backeer-opencode 0.1.2 → 0.1.4

package/dist/backeer-permission.js

@@ -0,0 +1,935 @@
+// src/config.js
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/utilities.js
+var MAX_TRACKED_ITEMS = 500;
+var limit = (value, length = 1e3) => String(value ?? "").slice(0, length);
+function enabled(value, fallback = true) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return fallback;
+  return !["0", "false", "no", "off"].includes(value.trim().toLowerCase());
+}
+function stableHash(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index++) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function rememberBounded(map, key, value) {
+  map.delete(key);
+  map.set(key, value);
+  while (map.size > MAX_TRACKED_ITEMS) map.delete(map.keys().next().value);
+}
+
+// src/reporter.js
+var LOG_LEVELS = /* @__PURE__ */ new Set(["silent", "error", "info", "debug"]);
+var LOG_RANK = { silent: 0, error: 1, info: 2, debug: 3 };
+var LOG_DEDUPLICATION_MS = 3e4;
+function normalizeLogLevel(value) {
+  const level = String(value ?? "info").trim().toLowerCase();
+  return LOG_LEVELS.has(level) ? level : "info";
+}
+function createConsoleReporter(levelValue) {
+  const level = normalizeLogLevel(levelValue);
+  const useColor = Boolean(process.stdout?.isTTY) && !("NO_COLOR" in process.env) && process.env.TERM !== "dumb";
+  const recentlyEmitted = /* @__PURE__ */ new Map();
+  const decorate = (code, text) => useColor ? `\x1B[${code}m${text}\x1B[0m` : text;
+  const symbols = {
+    info: decorate("36", "\u25C6"),
+    success: decorate("32", "\u25C6"),
+    applied: decorate("32", "\u2713"),
+    warning: decorate("33", "!"),
+    error: decorate("31", "\xD7"),
+    debug: decorate("2", "\xB7")
+  };
+  const brand = decorate("1", "Backeer");
+  function emit(requiredLevel, kind, message, detail, deduplicate = false) {
+    if (LOG_RANK[level] < LOG_RANK[requiredLevel]) return;
+    const key = `${kind}:${message}`;
+    const now = Date.now();
+    if (deduplicate) {
+      const previous = recentlyEmitted.get(key);
+      if (previous && now - previous < LOG_DEDUPLICATION_MS) return;
+      recentlyEmitted.delete(key);
+      recentlyEmitted.set(key, now);
+      while (recentlyEmitted.size > 100) {
+        recentlyEmitted.delete(recentlyEmitted.keys().next().value);
+      }
+    }
+    const technical = level === "debug" && detail ? decorate("2", ` \xB7 ${limit(detail, 500)}`) : "";
+    const line = `${symbols[kind]} ${brand}  ${message}${technical}`;
+    if (kind === "error" || kind === "warning") console.error(line);
+    else console.log(line);
+  }
+  return {
+    info: (message, detail) => emit("info", "info", message, detail),
+    success: (message, detail) => emit("info", "success", message, detail),
+    applied: (message, detail) => emit("info", "applied", message, detail),
+    warning: (message, detail) => emit("error", "warning", message, detail, true),
+    error: (message, detail) => emit("error", "error", message, detail, true),
+    debug: (message, detail) => emit("debug", "debug", message, detail)
+  };
+}
+
+// src/config.js
+var DEFAULT_ORIGIN = "https://external-gateway.backeer.com";
+function defaultConfigDirectory() {
+  const base = process.env.XDG_CONFIG_HOME?.trim();
+  return base ? join(base, "opencode") : join(homedir(), ".config", "opencode");
+}
+function loadToken(tokenFile) {
+  const environmentToken = process.env.BACKEER_INGEST_TOKEN?.trim();
+  if (environmentToken) return { token: environmentToken, source: "environment" };
+  try {
+    const token = readFileSync(tokenFile, "utf8").trim();
+    return { token, source: token ? "file" : "missing" };
+  } catch {
+    return { token: "", source: "missing" };
+  }
+}
+function loadConfig(options = {}) {
+  const origin = new URL(
+    options.origin ?? process.env.BACKEER_ORIGIN ?? DEFAULT_ORIGIN
+  );
+  if (origin.protocol !== "https:") {
+    throw new Error("Backeer origin must use HTTPS");
+  }
+  const tokenFile = options.tokenFile ?? process.env.BACKEER_TOKEN_FILE ?? join(defaultConfigDirectory(), "secrets", "backeer-ingest-token");
+  const loadedToken = loadToken(tokenFile);
+  return {
+    origin,
+    eventsEndpoint: new URL("/v1/events", origin),
