agentbox-app 0.1.12 → 0.1.13

package/main/opencode-server.mjs

@@ -0,0 +1,271 @@
+// OPENCODE'S OWN TRANSPORT, AND WHY IT IS THE SERVER AND NOT THE CLI.
+//
+// Measured against a real OpenCode 1.18.35 on 2026-10-07. `opencode run` is
+// the obvious road -- it is non-interactive, `--format json` prints one JSON
+// object per line, and that is nearly the shape main/harnesses/claude-stream
+// already reads. It is also the wrong road, and the measurement says so in one
+// line. Run with `permission: { bash: "ask" }` in config, the CLI printed:
+//
+//   ! permission requested: bash (echo probe-run-mode); auto-rejecting
+//
+// and handed the model "The user rejected permission to use this specific tool
+// call." With no permission config at all it ran the command with no card.
+// `--auto` approves everything not explicitly denied. So the CLI offers
+// approve-everything or refuse-everything, and an Agentbox card is neither.
+//
+// The HTTP server does carry a real approval. `opencode serve` raises
+// `permission.asked` on its `/event` stream with the command in
+// `metadata.command`, and `POST /session/:id/permissions/:id` with
+// `{ response: "once" }` releases it while `{ response: "reject" }` refuses it.
+// Both measured end to end against the real binary, both answers, 200 each
+// time, the tool running in the first case and coming back
+// "The user rejected permission to use this specific tool call." in the second.
+// That is the same card contract main/codex-approvals.mjs already fills, which
+// is why this file exists and a second stream parser does not.
+//
+// AND IT IS WHY WE DO NOT PASS `--auto` ANYWHERE. A grep for it is a test
+// (tests/opencode-asks-before-it-runs-a-command), because the flag would make
+// every run quietly approve its own file writes and shell commands.
+import { EventEmitter } from 'node:events';
+import { Name } from '../shared/product-name.mjs';
+
+/** How long a single HTTP call to the local server may take. */
+const CALL_MS = 60_000;
+
+/**
+ * A client for one `opencode serve`.
+ *
+ * `password` is the server's own basic-auth secret, which Agentbox generates
+ * per server and which OpenCode reads from `OPENCODE_SERVER_PASSWORD`. It is
+ * NOT a provider credential: OpenCode loads those itself, from its own
+ * `~/.local/share/opencode/auth.json`. Agentbox never has one to pass, which
+ * is the rule in CLAUDE.md and the reason this harness can exist at all.
+ */
+export function openCodeClient({ baseUrl, password = null, username = 'opencode', fetchImpl = globalThis.fetch } = {}) {
+  if (!baseUrl) throw Error('openCodeClient needs the address of a running OpenCode server');
+  const root = String(baseUrl).replace(/\/+$/, '');
+  const authorization = password ? `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}` : null;
+
+  const request = async (path, { method = 'GET', body, signal, stream = false } = {}) => {
+    const response = await fetchImpl(root + path, {
+      method,
+      headers: {
+        ...(authorization ? { authorization } : {}),
+        ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+        ...(stream ? { accept: 'text/event-stream' } : {}),
+      },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      signal: signal ?? AbortSignal.timeout(CALL_MS),
+    });
+    if (!response.ok) throw Error(`OpenCode answered ${response.status} for ${method} ${path}`);
+    if (stream) return response;
+    const text = await response.text();
+    if (!text) return null;
+    try { return JSON.parse(text); } catch { return text; }
+  };
+
+  return {
+    url: root,
+    request,
+    createSession: (body = {}) => request('/session', { method: 'POST', body }),
+    prompt: (sessionId, body) => request(`/session/${encodeURIComponent(sessionId)}/prompt_async`, { method: 'POST', body }),
+    abort: sessionId => request(`/session/${encodeURIComponent(sessionId)}/abort`, { method: 'POST', body: {} }),
+    // `{ response }` and not `{ action }`: the field name is off the real
+    // OpenAPI document the running server serves at /doc.
