@vantran-se/openchamber-web 2.0.4 → 2.0.6

package/server/lib/spaces/places/escape-suite.js

@@ -10,6 +10,7 @@
 //   spaceMetadata(spaceId)   resolves, as text, everything the place's own records show about the space container
 //   gatekeeperMetadata(spaceId)   the same for the gatekeeper container
 //   gatekeeperAddresses(spaceId)  resolves { inner, outer }, the gatekeeper's own addresses
+//   probeFromOuterNetwork(spaceId, script)  runs a Node script in a helper on the space's outer network
 //   startWindowUpstream(spaceId)  a stand-in provider on the space's outer network. It answers with
 //                                 the sha256 of the credentials it saw, never with the credentials
 
@@ -190,17 +191,51 @@ Promise.all(Array.from({ length: 80 }, attempt)).then((outcomes) => {
 const LONG_LIVED_CREDENTIAL = '"refresh"[[:space:]]*:[[:space:]]*"|BEGIN [A-Z ]*PRIVATE KEY|gh[pousr]_[A-Za-z0-9]{16}|sk-[A-Za-z0-9_-]{20}|xox[baprs]-';
 
 /** Everything the space holds that could be a long-lived credential, as text for the host to read.
- * HOME, the work directory and /tmp, which is writable and 256 MiB. */
+ * HOME, the work directory and /tmp, which is writable and 256 MiB. `-a` reads binary files as
+ * text: OpenCode 2 keeps its logins in the SQLite database `opencode.db` under HOME, and `-I`
+ * skipped that file. `-o` prints the matched shape and its file, never the binary around it. */
 const credentialSearch = (spaceId) => `
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin;
 echo "auth-record: $([ -e "$HOME/.local/share/opencode/auth.json" ] && echo present || echo absent)";
 echo "--- files";
-grep -rIsE '${LONG_LIVED_CREDENTIAL}' "$HOME" /tmp /spaces/${spaceId} 2>/dev/null | head -20;
+grep -raosE '${LONG_LIVED_CREDENTIAL}' "$HOME" /tmp /spaces/${spaceId} 2>/dev/null | head -20;
 echo "--- environments";
 for process in /proc/[0-9]*/environ; do tr '\\0' '\\n' < "$process" 2>/dev/null; done | grep -E '${LONG_LIVED_CREDENTIAL}' | head -20;
 echo "--- end";
 `;
 
+// OpenCode 2's own login store: rows in the `credential` table of `opencode.db`. The control
+// writes two the way OpenCode stores them: an OpenAI browser login, and a key for a provider of the
+// user's own that OpenCode's catalog does not know, which no integration route lists and no key
+// pattern matches. No route can create an OAuth record without a real login, so the rows are
+// written with Node's built-in SQLite into the database the running OpenCode uses. The timeout
+// waits for OpenCode's own lock instead of failing on it.
+const DECOY_CREDENTIAL_ID = 'cred_decoy000000000000000000';
+const DECOY_CUSTOM_CREDENTIAL_ID = 'cred_decoy000000000000000001';
+const openDatabase = (databasePath, options = '{ timeout: 5000 }') => `
+const { DatabaseSync } = require('node:sqlite');
+const db = new DatabaseSync(${JSON.stringify(databasePath)}, ${options});
+`;
+const plantCredential = (databasePath) => `${openDatabase(databasePath)}
+const now = Date.now();
+const insert = db.prepare('INSERT INTO credential (id, integration_id, label, value, active, time_created, time_updated) VALUES (?, ?, ?, ?, ?, ?, ?)');
+insert.run('${DECOY_CREDENTIAL_ID}', 'openai', 'default', JSON.stringify({ type: 'oauth', methodID: 'chatgpt-browser', refresh: 'decoy-refresh-value', access: 'decoy-access-value', expires: now + 3600000 }), 1, now, now);
+insert.run('${DECOY_CUSTOM_CREDENTIAL_ID}', 'acme-llm', 'default', JSON.stringify({ type: 'key', key: 'acme_live_decoy' }), 1, now, now);
+db.close();
+`;
+const removeCredential = (databasePath) => `${openDatabase(databasePath)}
+const { changes } = db.prepare('DELETE FROM credential WHERE id IN (?, ?)').run('${DECOY_CREDENTIAL_ID}', '${DECOY_CUSTOM_CREDENTIAL_ID}');
+db.close();
+console.log('removed:' + changes);
+`;
+// Every stored login, by integration and kind, read straight from the table. OpenCode lists only
+// the integrations its catalog knows, so this is the check that sees a custom provider's key.
+const readCredentials = (databasePath) => `${openDatabase(databasePath, '{ readOnly: true, timeout: 5000 }')}
+const rows = db.prepare("SELECT integration_id AS integration, json_extract(value, '$.type') AS type FROM credential ORDER BY id").all();
+db.close();
+console.log(JSON.stringify(rows.map((row) => ({ integration: row.integration, type: row.type }))));
+`;
+
 const sleep = (milliseconds) => new Promise((resolve) => { setTimeout(resolve, milliseconds); });
 