+    commandStreamEndpoint: new URL("/v1/commands/stream", origin),
+    token: loadedToken.token,
+    tokenSource: loadedToken.source,
+    tokenFile,
+    permissions: enabled(
+      options.permissions ?? process.env.BACKEER_NOTIFY_PERMISSIONS
+    ),
+    questions: enabled(
+      options.questions ?? process.env.BACKEER_NOTIFY_QUESTIONS
+    ),
+    todos: enabled(options.todos ?? process.env.BACKEER_NOTIFY_TODOS),
+    logLevel: normalizeLogLevel(
+      options.logLevel ?? process.env.BACKEER_LOG_LEVEL
+    )
+  };
+}
+
+// src/http.js
+var RETRY_DELAYS_MS = [0, 500, 1500];
+var HttpError = class extends Error {
+  constructor(message, status, responseBody = "") {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.responseBody = responseBody;
+  }
+};
+function isRetryable(status) {
+  return status === 429 || status >= 500;
+}
+function isAbortError(error) {
+  return error instanceof Error && error.name === "AbortError";
+}
+function sleep(milliseconds, signal) {
+  return new Promise((resolve2) => {
+    if (signal?.aborted) {
+      resolve2();
+      return;
+    }
+    const timeout = setTimeout(done, milliseconds);
+    function done() {
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", done);
+      resolve2();
+    }
+    signal?.addEventListener("abort", done, { once: true });
+  });
+}
+async function postJsonWithRetry(config, url, body, options = {}) {
+  const retryDelays = options.retryDelays ?? RETRY_DELAYS_MS;
+  for (let attempt = 0; attempt < retryDelays.length; attempt++) {
+    if (retryDelays[attempt] > 0) {
+      await sleep(retryDelays[attempt], options.signal);
+    }
+    if (options.signal?.aborted) throw new DOMException("Aborted", "AbortError");
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    const timeout = setTimeout(abort, options.timeoutMs ?? 5e3);
+    options.signal?.addEventListener("abort", abort, { once: true });
+    try {
+      const response = await fetch(url, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${config.token}`,
+          "Content-Type": "application/json",
+          ...options.headers
+        },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      const responseBody = limit(await response.text(), 1e3);
+      if (response.ok) return { status: response.status, responseBody };
+      if (!isRetryable(response.status) || attempt === retryDelays.length - 1) {
+        throw new HttpError(
+          `HTTP request failed with status ${response.status}`,
+          response.status,
+          responseBody
+        );
+      }
+    } catch (error) {
+      if (options.signal?.aborted) throw new DOMException("Aborted", "AbortError");
+      if (error instanceof HttpError) throw error;
+      if (attempt === retryDelays.length - 1) throw error;
+    } finally {
+      clearTimeout(timeout);
+      options.signal?.removeEventListener("abort", abort);
+    }
+  }
+  throw new Error("HTTP retry loop ended unexpectedly");
+}
+
+// src/event-publishers.js
+var ACTION_PROTOCOL = "opencode-permission/v1";
+function permissionIdentity(request) {
+  const requestID = request.id ?? request.requestID;
+  const sessionID = request.sessionID;
+  if (typeof requestID !== "string" || typeof sessionID !== "string") return;
+  return {
+    requestID,
+    sessionID,
+    externalId: `opencode:${sessionID}:${requestID}`
+  };
+}
+async function publishPermission(config, reporter, request, directory, identity) {
+  const permissionType = request.permission ?? request.action ?? "unknown";
+  const resources = Array.isArray(request.patterns) ? request.patterns.join(", ") : Array.isArray(request.resources) ? request.resources.join(", ") : "";
+  const payload = [
+    { key: "Permission", value: limit(permissionType) },
+    { key: "Session", value: limit(identity.sessionID) },
+    { key: "Request ID", value: limit(identity.requestID) },
+    { key: "Patterns", value: limit(resources) },
+    { key: "Working directory", value: limit(directory) },
+    { key: "Action protocol", value: ACTION_PROTOCOL },
+    { key: "Available decisions", value: "once, always, reject" }
+  ].filter((item) => item.value.length > 0);
+  const result = await postJsonWithRetry(config, config.eventsEndpoint, {