+    replyPermission: (sessionId, permissionId, response) =>
+      request(`/session/${encodeURIComponent(sessionId)}/permissions/${encodeURIComponent(permissionId)}`, { method: 'POST', body: { response } }),
+    summarize: (sessionId, model) =>
+      request(`/session/${encodeURIComponent(sessionId)}/summarize`, { method: 'POST', body: splitModel(model) }),
+    runCommand: (sessionId, body) => request(`/session/${encodeURIComponent(sessionId)}/command`, { method: 'POST', body }),
+    providers: () => request('/config/providers'),
+    commands: () => request('/command'),
+    config: () => request('/config'),
+    health: () => request('/global/health'),
+    events: ({ signal } = {}) => eventStream(request, signal),
+  };
+}
+
+/**
+ * `provider/model` as the two fields OpenCode's API wants.
+ *
+ * Its model ids are provider-qualified and the slash is part of the id people
+ * see (`opencode/big-pickle`, `anthropic/claude-sonnet-4-5`), but every server
+ * endpoint takes `providerID` and `modelID` apart. A model with no slash is not
+ * guessed at: it is left for the server's own default to answer, because
+ * inventing a provider here is how a run dies on a model nobody chose.
+ */
+export function splitModel(model) {
+  const text = typeof model === 'string' ? model.trim() : '';
+  const at = text.indexOf('/');
+  if (at <= 0 || at === text.length - 1) return {};
+  return { providerID: text.slice(0, at), modelID: text.slice(at + 1) };
+}
+
+/** The `/event` stream, as an async iterable of `{ type, properties }`. */
+function eventStream(request, outerSignal) {
+  const controller = new AbortController();
+  outerSignal?.addEventListener('abort', () => controller.abort(), { once: true });
+  const opened = request('/event', { stream: true, signal: controller.signal });
+
+  return {
+    close: () => controller.abort(),
+    async *[Symbol.asyncIterator]() {
+      const response = await opened;
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = '';
+      try {
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) return;
+          buffer += decoder.decode(value, { stream: true });
+          let index;
+          while ((index = buffer.indexOf('\n')) >= 0) {
+            const line = buffer.slice(0, index).trim();
+            buffer = buffer.slice(index + 1);
+            if (!line.startsWith('data:')) continue;
+            const payload = line.slice(5).trim();
+            if (!payload) continue;
+            try { yield JSON.parse(payload); } catch { /* a half-written frame is not news */ }
+          }
+        }
+      } finally {
+        try { await reader.cancel(); } catch { /* already gone */ }
+      }
+    },
+  };
+}
+
+/** The permission events, old and new, that mean "a card is wanted". */
+const ASKED = new Set(['permission.asked', 'permission.v2.asked']);
+/** What the reply endpoint calls yes and no. */
+const ALLOW = 'once';
+const DENY = 'reject';
+
+/**
+ * ONE OPENCODE RUN, SHAPED LIKE A CHILD PROCESS.
+ *
+ * The supervisor's spawn path wants something with `stderr`, `on('event')` and
+ * one `exit`, because that is what a Claude Code child and a Codex worker both
+ * look like from there (main/supervisor.mjs, `_spawnWorker`). This is the third
+ * one, and it owns nothing the other two own: its events are OpenCode's own
+ * names, passed through untranslated, exactly as the Codex adapter passes its
+ * notifications through rather than pretending to be Claude's JSON lines.
+ *
+ * DENY IS THE ANSWER NOBODY HAS TO CHOOSE. A card that is never answered, a
+ * handler that throws, a spool that has gone away, a worker killed mid-question
+ * -- every one of those refuses the tool call. The opposite default would mean
+ * a crashed inbox silently approves shell commands, which is the one failure
+ * here that cannot be taken back.