 const sha256 = (value) => `sha256:${crypto.createHash('sha256').update(value).digest('hex')}`;
@@ -458,7 +493,6 @@ export function runEscapeSuite(title, { enabled = true, setup }) {
       // Positive control: the metadata is real and complete enough to show the environment.
       expect(metadata).toContain('OPENCODE_DISABLE_AUTOUPDATE=1');
       expect(metadata).not.toContain(token);
-      expect(metadata).not.toContain('OPENCODE_AUTH_CONTENT');
     });
 
     it('cannot steer the requests of the host through its own ~/.curlrc', async () => {
@@ -796,6 +830,37 @@ export function runEscapeSuite(title, { enabled = true, setup }) {
           expect(JSON.stringify(journal)).not.toContain(MODEL_KEY);
         }, 120_000);
 
+        // The obligation of STAGES.md on the first real credential behind the window: on a Linux
+        // Docker host every local process can reach the outer bridge, so the corridor and the
+        // window listen on the gatekeeper's inner address only. A neighbour on the outer network
+        // stands in for such a process here; the same measurement from a Linux host itself is in
+        // the module documentation.
+        it('cannot be reached on its outer address: the corridor and the window listen on the inner network only', async () => {
+          const addresses = await host.gatekeeperAddresses(spec.id);
+          expect(addresses.outer).toMatch(/^\d+\.\d+\.\d+\.\d+$/);
+          const fromOutside = async (address, port) => (await host.probeFromOuterNetwork(spec.id, tcpProbe(address, port))).stdout.trim();
+          // Positive control: the neighbour's networking works, it reaches the stand-in upstream beside it.
+          expect(await fromOutside('upstream', 9000)).toMatch(/^connected:/);
+          for (const port of [GATEKEEPER_CORRIDOR_PORT, GATEKEEPER_WINDOW_PORT, GATEKEEPER_CONTROL_PORT]) {
+            expect(await fromOutside(addresses.outer, port), `outer address, port ${port}`).toBe('failed:ECONNREFUSED');
+          }
+          // And the space still reaches both by the gatekeeper's name, which resolves to the inner address.
+          expect(await probe(tcpProbe(GATEKEEPER_ALIAS, GATEKEEPER_CORRIDOR_PORT))).toBe(`connected:${addresses.inner}`);
+          expect(await probe(tcpProbe(GATEKEEPER_ALIAS, GATEKEEPER_WINDOW_PORT))).toBe(`connected:${addresses.inner}`);
+        }, 180_000);
+
+        it('gets no credential from the window for an opened domain, and none of its own reaches the upstream', async () => {
+          await channel().addGrant(spec.id, { id: 'open-registry', upstream: upstream.url });
+          const answer = await probe(windowProbe('/model/open-registry/-/package/left-pad', { 'x-api-key': 'sk-fake-inside', authorization: 'Bearer sk-fake-inside' }));
+          expect(answer).toMatch(/^200 /);
+          const seen = JSON.parse(answer.slice(4));
+          expect(seen.path).toBe('/v1/-/package/left-pad');
+          expect(seen.apiKey).toBe('none');
+          expect(seen.authorization).toBe('none');
+          expect(seen.headerNames.filter((name) => /key|auth|token/i.test(name))).toEqual([]);
+          expect(answer).not.toContain(MODEL_KEY);
+        }, 120_000);
+
         it('reaches a real upstream over TLS, with no credential of anyone\'s', async () => {
           publicAddress();
           await channel().addGrant(spec.id, { id: 'tls', upstream: 'https://example.com/', header: 'authorization', secret: 'not-a-credential' });
@@ -877,35 +942,74 @@ export function runEscapeSuite(title, { enabled = true, setup }) {
       // ever inside a space. Stage 2 puts none there, and this fails the day something does.
       it('holds no long-lived credential of the user\'s, anywhere the space can read', async () => {
         const search = () => shell(credentialSearch(spec.id));
+        const server = createSpaceServerChannel({ exec: place.exec });
+        const login = await server.request(spec.id, { method: 'POST', path: '/auth/session', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: await server.readToken(spec.id) }) });
+        expect(login.status).toBe(200);
+        const cookie = login.headers['set-cookie'][0].split(';')[0];
+        // What OpenCode itself holds: every connection of every integration, a stored login or a
+        // provider key it found in its own environment under one of its catalog's names.
+        const connections = async () => {
+          const answer = await server.request(spec.id, { path: '/api/integration', headers: { Cookie: cookie } });
+          expect(answer.status).toBe(200);
+          const integrations = JSON.parse(answer.body).data;
+          expect(integrations.length).toBeGreaterThan(0);
+          return integrations.flatMap((integration) => integration.connections.map((connection) => ({ integration: integration.id, ...connection })));
+        };
+        const database = `${SPACE_HOME}/.local/share/opencode/opencode.db`;
+        const storedCredentials = async () => {
+          const answer = await inside(['node', '--no-warnings', '-e', readCredentials(database)]);
+          expect(answer.code, answer.stderr).toBe(0);
+          return JSON.parse(answer.stdout);
+        };
         const decoyRecord = `${SPACE_HOME}/.local/share/opencode/auth.json`;
         const decoy = 'sk-decoy00000000000000000000';
 