+    type: "application",
+    severity: "warning",
+    title: `OpenCode permission required: ${limit(permissionType, 200)}`,
+    body: resources ? `OpenCode is waiting for approval to access: ${limit(resources, 500)}` : `OpenCode is waiting for approval for: ${limit(permissionType, 500)}`,
+    payload,
+    externalId: identity.externalId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    notify: true,
+    direction: "in"
+  });
+  reporter.success("Permission request sent", `HTTP ${result.status}`);
+}
+function questionIdentity(request) {
+  const requestID = request.id ?? request.requestID;
+  const sessionID = request.sessionID;
+  if (typeof requestID !== "string" || typeof sessionID !== "string") return;
+  return {
+    requestID,
+    sessionID,
+    externalId: `opencode-question:${sessionID}:${requestID}`
+  };
+}
+function formatQuestionOptions(options) {
+  if (!Array.isArray(options)) return "";
+  return options.map((option) => {
+    const label = limit(option?.label, 200);
+    const description = limit(option?.description, 500);
+    if (!label) return "";
+    return description ? `${label} \u2014 ${description}` : label;
+  }).filter(Boolean).join(" | ");
+}
+async function resolveSessionTitle(client, directory, sessionID, reporter) {
+  if (typeof client?.session?.get !== "function") return "";
+  try {
+    const result = await client.session.get({
+      path: { id: sessionID },
+      query: { directory },
+      throwOnError: true
+    });
+    return limit((result?.data ?? result)?.title);
+  } catch (error) {
+    reporter.debug("Session title unavailable", error);
+    return "";
+  }
+}
+async function publishQuestion(config, reporter, request, identity, client, directory) {
+  const questions = Array.isArray(request.questions) ? request.questions : [];
+  if (questions.length === 0) return;
+  const sessionTitle = await resolveSessionTitle(
+    client,
+    directory,
+    identity.sessionID,
+    reporter
+  );
+  const payload = [
+    { key: "OpenCode session", value: sessionTitle },
+    ...questions.flatMap((question, index) => {
+      const suffix = questions.length > 1 ? ` ${index + 1}` : "";
+      return [
+        { key: `Question title${suffix}`, value: limit(question?.header) },
+        { key: `Question${suffix}`, value: limit(question?.question) },
+        {
+          key: `Options${suffix}`,
+          value: limit(formatQuestionOptions(question?.options))
+        }
+      ];
+    })
+  ].filter((item) => item.value.length > 0);
+  const firstQuestion = questions[0];
+  const body = questions.map((question) => {
+    const header = limit(question?.header, 200);
+    const text = limit(question?.question, 500);
+    const options = limit(formatQuestionOptions(question?.options), 500);
+    return [header, text, options ? `Options: ${options}` : ""].filter(Boolean).join("\n");
+  }).join("\n\n");
+  const result = await postJsonWithRetry(config, config.eventsEndpoint, {
+    type: "application",
+    severity: "info",
+    title: `OpenCode question: ${limit(firstQuestion?.header, 200) || "Question"}`,
+    body: limit(body, 2e3),
+    payload,
+    externalId: identity.externalId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    notify: true,
+    direction: "in"
+  });
+  reporter.success("Question sent", `HTTP ${result.status}`);
+}
+async function publishTodoCompletion(config, reporter, request, eventID, client, directory) {
+  const todos = request.todos;
+  const sessionTitle = await resolveSessionTitle(
+    client,
+    directory,
+    request.sessionID,
+    reporter
+  );
+  const correlation = typeof eventID === "string" && eventID.length > 0 ? limit(eventID, 200) : stableHash(JSON.stringify(todos));
+  const externalId = `opencode-todo:${request.sessionID}:${correlation}`;
+  const visibleTodos = todos.slice(0, 20);
+  const payload = [
+    { key: "OpenCode session", value: sessionTitle },
+    { key: "Completed tasks", value: String(todos.length) },
+    ...visibleTodos.flatMap((todo, index) => [
+      { key: `Task ${index + 1}`, value: limit(todo?.content) },
+      { key: `Priority ${index + 1}`, value: limit(todo?.priority, 100) }
+    ]),