+ */
+export function createOpenCodeWorker({
+  client,
+  plan = {},
+  cwd = null,
+  resumeSessionId = null,
+  onApproval = null,
+  title = null,
+} = {}) {
+  if (!client) throw Error('createOpenCodeWorker needs a client for a running OpenCode server');
+
+  const worker = new EventEmitter();
+  worker.stderr = new EventEmitter();
+  worker.stdout = new EventEmitter();
+  worker.sessionId = resumeSessionId ?? null;
+
+  const say = text => {
+    const line = String(text ?? '').trim();
+    if (line) worker.stderr.emit('data', line);
+  };
+
+  let ended = false;
+  let stream = null;
+  const answered = new Set();
+
+  const stop = async () => {
+    if (ended) return;
+    ended = true;
+    try { stream?.close(); } catch { /* already closed */ }
+    if (worker.sessionId) { try { await client.abort(worker.sessionId); } catch { /* the run is over either way */ } }
+  };
+
+  /**
+   * One card, and the reply that releases or refuses the tool.
+   *
+   * The id is remembered BEFORE the card is raised, so a request the stream
+   * repeats -- which it does, `permission.asked` can arrive again for a request
+   * still open -- costs one card and not two.
+   */
+  const decide = async (type, properties) => {
+    const id = properties?.id;
+    const session = properties?.sessionID;
+    if (!id || session !== worker.sessionId || answered.has(id)) return;
+    answered.add(id);
+
+    let allowed = false;
+    try {
+      allowed = onApproval ? await onApproval(type, properties) === true : false;
+    } catch (error) {
+      say(`${Name} could not ask about ${String(properties?.metadata?.command ?? 'a tool call')}: ${error?.message ?? error}`);
+      allowed = false;
+    }
+    if (ended) allowed = false;
+
+    try {
+      await client.replyPermission(session, id, allowed ? ALLOW : DENY);
+    } catch (error) {
+      say(`OpenCode did not take the answer to that question: ${error?.message ?? error}`);
+    }
+  };
+
+  const run = async () => {
+    try {
+      if (!worker.sessionId) {
+        const session = await client.createSession({ ...(title ? { title } : {}), ...(cwd ? { directory: cwd } : {}) });
+        worker.sessionId = session?.id ?? null;
+        if (!worker.sessionId) throw Error('OpenCode did not name the session it opened');
+      }
+
+      // The stream is opened BEFORE the prompt. Opening it after is a race the
+      // fast answers win: `permission.asked` for the first tool call can beat
+      // our own subscription, and nothing would ever answer that card.
+      stream = client.events();
+      const reading = (async () => {
+        for await (const event of stream) {
+          if (ended) return;
+          const type = String(event?.type ?? '');
+          const properties = event?.properties ?? {};
+          worker.emit('event', type, properties);
+          if (ASKED.has(type)) { await decide(type, properties); continue; }
+          if (properties?.sessionID && properties.sessionID !== worker.sessionId) continue;
+          if (type === 'session.error') {
+            worker.error = properties?.error ?? 'OpenCode reported an error';
+            return;
+          }
+          if (type === 'session.idle') return;
+        }
+      })();
+
+      await client.prompt(worker.sessionId, {
+        ...splitModel(plan.model),
+        ...(plan.agent ? { agent: plan.agent } : {}),
+        parts: [{ type: 'text', text: String(plan.prompt ?? '') }],
+      });
+
+      await reading;
+    } catch (error) {
+      worker.error = error?.message ?? String(error);
+      say(worker.error);
+    } finally {
+      const already = ended;
+      ended = true;
+      try { stream?.close(); } catch { /* already closed */ }
+      if (!already && worker.sessionId) { try { await client.abort(worker.sessionId); } catch { /* nothing left to stop */ } }
+      worker.emit('exit', worker.error ? 1 : 0, null);
+    }
+  };
+
+  worker.kill = () => { void stop(); };
+  worker.done = run();
+  return worker;
+}

package/main/opencode.mjs

@@ -0,0 +1,287 @@
+// READING AN OPENCODE RUN, IN OPENCODE'S OWN WORDS.