+        // The clean search runs first. SQLite keeps a deleted row's bytes in its write-ahead log,
+        // so after the control below the database would hold the decoy's text for good.
+        const found = (await search()).stdout;
+        // Positive control of its own: the search ran and looked in all three places.
+        expect(found).toContain('--- files');
+        expect(found).toContain('--- environments');
+        expect(found).toContain('--- end');
+        expect(found).toContain('auth-record: absent');
+        expect(found.slice(found.indexOf('--- files'))).toBe('--- files\n--- environments\n--- end\n');
+        expect(await connections()).toEqual([]);
+        expect(await storedCredentials()).toEqual([]);
+
         // Positive control: the same search, with a credential of each shape planted where one
-        // would live. It must find all three, or a clean answer below would mean nothing.
+        // would live. The oauth refresh record goes only into OpenCode's database, so a search
+        // that skips binary files fails here. The legacy auth.json, which OpenCode 2 imports once,
+        // holds nothing and only shows that its path is checked.
         const planted = await shell([
           `mkdir -p "$(dirname ${decoyRecord})"`,
-          `printf '{"openai":{"type":"oauth","refresh":"decoy-refresh-value"}}' > ${decoyRecord}`,
+          `printf '{}' > ${decoyRecord}`,
           `printf -- '-----BEGIN OPENSSH PRIVATE KEY-----' > "$HOME/decoy-key"`,
           `DECOY_TOKEN=${decoy} sleep 30 & echo "decoy-pid:$!"`,
         ].join('; '));
         const decoyPid = /decoy-pid:(\d+)/.exec(planted.stdout)?.[1];
+        let removal;
         try {
+          const row = await inside(['node', '--no-warnings', '-e', plantCredential(database)]);
+          expect(row.code, row.stderr).toBe(0);
+          // OpenCode reads the row as a login, so this is where OpenCode 2 keeps them.
+          expect(await connections()).toEqual([{ integration: 'openai', type: 'credential', id: DECOY_CREDENTIAL_ID, label: 'default', method: 'oauth' }]);
+          // The custom provider's key is invisible to that listing, and the table read sees it.
+          expect(await storedCredentials()).toEqual([{ integration: 'openai', type: 'oauth' }, { integration: 'acme-llm', type: 'key' }]);
+
           const control = (await search()).stdout;
           expect(control).toContain('auth-record: present');
-          expect(control).toMatch(/"refresh"\s*:\s*"/);
+          expect(control).toMatch(/opencode\.db(-wal)?:"refresh"\s*:\s*"/);
           expect(control).toContain('BEGIN OPENSSH PRIVATE KEY');
           expect(control).toContain(decoy);
         } finally {
+          removal = await inside(['node', '--no-warnings', '-e', removeCredential(database)]);
           await shell(`rm -f ${decoyRecord} "$HOME/decoy-key"; ${decoyPid ? `kill ${decoyPid} 2>/dev/null` : 'true'}; true`);
         }
-
-        const found = (await search()).stdout;
-        // Positive control of its own: the search ran and looked in all three places.
-        expect(found).toContain('--- files');
-        expect(found).toContain('--- environments');
-        expect(found).toContain('--- end');
-        expect(found).toContain('auth-record: absent');
-        expect(found.slice(found.indexOf('--- files'))).toBe('--- files\n--- environments\n--- end\n');
+        // Checked after the finally, so a failed control above is the error that gets reported.
+        expect(removal.code, removal.stderr).toBe(0);
+        expect(removal.stdout).toBe('removed:2\n');
+        expect(await connections()).toEqual([]);
+        expect(await storedCredentials()).toEqual([]);
       }, 180_000);
 
       // One space is not enough to say anything about two. This makes a second one and looks

package/server/lib/spaces/places/fake-docker.js

@@ -96,7 +96,9 @@ export function hardenedContainerEntry({
       PortBindings: {},
     },
     Mounts: mountList.map(volumeMountEntry),
-    NetworkSettings: { Networks: { [network]: aliases.length > 0 ? { Aliases: aliases } : {} } },
+    // Like the real engine once the container runs: an address on its network. The fake gives it
+    // from the start, and the place's tests hold it to reading the address after the start.
+    NetworkSettings: { Networks: { [network]: { IPAddress: '172.19.0.2', ...(aliases.length > 0 ? { Aliases: aliases } : {}) } } },
   };
 }
 

