backeer-opencode 0.4.0 → 0.5.2

package/dist/backeer-permission.js

@@ -235,7 +235,7 @@ function make3(options) {
   };
   const responseError = async (response, descriptor) => {
     if (descriptor.declaredStatuses.includes(response.status))
-      throw declared(await json(response));
+      throw declared(await json2(response));
     try {
       await response.body?.cancel();
     } catch {
@@ -255,7 +255,7 @@ function make3(options) {
       }
       return;
     }
-    return await json(response);
+    return await json2(response);
   };
   const sse = (descriptor, requestOptions) => ({
     async *[Symbol.asyncIterator]() {
@@ -1615,7 +1615,7 @@ function appendQuery(params, key, value) {
   }
   params.append(key, String(value));
 }
-async function json(response) {
+async function json2(response) {
   if (!isContentType(response, "application/json") && !response.headers.get("content-type")?.includes("+json")) {
     try {
       await response.body?.cancel();
@@ -1855,9 +1855,9 @@ var init_promise = __esm({
 });
 
 // src/config.js
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 
 // src/utilities.js
 var MAX_TRACKED_ITEMS = 500;
@@ -1930,6 +1930,48 @@ function rememberRecent(map, key, value) {
   while (map.size > 100) map.delete(map.keys().next().value);
 }
 
+// src/live-bridge-config.js
+import { constants, closeSync, fstatSync, openSync, readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+function readCredential(file) {
+  if (typeof file !== "string" || !isAbsolute(file)) {
+    throw new Error("Live control requires an absolute credential-file path");
+  }
+  let descriptor;
+  try {
+    descriptor = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    const stat = fstatSync(descriptor);
+    if (!stat.isFile() || stat.size > 4096 || process.platform !== "win32" && ((stat.mode & 63) !== 0 || stat.uid !== process.getuid())) {
+      throw new Error("invalid_file");
+    }
+    const token = readFileSync(descriptor, "utf8").trim();
+    if (!/^[A-Za-z0-9_-]{32,256}$/.test(token)) throw new Error("invalid_token");
+    return token;
+  } catch {
+    throw new Error("Live control credential must be an owner-only regular file containing a 32\u2013256 character token");
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
+  }
+}
+function loadLiveBridgeConfig(option, { configDirectory, ingestToken } = {}) {
+  const values = option && typeof option === "object" ? option : {};
+  const enabled2 = (typeof option === "boolean" ? option : values.enabled) ?? process.env.BACKEER_LIVE_ENABLED;
+  if (enabled2 !== true && enabled2 !== "true" && enabled2 !== "1") return { enabled: false };
+  try {
+    const rawPort = values.port ?? process.env.BACKEER_LIVE_PORT ?? 43871;
+    const port = Number(rawPort);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error("Live control port must be an integer between 1 and 65535");
+    }
+    const tokenFile = values.tokenFile ?? process.env.BACKEER_LIVE_TOKEN_FILE ?? join(configDirectory, "secrets", "backeer-live-token");
+    const token = readCredential(tokenFile);
+    if (token === ingestToken) throw new Error("Live control requires a credential distinct from the Backeer ingest token");
+    return { enabled: true, token, tokenFile, port };
+  } catch (error) {
+    return { enabled: false, error: error.message };
+  }
+}
+
 // src/config.js
 var DEFAULT_ORIGIN = "https://external-gateway.backeer.com";
 function integer(value, fallback, { minimum = 0, maximum = 86400 } = {}) {
@@ -1971,13 +2013,13 @@ function loadLifecycleConfig(option) {
 }
 function defaultConfigDirectory() {
   const base = process.env.XDG_CONFIG_HOME?.trim();
-  return base ? join(base, "opencode") : join(homedir(), ".config", "opencode");
+  return base ? join2(base, "opencode") : join2(homedir(), ".config", "opencode");
 }
 function loadToken(tokenFile) {
   const environmentToken = process.env.BACKEER_INGEST_TOKEN?.trim();
   if (environmentToken) return { token: environmentToken, source: "environment" };
   try {
-    const token = readFileSync(tokenFile, "utf8").trim();
+    const token = readFileSync2(tokenFile, "utf8").trim();
     return { token, source: token ? "file" : "missing" };
   } catch {
     return { token: "", source: "missing" };
@@ -1990,7 +2032,7 @@ function loadConfig(options = {}) {
   if (origin.protocol !== "https:") {
     throw new Error("Backeer origin must use HTTPS");
   }
-  const tokenFile = options.tokenFile ?? process.env.BACKEER_TOKEN_FILE ?? join(defaultConfigDirectory(), "secrets", "backeer-ingest-token");
+  const tokenFile = options.tokenFile ?? process.env.BACKEER_TOKEN_FILE ?? join2(defaultConfigDirectory(), "secrets", "backeer-ingest-token");
   const loadedToken = loadToken(tokenFile);
   return {
     origin,
@@ -2000,6 +2042,10 @@ function loadConfig(options = {}) {
     token: loadedToken.token,
     tokenSource: loadedToken.source,
     tokenFile,
+    liveBridge: loadLiveBridgeConfig(options.liveBridge, {
+      configDirectory: defaultConfigDirectory(),
+      ingestToken: loadedToken.token
+    }),
     permissions: enabled(
       options.permissions ?? process.env.BACKEER_NOTIFY_PERMISSIONS
     ),
@@ -2337,7 +2383,7 @@ async function publishTodoCompletion(config, reporter, request, eventID, client,
 import {
   chmodSync,
   mkdirSync,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   renameSync,
   statSync as statSync2,
   writeFileSync
@@ -2349,7 +2395,7 @@ import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
 