+//
+// The same five readers Claude Code and Codex each provide -- capture, live
+// text, summary, trace, activity -- over OpenCode's `/event` stream. Nothing
+// here translates an OpenCode event into a pretend Claude JSON line or a
+// pretend Codex notification, for the reason docs/harnesses.md gives: the
+// vocabularies are not the same shape and a fake one loses what the real one
+// carries. OpenCode's `edit` approval, for instance, arrives with a whole
+// unified diff in it, which neither of the other two does.
+//
+// EVERY SHAPE BELOW WAS READ OFF A RUNNING OPENCODE 1.18.35 ON 2026-10-07,
+// not off the docs, which do not enumerate the event payloads at all. The
+// ones that matter:
+//
+//   session.updated          properties.info.{cost,tokens,title,model,directory}
+//   message.part.updated     properties.part.type: text | reasoning | tool |
+//                            step-start | step-finish
+//   message.part.delta       properties.{partID,field,delta}   ("field":"text")
+//   permission.asked         properties.{id,sessionID,permission,patterns,
+//                            metadata:{command} | metadata:{filepath,diff}}
+//   session.idle             properties.sessionID
+//   session.error            properties.{sessionID,error}
+//
+// A tool part carries `state.status` of pending | running | completed | error,
+// with `state.input`, `state.output` and `state.error` beside it.
+
+/** How much streamed prose is kept before it is dropped, as the others do. */
+const SAYING_CAP = 20_000;
+
+/** Tool names worth naming on the row, in the words a person would use. */
+const TOOL_WORDS = {
+  bash: 'Bash', edit: 'Edit', write: 'Write', read: 'Read', glob: 'Glob',
+  grep: 'Grep', list: 'List', webfetch: 'Fetch', websearch: 'Search',
+  task: 'Task', todowrite: 'Todo', patch: 'Edit', skill: 'Skill',
+};
+
+const toolWord = name => {
+  const id = String(name ?? '').trim();
+  if (!id) return null;
+  return TOOL_WORDS[id.toLowerCase()] ?? id;
+};
+
+const partOf = properties => (properties && typeof properties === 'object' ? properties.part ?? null : null);
+
+/**
+ * WHAT THE RUN WAS, kept on the session as it goes.
+ *
+ * `sessionId` is the one OpenCode resumes by, and it is on nearly every event
+ * as `properties.sessionID`. It is taken from the first event that carries one
+ * rather than from the session-creation response, so a resumed run and a fresh
+ * one record it the same way.
+ *
+ * The result is the LAST assistant text of the turn. OpenCode has no single
+ * "here is the answer" event the way Codex's `turn/completed` does: prose
+ * arrives as `text` parts that are updated in place, and the final one is the
+ * answer. So each completed text part overwrites the last, and whatever is
+ * standing when the session goes idle is the result.
+ */
+export function captureOpenCodeEvent(session, type, properties) {
+  try {
+    if (!session || typeof type !== 'string') return;
+    const p = properties ?? {};
+    if (!session.sessionId && typeof p.sessionID === 'string' && p.sessionID) session.sessionId = p.sessionID;
+
+    if (type === 'session.updated') {
+      const info = p.info ?? {};
+      if (Number.isFinite(info.cost)) session.opencodeCost = info.cost;
+      if (info.tokens && typeof info.tokens === 'object') session.opencodeTokens = info.tokens;
+      return;
+    }
+
+    if (type === 'session.error') {
+      session.result = openCodeErrorText(p.error) ?? 'OpenCode stopped with an error it did not name.';
+      session.resultIsError = true;
+      return;
+    }
+
+    if (type === 'message.part.updated') {
+      const part = partOf(p);
+      if (!part) return;
+      // A WRITE THIS RUN MADE, so the card can say what changed. The `edit` and
+      // `write` tools report the file they touched in `state.input.filePath`,
+      // which is the only place a path appears for a change OpenCode has
+      // already applied.