package/server/lib/spaces/places/grants.docker.live.test.js

@@ -0,0 +1,197 @@
+// Grants on a real space, made through the journey on a real Docker daemon. Runs only with
+// OPENCHAMBER_TEST_DOCKER=1. A real key goes behind the window of a space made through the
+// journey's own routes; a stand-in provider on the space's outer network answers with the hash
+// of the key it saw and never with the key; and the key is then looked for everywhere the host
+// and the space keep things: the record on disk, the metadata of both containers, the space's
+// environment, processes and files. OpenCode inside is asked for a turn against that provider,
+// which proves that the provider configuration the host wrote sends it through the window.
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+
+import express from 'express';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { createGlobalMessageStreamHub } from '../../event-stream/global-hub.js';
+import { registerOpenCodeProxy } from '../../opencode/proxy.js';
+import { runCommand } from '../run-command.js';
+import { createSpacesHost } from '../host.js';
+import { SPACE_OPENCODE_CONFIG_PATH } from '../layout.js';
+import { LIVE_DOCKER_ENABLED, createLiveDockerPlace } from './docker-live-support.js';
+
+const CREATE_TIMEOUT_MS = 25 * 60_000;
+const sleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
+const until = async (check, timeoutMs = 10_000) => {
+  const deadline = Date.now() + timeoutMs;
+  while (!(await check()) && Date.now() < deadline) await sleep(250);
+  return check();
+};
+const listen = (app) => new Promise((resolve) => {
+  const server = http.createServer(app);
+  server.listen(0, '127.0.0.1', () => resolve(server));
+});
+const sha256 = (value) => `sha256:${crypto.createHash('sha256').update(value).digest('hex')}`;
+const temporary = (prefix) => fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+
+describe.skipIf(!LIVE_DOCKER_ENABLED)('grants on a real space: docker (live)', () => {
+  // Two real keys, made here. Neither ever enters the space; the stand-in provider sees them.
+  const TYPED_KEY = `sk-ant-live-${crypto.randomBytes(24).toString('hex')}`;
+  const ENV_KEY = `sk-oai-live-${crypto.randomBytes(24).toString('hex')}`;
+  let place;
+  let dispose = async () => {};
+  let liveHost;
+  let dataDir;
+  let project;
+  let host;
+  let hub;
+  let hostOpenCode;
+  let server;
+  let spaceId;
+  let upstream = { seen: async () => [], stop: async () => {} };
+  let session = null;
+  const url = (suffix) => `http://127.0.0.1:${server.address().port}${suffix}`;
+  const inside = async (argv) => place.exec(spaceId, argv, { timeoutMs: 60_000 });
+  const shell = (script) => inside(['sh', '-c', script]);
+  const prefixed = (suffix, init) => fetch(url(`/api/spaces/${spaceId}${suffix}`), init);
+  const json = (body) => ({ method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+  const listed = async () => (await host.journey.listSpaces({ access: true })).find((space) => space.id === spaceId);
+  const recordText = () => fs.readFileSync(path.join(dataDir, 'spaces', 'records', `${spaceId}.json`), 'utf8');
+
+  beforeAll(async () => {
+    ({ place, dispose, host: liveHost } = createLiveDockerPlace());
+    dataDir = temporary('openchamber-grants-live-');
