npmrc');
+    process.env.NPM_CONFIG_USERCONFIG = userConfigPath;
+    delete process.env.npm_config_userconfig;
+    delete process.env.npm_config_registry;
+    delete process.env.NPM_CONFIG_REGISTRY;
     fetchMock = mock(() => jsonResponse({}));
     globalThis.fetch = fetchMock;
   });
@@ -25,6 +38,15 @@ describe('npm registry client', () => {
     npm.clearCache();
     globalThis.fetch = originalFetch;
     Date.now = originalDateNow;
+    fs.rmSync(path.dirname(userConfigPath), { recursive: true, force: true });
+    if (originalUserConfig === undefined) delete process.env.NPM_CONFIG_USERCONFIG;
+    else process.env.NPM_CONFIG_USERCONFIG = originalUserConfig;
+    if (originalLowerUserConfig === undefined) delete process.env.npm_config_userconfig;
+    else process.env.npm_config_userconfig = originalLowerUserConfig;
+    if (originalLowerRegistry === undefined) delete process.env.npm_config_registry;
+    else process.env.npm_config_registry = originalLowerRegistry;
+    if (originalUpperRegistry === undefined) delete process.env.NPM_CONFIG_REGISTRY;
+    else process.env.NPM_CONFIG_REGISTRY = originalUpperRegistry;
   });
 
   test('200 success returns latest versions and dist tags', async () => {
@@ -171,6 +193,14 @@ describe('npm registry client', () => {
     expect(fetchMock.mock.calls[0][0]).toBe('https://registry.npmjs.org/@scope%2Fpkg');
   });
 
+  test('user npm configuration changes the package metadata registry', async () => {
+    fs.writeFileSync(userConfigPath, 'registry=https://mirror.example.com/npm/\n');
+
+    await npm.getNpmInfo('private-plugin');
+
+    expect(fetchMock.mock.calls[0][0]).toBe('https://mirror.example.com/npm/private-plugin');
+  });
+
   test('user-agent header is present', async () => {
     await npm.getNpmInfo('foo');
 

package/server/lib/opencode/openchamber-routes.js

@@ -71,6 +71,26 @@ export const registerOpenChamberRoutes = (app, dependencies) => {
 
   let desktopRestartError = null;
 
+  /**
+   * How this server was launched, read from its instance file. A foreground
+   * server outside systemd has no process that can restart it after an
+   * install, so it cannot update itself.
+   */
+  const readLaunchState = async () => {
+    const currentPort = server.address()?.port || 3000;
+    const instanceFilePath = path.join(openchamberDataDir, 'run', `openchamber-${currentPort}.json`);
+    let storedOptions = { port: currentPort, daemon: true };
+    try {
+      const content = await fs.promises.readFile(instanceFilePath, 'utf8');
+      storedOptions = JSON.parse(content);
+    } catch {
+    }
+    const launchMode = storedOptions.launchMode === 'foreground' ? 'foreground' : 'daemon';
+    const isForegroundService = launchMode === 'foreground';
+    const systemdServiceUnit = isForegroundService ? resolveSystemdServiceUnit(process.env) : null;
+    return { storedOptions, launchMode, isForegroundService, systemdServiceUnit };
+  };
+
   app.get('/api/openchamber/update-check', async (req, res) => {
     try {
       const parseString = (value) => (typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined);
@@ -121,6 +141,14 @@ export const registerOpenChamberRoutes = (app, dependencies) => {
       } else {
         const { checkForUpdates } = await import('../package-manager.js');
         updateInfo = await checkForUpdates(updateRequest);
+        // Tell clients up front that the install route will refuse, so they
+        // show the manual command instead of an Update button that fails.
+        if (updateInfo?.available && updateRequest.appType === 'web') {
+          const { isForegroundService, systemdServiceUnit } = await readLaunchState();
+          if (isForegroundService && !systemdServiceUnit) {
+            updateInfo = { ...updateInfo, installBlocked: 'service-manager' };
+          }
+        }
       }
       res.json(updateInfo);
     } catch (error) {
@@ -215,17 +243,7 @@ export const registerOpenChamberRoutes = (app, dependencies) => {
         return;
       }
 