+    ...todos.length > visibleTodos.length ? [{ key: "Additional tasks", value: String(todos.length - visibleTodos.length) }] : []
+  ].filter((item) => item.value.length > 0);
+  const summary = todos.slice(0, 5).map((todo) => limit(todo?.content, 200)).filter(Boolean).join(" \u2022 ");
+  const location = sessionTitle ? ` in ${sessionTitle}` : "";
+  const body = [
+    `All ${todos.length} OpenCode tasks completed${location}.`,
+    summary
+  ].filter(Boolean).join("\n");
+  const result = await postJsonWithRetry(config, config.eventsEndpoint, {
+    type: "application",
+    severity: "info",
+    title: "OpenCode todo list completed",
+    body: limit(body, 2e3),
+    payload,
+    externalId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    notify: true,
+    direction: "in"
+  });
+  reporter.success("Todo completion sent", `HTTP ${result.status}`);
+}
+
+// src/management.js
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync as readFileSync2,
+  renameSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { dirname, resolve } from "node:path";
+var PLUGIN_VERSION = "0.1.4";
+var COMMAND_DESCRIPTION = "Show Backeer status or manage its token: /backeer [status|token|token-file PATH]";
+function tokenFileState(path) {
+  try {
+    const stats = statSync(path);
+    const mode = (stats.mode & 511).toString(8).padStart(3, "0");
+    return stats.isFile() ? `present (mode ${mode})` : "not a regular file";
+  } catch {
+    return "missing";
+  }
+}
+function cleanPathArgument(value) {
+  const path = value.trim();
+  if (path.length >= 2 && (path.startsWith('"') && path.endsWith('"') || path.startsWith("'") && path.endsWith("'"))) {
+    return path.slice(1, -1);
+  }
+  return path;
+}
+function writeTokenAtomically(path, token) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const temporaryPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporaryPath, `${token}
+`, { encoding: "utf8", mode: 384 });
+  chmodSync(temporaryPath, 384);
+  renameSync(temporaryPath, path);
+}
+function rotateTokenFromFile(config, sourcePathValue) {
+  if (!sourcePathValue.trim()) throw new Error("A token file path is required");
+  const sourcePath = resolve(cleanPathArgument(sourcePathValue));
+  const sourceStats = statSync(sourcePath);
+  if (!sourceStats.isFile()) throw new Error("The token source is not a regular file");
+  if ((sourceStats.mode & 63) !== 0) {
+    throw new Error("The token source must not be readable by group or other users");
+  }
+  const token = readFileSync2(sourcePath, "utf8").trim();
+  if (!token || /\s/.test(token)) {
+    throw new Error("The token source must contain exactly one non-empty token");
+  }
+  const targetPath = resolve(config.tokenFile);
+  if (sourcePath !== targetPath) writeTokenAtomically(targetPath, token);
+  else chmodSync(targetPath, 384);
+  config.token = token;
+  config.tokenSource = "file";
+  return targetPath;
+}
+async function probeGateway(config) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3e3);
+  try {
+    const response = await fetch(config.origin, {
+      method: "HEAD",
+      redirect: "manual",
+      signal: controller.signal
+    });
+    return `reachable (HTTP ${response.status}; authentication not tested)`;
+  } catch {
+    return "unreachable";
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function buildStatus(config, permissionController) {
+  const gateway = await probeGateway(config);
+  const permissionStatus = permissionController.status();
+  return [
+    "## Backeer status",
+    "",
+    `- Plugin version: ${PLUGIN_VERSION}`,
+    `- Gateway: ${config.origin.origin} \u2014 ${gateway}`,
+    `- Token: ${config.token ? `configured via ${config.tokenSource}` : "missing"}`,
+    `- Token file: ${config.tokenFile} \u2014 ${tokenFileState(config.tokenFile)}`,
+    `- Permission notifications: ${config.permissions ? "enabled" : "disabled"}`,
+    `- Question notifications: ${config.questions ? "enabled" : "disabled"}`,
+    `- Todo notifications: ${config.todos ? "enabled" : "disabled"}`,
+    `- Command stream: ${permissionStatus.stream}`,
+    `- Pending permissions: ${permissionStatus.pending}`,
+    `- Log level: ${config.logLevel}`,
+    "",
+    "The token value is never displayed."