+    // The registered project the space is made for: a small repository of its own.
+    project = temporary('openchamber-grants-project-');
+    const git = (...args) => runCommand('git', ['-C', project, ...args]);
+    await git('init', '-q', '.');
+    fs.writeFileSync(path.join(project, 'README.md'), 'A project for the grants live pass.\n');
+    await git('add', '.');
+    await git('-c', 'user.email=me@example.invalid', '-c', 'user.name=Me', 'commit', '-q', '-m', 'init');
+
+    host = createSpacesHost({
+      dataDir,
+      place,
+      listProjectDirectories: async () => [project],
+      hostEnvironment: { ...process.env, OPENAI_API_KEY: ENV_KEY },
+      logger: { warn: () => {} },
+    });
+    // The host's own OpenCode: nothing but an event stream that stays open.
+    const hostApp = express();
+    hostApp.get('/api/session', (_req, res) => res.json({ data: [], cursor: {} }));
+    hostApp.get('/api/event', (_req, res) => { res.setHeader('content-type', 'text/event-stream'); res.flushHeaders(); });
+    hostOpenCode = await listen(hostApp);
+    const hostPort = hostOpenCode.address().port;
+    hub = createGlobalMessageStreamHub({ buildOpenCodeUrl: (p) => `http://127.0.0.1:${hostPort}${p}`, getOpenCodeAuthHeaders: () => ({}), deltaCoalesceWindowMs: 0 });
+    const app = express();
+    app.use(host.middleware);
+    registerOpenCodeProxy(app, {
+      fs: {}, os: {}, path, OPEN_CODE_READY_GRACE_MS: 0,
+      getRuntime: () => ({ openCodePort: hostPort, isOpenCodeReady: true, openCodeNotReadySince: 0, isRestartingOpenCode: false }),
+      getOpenCodeAuthHeaders: () => ({}),
+      buildOpenCodeUrl: (p) => `http://127.0.0.1:${hostPort}${p}`,
+      ensureOpenCodeApiPrefix: () => {},
+      mergeSpaceSessionList: (payload) => host.mergeSessionList(payload),
+      spaceEventHub: hub,
+    });
+    server = await listen(app);
+    await host.startEvents(hub);
+
+    // The space, through the journey, as the create dialog will make it.
+    const answer = await host.journey.createSpace({ projectDirectory: project, name: 'Grants live', start: 'clean', network: { mode: 'allowlist', domains: [] } });
+    spaceId = answer.id;
+    expect(await until(async () => (await listed())?.state === 'running' && (await listed())?.step === null, CREATE_TIMEOUT_MS)).toBe(true);
+    upstream = await liveHost.startWindowUpstream(spaceId);
+  }, CREATE_TIMEOUT_MS);
+
+  afterAll(async () => {
+    host?.close();
+    hub?.stop();
+    for (const running of [server, hostOpenCode]) {
+      await new Promise((resolve) => { if (running) { running.closeAllConnections?.(); running.close(() => resolve()); } else resolve(); });
+    }
+    await upstream.stop();
+    await dispose();
+    for (const folder of [dataDir, project]) if (folder) fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('gives a typed key to the gatekeeper and keeps it out of the record, the containers and the space', async () => {
+    const granted = await host.journey.grantAccess(spaceId, { kind: 'model', provider: 'anthropic', upstream: upstream.url, secret: { kind: 'typed', value: TYPED_KEY } });
+    expect(granted.grant).toMatchObject({ id: 'anthropic', header: 'x-api-key', source: { kind: 'typed' }, url: 'http://gatekeeper:8080/model/anthropic' });