+      if (part.type === 'tool' && part.state?.status === 'completed') {
+        const path = part.state?.input?.filePath ?? part.state?.input?.path;
+        if (typeof path === 'string' && path && (part.tool === 'edit' || part.tool === 'write' || part.tool === 'patch')) {
+          session.opencodeChange ??= [];
+          if (!session.opencodeChange.includes(path)) session.opencodeChange.push(path);
+        }
+      }
+      if (part.type === 'step-finish') {
+        if (Number.isFinite(part.cost)) session.opencodeStepCost = part.cost;
+        if (part.tokens && typeof part.tokens === 'object') session.opencodeTokens = part.tokens;
+      }
+      // Only the assistant's prose is an answer. `reasoning` is the model
+      // thinking out loud and is never the result, which is why it is matched
+      // by name here rather than falling through to the text branch.
+      if (part.type === 'text') {
+        const text = String(part.text ?? '').trim();
+        if (text) { session.result = text; session.resultIsError = false; }
+      }
+      return;
+    }
+  } catch {
+    // A reader that throws kills a run that was going fine. Same rule as the
+    // other two harnesses: read what parses and ignore what does not.
+  }
+}
+
+/** The error on `session.error`, which is an object and not a string. */
+export function openCodeErrorText(error) {
+  if (!error) return null;
+  if (typeof error === 'string') return error.trim() || null;
+  const name = typeof error.name === 'string' ? error.name : '';
+  const message = typeof error.data?.message === 'string' ? error.data.message
+    : typeof error.message === 'string' ? error.message : '';
+  const joined = [name, message].filter(Boolean).join(': ');
+  return joined || null;
+}
+
+/**
+ * THE PROSE AS IT IS TYPED, for the line on the row that moves.
+ *
+ * Deltas arrive as `message.part.delta` with a `field` saying which field of
+ * which part is growing. Only `text` is shown: `reasoning` deltas are the
+ * model's private thinking, and streaming those onto her row would put words
+ * on screen that are not what the run decided.
+ */
+export function openCodeStreamingText(session, type, properties) {
+  try {
+    if (!session) return false;
+    const p = properties ?? {};
+
+    if (type === 'message.part.updated') {
+      const part = partOf(p);
+      // A tool starting means the talking stopped. What is already typed stays
+      // until the trace carries the same words, exactly as Codex's reader does.
+      if (part?.type === 'text' && !String(part.text ?? '')) { session.saying = ''; session.sayingAt = Date.now(); return true; }
+      return false;
+    }
+
+    if (type !== 'message.part.delta') return false;
+    if (p.field !== 'text') return false;
+    const piece = String(p.delta ?? '');
+    if (!piece) return false;
+    // A delta for a reasoning part has the same `field: "text"`, so the part it
+    // belongs to is what tells them apart. Without a remembered prose part id
+    // nothing is streamed, which is the quiet answer rather than the wrong one.
+    if (session.opencodeProsePart && p.partID && p.partID !== session.opencodeProsePart) return false;
+    if (!session.sayingAt) session.sayingAt = Date.now();
+    const next = (session.saying ?? '') + piece;
+    session.saying = next.length > SAYING_CAP ? '' : next;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Which part the prose is going into, so reasoning deltas can be told apart. */
+export function rememberOpenCodeProsePart(session, type, properties) {
+  if (!session || type !== 'message.part.updated') return;
+  const part = partOf(properties);
+  if (part?.type === 'text' && typeof part.id === 'string') session.opencodeProsePart = part.id;
+  if (part?.type === 'step-start') session.opencodeProsePart = null;
+}
+
+/** One short line for the row: what it just did. */
+export function summarizeOpenCodeEvent(type, properties) {
+  try {
+    const p = properties ?? {};
+    if (type !== 'message.part.updated') return null;
+    const part = partOf(p);
+    if (!part) return null;
+    if (part.type === 'text') {
+      const text = String(part.text ?? '').trim();