+  ].join("\n");
+}
+function helpMessage() {
+  return [
+    "## Backeer commands",
+    "",
+    "- `/backeer` or `/backeer status` \u2014 show integration status",
+    "- `/backeer token` \u2014 show secure token-change instructions",
+    "- `/backeer token-file /absolute/protected/path` \u2014 import and activate a token",
+    "",
+    "Never place a token directly in a slash command. Slash-command arguments may be stored in session history."
+  ].join("\n");
+}
+function tokenInstructions() {
+  return [
+    "## Change the Backeer token securely",
+    "",
+    "Do not paste the token into OpenCode or `/backeer` arguments.",
+    "",
+    "Use either:",
+    "",
+    "1. Hidden terminal input: `npx backeer-opencode@latest configure`",
+    "2. A protected file: `chmod 600 /path/to/token && /backeer token-file /path/to/token`",
+    "",
+    "`token-file` activates the new token immediately; no OpenCode restart is required."
+  ].join("\n");
+}
+async function sendCommandMessage(client, sessionID, text) {
+  if (typeof client?.session?.prompt !== "function") {
+    throw new Error("OpenCode session messaging is unavailable");
+  }
+  await client.session.prompt({
+    path: { id: sessionID },
+    body: {
+      noReply: true,
+      parts: [{ type: "text", text, ignored: true }]
+    }
+  });
+}
+function registerBackeerCommand(opencodeConfig) {
+  opencodeConfig.command ??= {};
+  opencodeConfig.command.backeer = {
+    template: "",
+    description: COMMAND_DESCRIPTION
+  };
+}
+function createBackeerCommandHandler({
+  client,
+  config,
+  permissionController,
+  reporter
+}) {
+  return async (input, output) => {
+    if (input.command !== "backeer") return;
+    output.parts.length = 0;
+    const argumentsValue = (input.arguments ?? "").trim();
+    const separator = argumentsValue.indexOf(" ");
+    const subcommand = (separator === -1 ? argumentsValue : argumentsValue.slice(0, separator)).toLowerCase();
+    const subcommandArguments = separator === -1 ? "" : argumentsValue.slice(separator + 1).trim();
+    let message;
+    try {
+      if (!subcommand || subcommand === "status") {
+        message = await buildStatus(config, permissionController);
+      } else if (subcommand === "token") {
+        message = tokenInstructions();
+      } else if (subcommand === "token-file") {
+        const targetPath = rotateTokenFromFile(config, subcommandArguments);
+        permissionController.refreshCredentials();
+        reporter.success("Access token updated");
+        message = [
+          "## Backeer token updated",
+          "",
+          `- Protected token file: ${targetPath}`,
+          "- File mode: 600",
+          "- The new token is active immediately."
+        ].join("\n");
+      } else {
+        message = helpMessage();
+      }
+    } catch (error) {
+      reporter.error("Access token could not be updated", error);
+      message = [
+        "## Backeer command failed",
+        "",
+        error instanceof Error ? error.message : String(error),
+        "",
+        "Use `/backeer token` for secure token-change instructions."
+      ].join("\n");
+    }
+    await sendCommandMessage(client, input.sessionID, message);
+  };
+}
+
+// src/sse.js
+function parseSseFrame(frame) {
+  const data = [];
+  let event = "message";
+  let id;
+  for (const line of frame.split(/\r?\n/)) {
+    if (!line || line.startsWith(":")) continue;
+    const separator = line.indexOf(":");
+    const field = separator === -1 ? line : line.slice(0, separator);
+    let value = separator === -1 ? "" : line.slice(separator + 1);
+    if (value.startsWith(" ")) value = value.slice(1);
+    if (field === "event") event = value;
+    if (field === "id") id = value;
+    if (field === "data") data.push(value);
+  }
+  if (data.length === 0) return;
+  return { event, id, data: data.join("\n") };
+}
+function nextSseFrame(buffer) {
+  const lfIndex = buffer.indexOf("\n\n");
+  const crlfIndex = buffer.indexOf("\r\n\r\n");
+  if (lfIndex === -1 && crlfIndex === -1) return;
+  if (crlfIndex !== -1 && (lfIndex === -1 || crlfIndex < lfIndex)) {
+    return {
+      frame: buffer.slice(0, crlfIndex),
+      rest: buffer.slice(crlfIndex + 4)
+    };
+  }
+  return { frame: buffer.slice(0, lfIndex), rest: buffer.slice(lfIndex + 2) };
+}
+async function consumeSse(response, state, onCommand, signal, reporter) {
+  if (!response.body) throw new Error("Backeer command stream has no body");