+    expect(JSON.stringify(granted)).not.toContain(TYPED_KEY);
+
+    // The window carries the real key: a request from inside reaches the stand-in with its hash.
+    const through = await shell('curl -s -H "x-api-key: space-window" http://gatekeeper:8080/model/anthropic/messages');
+    expect(through.code, through.stderr).toBe(0);
+    expect(JSON.parse(through.stdout)).toMatchObject({ path: '/v1/messages', apiKey: sha256(TYPED_KEY), authorization: 'none' });
+
+    // Not on the host's disk.
+    expect(recordText()).not.toContain(TYPED_KEY);
+    expect(JSON.parse(recordText()).grants).toEqual([{ kind: 'model', id: 'anthropic', provider: 'anthropic', upstream: upstream.url, header: 'x-api-key', source: { kind: 'typed' } }]);
+    // Not in what the runtime records about either container.
+    expect(await liveHost.spaceMetadata(spaceId)).not.toContain(TYPED_KEY);
+    expect(await liveHost.gatekeeperMetadata(spaceId)).not.toContain(TYPED_KEY);
+    // Not anywhere the space can look. The space prints what it has; the host searches it.
+    const insideTheSpace = await shell(`env; ps auxeww; find /home/space /tmp /spaces/${spaceId} -type f -size -1M -exec cat {} + 2>/dev/null; true`);
+    expect(insideTheSpace.stdout.length).toBeGreaterThan(0);
+    expect(insideTheSpace.stdout).not.toContain(TYPED_KEY);
+    // What the space does have: the configuration that points OpenCode at the window.
+    const config = JSON.parse((await inside(['cat', SPACE_OPENCODE_CONFIG_PATH])).stdout);
+    expect(config.provider.anthropic.options).toEqual({ baseURL: 'http://gatekeeper:8080/model/anthropic', apiKey: 'space-window' });
+    expect((await listed())).toMatchObject({ access: 'granted', needsAccess: [], grants: [expect.objectContaining({ id: 'anthropic' })] });
+  }, 120_000);
+
+  it('sends a turn of OpenCode inside through the window, where the stand-in sees the real key', async () => {
+    const directory = (await listed()).directory;
+    const created = await prefixed('/session', json({ location: { directory }, title: 'Through the window' }));
+    expect(created.status, await created.clone().text()).toBe(200);
+    session = (await created.json()).data;
+    const model = await prefixed(`/session/${session.id}/model`, { ...json({ model: { id: 'claude-sonnet-4-5', providerID: 'anthropic' } }), headers: { 'content-type': 'application/json', 'x-opencode-directory': encodeURIComponent(directory) } });
+    expect(model.status, await model.clone().text()).toBeLessThan(300);
+    const prompt = await prefixed(`/session/${session.id}/prompt`, { ...json({ id: `msg_${crypto.randomBytes(8).toString('hex')}`, text: 'Say hello.' }), headers: { 'content-type': 'application/json', 'x-opencode-directory': encodeURIComponent(directory) } });
+    expect(prompt.status, await prompt.clone().text()).toBeLessThan(300);
+
+    // A POST: the curl of the test above was a GET with the same key, and this must be OpenCode's own request.
+    const fromOpenCode = (entry) => entry.method === 'POST' && entry.apiKey === sha256(TYPED_KEY) && entry.path.startsWith('/v1/messages');
+    expect(await until(async () => (await upstream.seen()).some(fromOpenCode), 120_000)).toBe(true);
+    expect((await upstream.seen()).find(fromOpenCode)).toMatchObject({ authorization: 'none' });