+      return text ? text.slice(0, 300) : null;
+    }
+    if (part.type === 'tool' && part.state?.status === 'completed') {
+      const word = toolWord(part.tool);
+      return word ? `tool: ${word}` : null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** One line for the run trace, the record she can open afterwards. */
+export function traceOpenCodeEvent(type, properties) {
+  try {
+    const p = properties ?? {};
+    const at = new Date().toISOString().slice(11, 19);
+
+    if (type === 'session.error') {
+      const text = openCodeErrorText(p.error);
+      return text ? `${at}  [error] ${text.slice(0, 300)}` : null;
+    }
+
+    if (type !== 'message.part.updated') return null;
+    const part = partOf(p);
+    if (!part) return null;
+
+    if (part.type === 'text') {
+      const text = String(part.text ?? '').trim();
+      return text ? `${at}  ${text}` : null;
+    }
+
+    if (part.type === 'tool' && (part.state?.status === 'completed' || part.state?.status === 'error')) {
+      const word = toolWord(part.tool);
+      if (!word) return null;
+      const input = part.state?.input ?? {};
+      const detail = String(input.command ?? input.filePath ?? input.path ?? input.pattern ?? '').trim();
+      const failed = part.state?.status === 'error' ? ' (refused)' : '';
+      return `${at}  [${word}]${failed}${detail ? ` ${detail.slice(0, 200)}` : ''}`;
+    }
+
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** What it is doing right now, for the row's activity line. */
+export function openCodeActivity(type, properties) {
+  try {
+    if (type !== 'message.part.updated') return null;
+    const part = partOf(properties);
+    if (part?.type !== 'tool') return null;
+    if (part.state?.status !== 'pending' && part.state?.status !== 'running') return null;
+    const word = toolWord(part.tool);
+    return word ? { tool: word } : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * THE APPROVAL, IN THE WORDS A CARD NEEDS.
+ *
+ * `bash` asks carry `metadata.command`. `edit` asks carry `metadata.filepath`
+ * AND `metadata.diff`, a whole unified diff of the change it wants to make --
+ * measured, not assumed. That is strictly more than a Codex patch approval
+ * arrives with, and it means an OpenCode card can show the change itself
+ * rather than a filename.
+ */
+export function openCodeApprovalCard(properties) {
+  const p = properties ?? {};
+  const kind = typeof p.permission === 'string' ? p.permission : '';
+  const metadata = p.metadata ?? {};
+  const command = typeof metadata.command === 'string' ? metadata.command.trim() : '';
+  const filepath = typeof metadata.filepath === 'string' ? metadata.filepath.trim() : '';
+  const diff = typeof metadata.diff === 'string' ? metadata.diff : '';
+  const patterns = Array.isArray(p.patterns) ? p.patterns.filter(x => typeof x === 'string') : [];
+
+  if (command) return { kind: kind || 'bash', title: 'Run a command', detail: command, command, patterns };
+  if (filepath) return { kind: kind || 'edit', title: 'Change a file', detail: filepath, filepath, diff, patterns };
+  return { kind: kind || 'tool', title: 'Use a tool', detail: patterns.join(', ') || kind || 'a tool', patterns };
+}
+
+/**
+ * THE PERMISSION POLICY A WORKER RUNS UNDER, as OpenCode's own config.
+ *
+ * This is the whole reason Agentbox can draw a card for OpenCode at all.
+ * Measured 2026-10-07: with no permission config the server runs shell
+ * commands and writes files with no card; with this config it raises
+ * `permission.asked` and waits. The server reports back what it loaded at
+ * `GET /config`, which is how the adapter can tell the policy really took.
+ *
+ * `read`, `glob`, `grep` and `list` are deliberately left alone: a card for
+ * every file read is the 2026-08-05 card flood again, and reading inside the
+ * task's own folder is what the folder is for.
+ */
+export function openCodePermissionConfig() {
+  return {
+    $schema: 'https://opencode.ai/config.json',
+    permission: {
+      bash: 'ask',
+      edit: 'ask',
+      webfetch: 'ask',
+      websearch: 'ask',
+      external_directory: 'ask',
+      task: 'allow',
+      todowrite: 'allow',
+    },
+  };
+}