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  try {
+    while (!signal.aborted) {
+      const item = await reader.read();
+      if (item.done) break;
+      buffer += decoder.decode(item.value, { stream: true });
+      for (; ; ) {
+        const next = nextSseFrame(buffer);
+        if (!next) break;
+        buffer = next.rest;
+        const message = parseSseFrame(next.frame);
+        if (!message) continue;
+        if (message.id) state.lastEventID = message.id;
+        if (message.event !== "message" && message.event !== "command") continue;
+        try {
+          await onCommand(JSON.parse(message.data));
+        } catch (error) {
+          if (error instanceof SyntaxError) {
+            reporter.error("Invalid command received", "SSE data is not valid JSON");
+            continue;
+          }
+          throw error;
+        }
+      }
+    }
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+}
+async function runCommandStream(config, reporter, { signal, hasPending, onCommand }) {
+  const state = { lastEventID: "" };
+  let reconnectDelay = 1e3;
+  let lastLoggedError = "";
+  while (!signal.aborted && hasPending()) {
+    try {
+      const headers = {
+        Accept: "text/event-stream",
+        Authorization: `Bearer ${config.token}`
+      };
+      if (state.lastEventID) headers["Last-Event-ID"] = state.lastEventID;
+      const response = await fetch(config.commandStreamEndpoint, {
+        headers,
+        signal
+      });
+      if (!response.ok) {
+        const responseBody = limit(await response.text(), 500);
+        throw new HttpError(
+          `Backeer command stream failed with status ${response.status}`,
+          response.status,
+          responseBody
+        );
+      }
+      if (!response.headers.get("content-type")?.includes("text/event-stream")) {
+        throw new Error("Backeer command stream returned an invalid content type");
+      }
+      reconnectDelay = 1e3;
+      lastLoggedError = "";
+      await consumeSse(response, state, onCommand, signal, reporter);
+    } catch (error) {
+      if (signal.aborted || isAbortError(error)) return;
+      const message = error instanceof HttpError ? `${error.message}: ${error.responseBody}` : limit(error, 500);
+      if (message !== lastLoggedError) {
+        const authenticationFailure = error instanceof HttpError && [401, 403].includes(error.status);
+        reporter.error(
+          authenticationFailure ? "Authentication failed \u2014 run: npx backeer-opencode@latest configure" : "Connection interrupted \u2014 retrying",
+          message
+        );
+        lastLoggedError = message;
+      }
+      if (error instanceof HttpError && [401, 403, 404].includes(error.status)) {
+        reconnectDelay = 6e4;
+      }
+    }
+    if (!signal.aborted && hasPending()) {
+      await sleep(reconnectDelay, signal);
+      reconnectDelay = Math.min(reconnectDelay * 2, 6e4);
+    }
+  }
+}
+
+// src/permission-controller.js
+var ALLOWED_DECISIONS = /* @__PURE__ */ new Set(["once", "always", "reject"]);
+var DECISION_LABELS = {
+  once: "Allow once",
+  always: "Always allow",
+  reject: "Reject"
+};
+async function replyToOpenCode(client, pending, decision) {
+  const result = await client.postSessionIdPermissionsPermissionId({
+    path: { id: pending.sessionID, permissionID: pending.requestID },
+    query: { directory: pending.directory },
+    body: { response: decision },
+    throwOnError: true
+  });
+  if (result?.data === false || result === false) {
+    throw new HttpError("OpenCode did not apply the permission reply", 409);
+  }
+}
+async function acknowledgeCommand(config, commandID, acknowledgement) {
+  const url = new URL(
+    `/v1/commands/${encodeURIComponent(commandID)}/ack`,
+    config.origin
+  );
+  await postJsonWithRetry(config, url, acknowledgement);
+}
+function createPermissionController({
+  config,
+  reporter,
+  client,
+  directory
+}) {
+  const pendingByExternalID = /* @__PURE__ */ new Map();
+  const externalIDByRequestID = /* @__PURE__ */ new Map();
+  const processingCommands = /* @__PURE__ */ new Set();
+  const completedCommands = /* @__PURE__ */ new Map();
+  const publishedPermissions = /* @__PURE__ */ new Map();
+  let commandStream;
+  let disposed = false;
+  function removePendingByRequestID(requestID) {
+    const externalId = externalIDByRequestID.get(requestID);
+    if (!externalId) return;
+    externalIDByRequestID.delete(requestID);
+    pendingByExternalID.delete(externalId);
