backeer-opencode 0.4.0 → 0.5.2

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to `backeer-opencode` are documented here.
 
+## 0.5.2 - 2026-11-03
+
+- Cancel unread HTTP error bodies so repeated failed requests release their
+  transport resources without exposing remote error contents.
+- Keep intentional shutdown in the closed state, await initial cursor setup,
+  and discard late handshake responses instead of reviving a closed client.
+- Add four regression tests for error-body cleanup and shutdown races.
+- Update the development-only brace-expansion dependency to its compatible
+  security patch. Production dependencies are unchanged.
+
+## 0.5.1 - 2026-11-03
+
+- Keep live tracking active during hours of agent silence; retain 15-second
+  heartbeats and detect dead transport only after 45 seconds without traffic.
+- Retry live SSE and native V2 subscriptions every three seconds indefinitely,
+  including initial unavailability and authentication failures. Preserve explicit
+  history-gap reporting while reconnecting the transport automatically.
+- Send disconnect/reconnect application notifications through the existing
+  Backeer mobile gateway once per aggregate connection transition. Keep pending
+  delivery bounded and avoid notifications on deliberate plugin disposal.
+- Document a reconnecting SSH tunnel and the distinction between tool waits,
+  transport timeouts and long-running agent jobs.
+
+## 0.5.0 - 2026-11-03
+
+- Add optional authenticated loopback live control inside the existing OpenCode
+  process: bounded SSE replay, reconnect/gap signaling, exact-session normal
+  prompts and 24-hour instruction idempotency.
+- Add a local stdio MCP adapter for session status, incremental reads, bounded
+  SSE waits and explicit instructions over an existing SSH tunnel.
+- Preserve mobile approvals/questions, reject cross-project access, and keep
+  live credentials separate and owner-readable. No remote deployment or public
+  listener is enabled automatically.
+- Document supported V1/V2 output events and observed-session discovery limits.
+
 ## 0.4.0 - 2026-10-11
 
 - Add a V2 default definition with a stable ID, setup, event subscription,

package/README.md

@@ -8,8 +8,62 @@ command stream. An authorized user can choose **Allow once**, **Always allow**,
 or **Reject** for permissions and can answer or reject AI questions from the
 Backeer iOS application.
 
-The plugin uses outbound HTTPS only. It does not start a server or require an
-inbound firewall rule.
+Mobile notifications and approvals use outbound HTTPS only. The optional live
+control feature adds an authenticated loopback-only listener inside OpenCode;
+it needs no public port, inbound firewall rule, or separately hosted server.
+See [Live control setup](docs/live-control.md) for the SSE/MCP connection.
+
+## Live output and instructions
+
+The opt-in live channel lets a local MCP client send an instruction to an exact
+OpenCode session and follow assistant text, tool results, status and pending
+approval metadata over SSE. It does not record the whole terminal, export
+reasoning or authentication forms, or approve permissions. Mobile approval and
+question replies continue through Backeer as before.
+
+Create a separate protected live-control credential file on the OpenCode host;
+use the same credential in an owner-only file on the MCP computer. Do not reuse
+the Backeer ingest token. Values never belong in plugin options or chat text.
+For example, generate a file without printing its contents:
+
+```sh
+install -d -m 700 "$HOME/.config/opencode/secrets"
+(set -C; umask 077; openssl rand -hex 32 > "$HOME/.config/opencode/secrets/backeer-live-token")
+```
+
+This refuses to overwrite an existing live-control file; generate it once for
+initial setup, not during a running session. Enable the plugin with non-secret
+options (use an actual absolute path):
+
+```json
+{
+  "plugins": [{
+    "package": "backeer-opencode",
+    "options": {
+      "liveBridge": {
+        "enabled": true,
+        "port": 43871,
+        "tokenFile": "/absolute/private/path/backeer-live-token"
+      }
+    }
+  }]
+}
+```
+
+For side-loaded installations, the equivalent environment variables are
+`BACKEER_LIVE_ENABLED=true`, `BACKEER_LIVE_PORT=43871`, and
+`BACKEER_LIVE_TOKEN_FILE=/absolute/private/path/backeer-live-token`. Defaults:
+disabled; port `43871`; token file under the existing OpenCode configuration
+directory at `secrets/backeer-live-token`. An invalid live configuration disables
+only the live channel, leaving existing mobile integration available. Restart
+the intended OpenCode process after explicitly installing/enabling this version;
+existing running sessions are not modified by this source checkout.
+
+The matching `backeer-opencode-mcp` executable is provided in the package.
+Connect through an existing SSH tunnel and register the local stdio executable
+as described in [the complete setup guide](docs/live-control.md). Version 0.5.2
+in this checkout must be installed from its built package or installer bundle
+until it has been separately published; do not assume npm `latest` contains it.
 
 ## Requirements
 
@@ -148,7 +202,7 @@ OpenCode V2 plugin options syntax:
 ```
 
 Supported options are `origin`, `tokenFile`, `permissions`, `questions`,
-`todos`, `lifecycle`, and `logLevel`. Use `"lifecycle": false` to disable the
+`todos`, `lifecycle`, `liveBridge`, and `logLevel`. Use `"lifecycle": false` to disable the
 entire lifecycle group. The token itself is deliberately not a plugin option.
 
 ## Conversation feedback

package/bin/backeer-opencode-mcp.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { runLiveControlMcp } from "../src/live-control-mcp.js"
+
+try {
+  await runLiveControlMcp()
+} catch {
+  console.error("Backeer live-control MCP failed to start. Check BACKEER_LIVE_TOKEN_FILE, its owner-only permissions, and BACKEER_LIVE_URL.")
+  process.exitCode = 1
+}