+    expect(JSON.stringify(await upstream.seen())).not.toContain(TYPED_KEY);
+  }, 180_000);
+
+  it('measures whether OpenCode inside takes a provider granted after its instance started', async () => {
+    // A second provider, from the host's environment this time, granted while the instance of
+    // the space's project is already running. Whether that instance re-reads its configuration
+    // without a restart is what this measures; the outcome is reported, not asserted, because
+    // either way the key is out of the space and the window is the only way to the provider.
+    const granted = await host.journey.grantAccess(spaceId, { kind: 'model', provider: 'openai', upstream: upstream.url, secret: { kind: 'env', name: 'OPENAI_API_KEY' } });
+    expect(granted.grant).toMatchObject({ id: 'openai', header: 'authorization', source: { kind: 'env', name: 'OPENAI_API_KEY' } });
+    expect(recordText()).not.toContain(ENV_KEY);
+    const directory = (await listed()).directory;
+    const headers = { 'content-type': 'application/json', 'x-opencode-directory': encodeURIComponent(directory) };
+    await prefixed(`/session/${session.id}/model`, { ...json({ model: { id: 'gpt-4.1', providerID: 'openai' } }), headers });
+    await prefixed(`/session/${session.id}/prompt`, { ...json({ id: `msg_${crypto.randomBytes(8).toString('hex')}`, text: 'Say hello again.' }), headers });
+    const arrived = await until(async () => (await upstream.seen()).some((seen) => seen.authorization === sha256(`Bearer ${ENV_KEY}`)), 60_000);
+    // stderr, because vitest keeps a passing test's console.log to itself.
+    process.stderr.write(`[grants live] a provider granted after the instance started ${arrived ? 'was used on the next turn without a restart' : 'was NOT used on the next turn: the instance keeps the configuration it started with'}\n`);
+    expect(JSON.stringify(await upstream.seen())).not.toContain(ENV_KEY);
+  }, 180_000);
+
+  it('says the grants again after a stop and a start: the environment key yes, the typed key no', async () => {
+    await host.journey.stopSpace(spaceId);
+    const started = await host.journey.startSpace(spaceId);
+    expect(started).toMatchObject({ state: 'running', networkRestored: true, grantsRestored: ['openai'], needsAccess: ['anthropic'] });
+    expect(await listed()).toMatchObject({ access: 'needs_access', needsAccess: ['anthropic'] });
+    // The environment key works again at once; the typed one is gone with the gatekeeper's memory.
+    const bearer = await shell('curl -s http://gatekeeper:8080/model/openai/responses');
+    expect(JSON.parse(bearer.stdout)).toMatchObject({ path: '/v1/responses', authorization: sha256(`Bearer ${ENV_KEY}`) });
+    const missing = await shell('curl -s -o /dev/null -w "%{http_code}" http://gatekeeper:8080/model/anthropic/messages');
+    expect(missing.stdout).toBe('403');
+    // Granting once more brings it back.
+    await host.journey.grantAccess(spaceId, { kind: 'model', provider: 'anthropic', upstream: upstream.url, secret: { kind: 'typed', value: TYPED_KEY } });
+    expect(await listed()).toMatchObject({ access: 'granted', needsAccess: [] });
+    expect(recordText()).not.toContain(TYPED_KEY);
+    expect(recordText()).not.toContain(ENV_KEY);
+  }, 300_000);
+});