+  }
+  function stopCommandStreamIfIdle() {
+    if (pendingByExternalID.size === 0) commandStream?.controller.abort();
+  }
+  async function handleCommand(command) {
+    if (!command || typeof command !== "object") return;
+    if (command.type !== "opencode_permission_reply") return;
+    if (typeof command.id !== "string" || command.id.length > 200) return;
+    const previousAcknowledgement = completedCommands.get(command.id);
+    if (previousAcknowledgement) {
+      await acknowledgeCommand(config, command.id, previousAcknowledgement).catch((error) => reporter.warning("Decision receipt retry failed", error));
+      return;
+    }
+    if (processingCommands.has(command.id)) return;
+    if (typeof command.externalId !== "string") return;
+    const pending = pendingByExternalID.get(command.externalId);
+    if (!pending) return;
+    processingCommands.add(command.id);
+    let acknowledgement;
+    try {
+      if (!ALLOWED_DECISIONS.has(command.decision)) {
+        acknowledgement = { status: "rejected", errorCode: "invalid_decision" };
+      } else {
+        const expiresAt = Date.parse(command.expiresAt);
+        if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+          acknowledgement = { status: "expired", decision: command.decision };
+        } else if (command.decision === "always" && command.confirmed !== true) {
+          acknowledgement = {
+            status: "rejected",
+            decision: command.decision,
+            errorCode: "confirmation_required"
+          };
+        } else {
+          await replyToOpenCode(client, pending, command.decision);
+          acknowledgement = { status: "applied", decision: command.decision };
+          removePendingByRequestID(pending.requestID);
+        }
+      }
+    } catch (error) {
+      const stale = error instanceof HttpError && error.status === 404;
+      acknowledgement = {
+        status: stale ? "stale" : "failed",
+        decision: ALLOWED_DECISIONS.has(command.decision) ? command.decision : void 0,
+        errorCode: stale ? "permission_not_found" : "opencode_reply_failed"
+      };
+      if (stale) removePendingByRequestID(pending.requestID);
+      reporter.error("Decision could not be applied", error);
+    } finally {
+      processingCommands.delete(command.id);
+    }
+    acknowledgement = {
+      ...acknowledgement,
+      type: "opencode_permission_reply_ack",
+      externalId: command.externalId,
+      processedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    rememberBounded(completedCommands, command.id, acknowledgement);
+    if (acknowledgement.status === "applied") {
+      reporter.applied(
+        `Decision applied: ${DECISION_LABELS[acknowledgement.decision]}`
+      );
+    } else if (acknowledgement.status === "expired") {
+      reporter.warning("Decision expired before it could be applied");
+    } else if (acknowledgement.status === "stale") {
+      reporter.warning("Permission was already answered locally");
+    } else if (acknowledgement.status === "rejected") {
+      reporter.warning("Decision was rejected by validation");
+    }
+    await acknowledgeCommand(config, command.id, acknowledgement).catch((error) => {
+      reporter.warning("Decision receipt could not be sent", error);
+    });
+    stopCommandStreamIfIdle();
+  }
+  function ensureCommandStream() {
+    if (disposed || commandStream || pendingByExternalID.size === 0) return;
+    const controller = new AbortController();
+    const current = {
+      controller,
+      task: runCommandStream(config, reporter, {
+        signal: controller.signal,
+        hasPending: () => pendingByExternalID.size > 0,
+        onCommand: handleCommand
+      })
+    };
+    commandStream = current;
+    void current.task.finally(() => {
+      if (commandStream === current) commandStream = void 0;
+      if (!disposed && pendingByExternalID.size > 0) ensureCommandStream();
+    });
+  }
+  return {
+    register(identity) {
+      pendingByExternalID.set(identity.externalId, { ...identity, directory });
+      externalIDByRequestID.set(identity.requestID, identity.externalId);
+      ensureCommandStream();
+      if (publishedPermissions.has(identity.externalId)) return false;
+      rememberBounded(publishedPermissions, identity.externalId, true);
+      return true;
+    },
+    resolveLocally(requestID) {
+      removePendingByRequestID(requestID);
+      stopCommandStreamIfIdle();
+    },
+    refreshCredentials() {