-      const currentPort = server.address()?.port || 3000;
-      const instanceFilePath = path.join(openchamberDataDir, 'run', `openchamber-${currentPort}.json`);
-      let storedOptions = { port: currentPort, daemon: true };
-      try {
-        const content = await fs.promises.readFile(instanceFilePath, 'utf8');
-        storedOptions = JSON.parse(content);
-      } catch {
-      }
-      const launchMode = storedOptions.launchMode === 'foreground' ? 'foreground' : 'daemon';
-      const isForegroundService = launchMode === 'foreground';
-      const systemdServiceUnit = isForegroundService ? resolveSystemdServiceUnit(process.env) : null;
+      const { storedOptions, launchMode, isForegroundService, systemdServiceUnit } = await readLaunchState();
 
       if (isForegroundService) {
         if (!systemdServiceUnit) {

package/server/lib/opencode/openchamber-routes.test.js

@@ -203,6 +203,24 @@ describe('OpenChamber desktop host update route', () => {
 });
 
 describe('OpenChamber foreground update route', () => {
+  it('marks an available update as blocked when the foreground server has no service manager', async () => {
+    const { app } = createApp();
+
+    const response = await request(app).get('/api/openchamber/update-check?appType=web').expect(200);
+
+    expect(response.body).toMatchObject({ available: true, installBlocked: 'service-manager' });
+  });
+
+  it('leaves the update installable for a systemd-owned or daemon server', async () => {
+    const systemd = createApp({ environment: { INVOCATION_ID: 'systemd-invocation' } });
+    const daemon = createApp({ storedOptions: { launchMode: 'daemon' } });
+
+    for (const { app } of [systemd, daemon]) {
+      const response = await request(app).get('/api/openchamber/update-check?appType=web').expect(200);
+      expect(response.body.installBlocked).toBeUndefined();
+    }
+  });
+
   it('rejects a foreground update when the server is not owned by systemd', async () => {
     const { app } = createApp();
 

package/server/lib/opencode/project-directory-runtime.js

@@ -16,6 +16,10 @@ export const createProjectDirectoryRuntime = (dependencies) => {
     readSettingsFromDiskMigrated,
     getReadSettingsFromDiskMigrated,
     sanitizeProjects,
+    // `refuseDirectory(candidate)` answers the reason a directory may not be used on this host,
+    // or null. It runs before the path is looked at, so a refused directory is never touched and
+    // never falls back to another one. The isolated-spaces host refuses `/spaces/...` with it.
+    refuseDirectory = () => null,
   } = dependencies;
   const realpathCache = createRealpathCache({
     realpath: fsPromises.realpath.bind(fsPromises),
@@ -38,6 +42,10 @@ export const createProjectDirectoryRuntime = (dependencies) => {
     if (!resolved) {
       return { ok: false, error: 'Directory parameter is required' };
     }
+    const refusal = refuseDirectory(resolved);
+    if (typeof refusal === 'string' && refusal.length > 0) {
+      return { ok: false, error: refusal };
+    }
     try {
       const stats = await fsPromises.stat(resolved);
       if (!stats.isDirectory()) {

package/server/lib/opencode/project-directory-runtime.test.js

@@ -42,6 +42,19 @@ describe('project directory runtime', () => {
       expect(result).toEqual({ ok: true, directory: '/real/path/to/project', requestedDirectory: '/symlink/path/to/project' });
     });
 
+    it('refuses a directory the host says no to, before it looks at the disk', async () => {
+      let statCalls = 0;
+      const runtime = createTestRuntime({
+        fsPromises: { stat: async () => { statCalls += 1; return { isDirectory: () => true }; }, realpath: async (p) => p },
+        refuseDirectory: (candidate) => (candidate.startsWith('/spaces/') ? 'A directory under /spaces/ belongs to an isolated space' : null),
+      });
+
+      expect(await runtime.validateDirectoryPath('/spaces/a1b2c3d4e5f6/repo')).toEqual({ ok: false, error: 'A directory under /spaces/ belongs to an isolated space' });
+      expect(statCalls).toBe(0);
+      expect(await runtime.validateDirectoryPath('/home/user/project')).toMatchObject({ ok: true });
+      expect(statCalls).toBe(1);
+    });
+
     it('returns error when candidate is empty', async () => {
       const runtime = createTestRuntime();
       const result = await runtime.validateDirectoryPath('');