package/server/lib/spaces/places/memory-place.js

@@ -5,6 +5,8 @@
 // one container would pass nothing here.
 
 import crypto from 'node:crypto';
+import http from 'node:http';
+import net from 'node:net';
 
 import { SpaceError } from '../errors.js';
 import { ROLE_GATEKEEPER, ROLE_SPACE, requireSpaceId } from '../labels.js';
@@ -57,6 +59,14 @@ export function createMemoryPlace({ id = 'memory' } = {}) {
         // A container has a hostname of its own, as a real one does, so a caller can tell them apart.
         containers.set(`${spaceId}:${target}`, { hostname: crypto.randomBytes(6).toString('hex') });
       }
+      // The server inside, for `connect`: a loopback listener of this space's own that answers
+      // `/health` the way the real one does, with the space id so a caller can tell spaces apart.
+      const server = http.createServer((request, response) => {
+        response.setHeader('content-type', 'application/json');
+        response.end(JSON.stringify({ status: 'ok', isOpenCodeReady: true, spaceId, path: request.url }));
+      });
+      await new Promise((resolve) => { server.listen(0, '127.0.0.1', resolve); });
+      containers.get(`${spaceId}:${ROLE_SPACE}`).server = server;
     },
     list: async () => Array.from(spaces.values(), (space) => ({ ...space })),
     exec: async (spaceId, argv, options = {}) => {
@@ -84,12 +94,25 @@ export function createMemoryPlace({ id = 'memory' } = {}) {
       }
       return [process.execPath, '-e', CONTAINER_PROGRAM, hostname];
     },
+    // Added in stage 4a. A channel to the server inside, refused like `execArgv` when the space
+    // is stopped or gone: a plain socket to this space's own listener.
+    connect: async (spaceId) => {
+      const { server } = requireContainer(spaceId);
+      if (requireSpace(spaceId).state !== 'running') {
+        throw new SpaceError('space_not_running', `Space ${spaceId} is stopped`);
+      }
+      return net.connect({ host: '127.0.0.1', port: server.address().port });
+    },
     stop: async (spaceId) => { requireSpace(spaceId).state = 'exited'; },
     start: async (spaceId) => { requireSpace(spaceId).state = 'running'; },
     remove: async (spaceId) => {
       const removed = [];
       for (const target of TARGETS) {
-        if (containers.delete(`${requireSpaceId(spaceId)}:${target}`)) removed.push({ kind: 'container', name: `${spaceId}-${target}` });
+        const container = containers.get(`${requireSpaceId(spaceId)}:${target}`);
+        if (!container) continue;
+        container.server?.close();
+        containers.delete(`${spaceId}:${target}`);
+        removed.push({ kind: 'container', name: `${spaceId}-${target}` });
       }
       if (spaces.delete(spaceId)) removed.push({ kind: 'space', name: spaceId });
       return { removed, failed: [] };

package/server/lib/spaces/places/registry.js

@@ -1,4 +1,4 @@
-export const REQUIRED_PLACE_METHODS = ['check', 'create', 'list', 'exec', 'execArgv', 'stop', 'start', 'remove', 'verify'];
+export const REQUIRED_PLACE_METHODS = ['check', 'create', 'list', 'exec', 'execArgv', 'connect', 'stop', 'start', 'remove', 'verify'];
 
 export function createPlaceRegistry(initialPlaces = []) {
   const places = new Map();