+      commandStream?.controller.abort();
+      if (!commandStream) ensureCommandStream();
+    },
+    status() {
+      return {
+        pending: pendingByExternalID.size,
+        stream: commandStream ? "active" : "idle"
+      };
+    },
+    async dispose() {
+      disposed = true;
+      commandStream?.controller.abort();
+      await commandStream?.task.catch(() => {
+      });
+      pendingByExternalID.clear();
+      externalIDByRequestID.clear();
+      processingCommands.clear();
+      completedCommands.clear();
+      publishedPermissions.clear();
+    }
+  };
+}
+
+// src/plugin.js
+async function BackeerPlugin({ client, directory }, options = {}) {
+  const bootstrapReporter = createConsoleReporter(
+    options.logLevel ?? process.env.BACKEER_LOG_LEVEL
+  );
+  let config;
+  try {
+    config = loadConfig(options);
+  } catch (error) {
+    bootstrapReporter.error("Plugin disabled \u2014 invalid configuration", error);
+    return {};
+  }
+  const reporter = createConsoleReporter(config.logLevel);
+  const permissionController = createPermissionController({
+    config,
+    reporter,
+    client,
+    directory
+  });
+  const todoCompletionBySessionID = /* @__PURE__ */ new Map();
+  const publishedQuestions = /* @__PURE__ */ new Map();
+  const handleBackeerCommand = createBackeerCommandHandler({
+    client,
+    config,
+    permissionController,
+    reporter
+  });
+  if (!config.token) {
+    reporter.error(
+      "Notifications disabled \u2014 use /backeer token",
+      `Token not found at ${config.tokenFile}`
+    );
+  }
+  async function handlePermissionAsked(event) {
+    const identity = permissionIdentity(event.properties);
+    if (!identity) {
+      reporter.error("Permission event is missing correlation IDs");
+      return;
+    }
+    if (!permissionController.register(identity)) return;
+    void publishPermission(
+      config,
+      reporter,
+      event.properties,
+      directory,
+      identity
+    ).catch((error) => reporter.error("Permission request could not be sent", error));
+  }
+  async function handleTodoUpdated(event) {
+    const { sessionID, todos } = event.properties;
+    if (typeof sessionID !== "string" || !Array.isArray(todos)) {
+      reporter.error("Todo event is missing a valid session or list");
+      return;
+    }
+    const isComplete = todos.length > 0 && todos.every((todo) => todo?.status === "completed");
+    const wasComplete = todoCompletionBySessionID.get(sessionID) === true;
+    rememberBounded(todoCompletionBySessionID, sessionID, isComplete);
+    if (!isComplete || wasComplete) return;
+    void publishTodoCompletion(
+      config,
+      reporter,
+      event.properties,
+      event.id,
+      client,
+      directory
+    ).catch((error) => reporter.error("Todo completion could not be sent", error));
+  }
+  async function handleQuestionAsked(event) {
+    const identity = questionIdentity(event.properties);
+    if (!identity) {
+      reporter.error("Question event is missing correlation IDs");
+      return;
+    }
+    if (publishedQuestions.has(identity.externalId)) return;
+    rememberBounded(publishedQuestions, identity.externalId, true);
+    void publishQuestion(
+      config,
+      reporter,
+      event.properties,
+      identity,
+      client,
+      directory
+    ).catch((error) => reporter.error("Question could not be sent", error));
+  }
+  return {
+    config: async (opencodeConfig) => {
+      registerBackeerCommand(opencodeConfig);
+    },
+    "command.execute.before": handleBackeerCommand,
+    event: async ({ event }) => {
+      if (!config.token) return;
+      if (config.permissions && event.type === "permission.asked") {
+        await handlePermissionAsked(event);
+        return;
+      }
+      if (config.permissions && event.type === "permission.replied") {
+        permissionController.resolveLocally(
+          event.properties.requestID ?? event.properties.id
+        );
+        return;
+      }
+      if (config.todos && event.type === "todo.updated") {
+        await handleTodoUpdated(event);
+        return;
+      }
+      if (config.questions && (event.type === "question.asked" || event.type === "question.v2.asked")) {
+        await handleQuestionAsked(event);
+      }
+    },
+    dispose: async () => {
+      await permissionController.dispose();
+      todoCompletionBySessionID.clear();
+      publishedQuestions.clear();
+    }
+  };
+}
+export {
+  BackeerPlugin as default
+};