 // src/updates.js
-var PLUGIN_VERSION = "0.4.0";
+var PLUGIN_VERSION = "0.5.2";
 var PACKAGE_NAME = "backeer-opencode";
 var NPM_REGISTRY_URL = "https://registry.npmjs.org";
 var CHECK_TIMEOUT_MS = 3e3;
@@ -2840,7 +2886,7 @@ function rotateTokenFromFile(config, sourcePathValue) {
   if ((sourceStats.mode & 63) !== 0) {
     throw new Error("The token source must not be readable by group or other users");
   }
-  const token = readFileSync2(sourcePath, "utf8").trim();
+  const token = readFileSync3(sourcePath, "utf8").trim();
   if (!token || /\s/.test(token)) {
     throw new Error("The token source must contain exactly one non-empty token");
   }
@@ -3367,6 +3413,517 @@ function createLifecycleController({
   };
 }
 
+// src/live-bridge.js
+import { createServer } from "node:http";
+import { randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+
+// src/live-bridge-client.js
+function createV2LiveClient(ctx) {
+  const known = /* @__PURE__ */ new Map();
+  let disposed = false;
+  async function get(id) {
+    const info = await ctx.session.get({ sessionID: id });
+    if (disposed) return info;
+    known.set(id, info);
+    if (known.size > 100) known.delete(known.keys().next().value);
+    return info;
+  }
+  return {
+    async list() {
+      if (typeof ctx.session.list === "function") {
+        return ctx.session.list({ directory: ctx.location.directory, limit: 100, order: "desc" });
+      }
+      const refreshed = [];
+      for (const id of known.keys()) {
+        try {
+          refreshed.push(await get(id));
+        } catch {
+          known.delete(id);
+        }
+      }
+      return refreshed;
+    },
+    get,
+    prompt: (id, text) => ctx.session.prompt({ sessionID: id, text, delivery: "queue" }),
+    dispose: () => {
+      disposed = true;
+      known.clear();
+    }
+  };
+}
+function unwrap(value) {
+  if (value?.error) throw new Error("OpenCode request failed");
+  return value?.data ?? value;
+}
+function createV1LiveClient(client, directory) {
+  return {
+    list: async () => unwrap(await client.session.list({ query: { directory }, throwOnError: true })),
+    get: async (id) => unwrap(await client.session.get({ path: { id }, query: { directory }, throwOnError: true })),
+    async prompt(id, text) {
+      if (typeof client.session.promptAsync !== "function") {
+        throw Object.assign(new Error("OpenCode asynchronous prompts are unavailable"), { status: 501 });
+      }
+      return unwrap(await client.session.promptAsync({
+        path: { id },
+        query: { directory },
+        body: { parts: [{ type: "text", text }] },
+        throwOnError: true
+      }));
+    }
+  };
+}
+
+// src/live-connection.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+var LIVE_RECONNECT_MS = 3e3;
+var LIVE_HEARTBEAT_MS = 15e3;
+function createLiveConnectionNotifier(config, reporter) {
+  const epoch = randomUUID2();
+  const controller = new AbortController();
+  let last, sequence = 0, pending, task;
+  async function drain() {
+    while (pending && !controller.signal.aborted) {
+      const event = pending;
+      pending = void 0;
+      try {
+        await postJsonWithRetry(config, config.eventsEndpoint, event, { signal: controller.signal });
+      } catch {
+        if (!controller.signal.aborted) reporter?.error("Live connection notification could not be sent");
+      }
+    }
+  }
+  return {
+    update(connected) {
+      if (controller.signal.aborted || connected === last) return;
+      const initial = last === void 0;
+      last = connected;
+      if (initial || !config.token || !config.eventsEndpoint) return;
+      pending = {
+        type: "application",
+        severity: connected ? "info" : "warning",
+        title: connected ? "OpenCode ba\u011Flant\u0131s\u0131 yeniden kuruldu" : "OpenCode ba\u011Flant\u0131s\u0131 kesildi",
+        body: connected ? "Canl\u0131 takip yeniden ba\u011Fland\u0131. Sunucudaki g\xF6rev otomatik olarak yeniden ba\u015Flat\u0131lmad\u0131." : "Canl\u0131 takip ba\u011Flant\u0131s\u0131 kesildi. Yeniden ba\u011Flanma her 3 saniyede denenecek; sunucudaki g\xF6rev durdurulmad\u0131.",
+        payload: [{ key: "Connection", value: connected ? "reconnected" : "disconnected" }],
+        externalId: `opencode:live:${epoch}:${++sequence}`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        notify: true,
+        direction: "in"
+      };
+      task ??= drain().finally(() => {
+        task = void 0;
+      });
+    },
+    async dispose() {
+      controller.abort();
+      pending = void 0;
+      await task;
+    }
+  };
+}
+
+// src/live-bridge-events.js
+var ID = /^[A-Za-z0-9_-]{1,160}$/;
+var validBridgeID = (value) => typeof value === "string" && ID.test(value);
+function createBridgeSanitizer(secrets = []) {
+  const known = secrets.filter((value) => typeof value === "string" && value.length > 0);
+  const assistants = /* @__PURE__ */ new Map();
+  function clipped(value, max = 12e3) {
+    if (typeof value !== "string") return { value: "", truncated: false };
+    let result = value.slice(0, 64e3);
+    for (const secret of known) result = result.split(secret).join("[REDACTED]");
+    result = result.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED PRIVATE KEY]").replace(/\bBearer\s+[^\s"'<>]+/gi, "Bearer [REDACTED]").replace(/\b(?:sk|bgi)_[A-Za-z0-9_-]{12,}|\bsk-[A-Za-z0-9_-]{12,}/g, "[REDACTED]").replace(/((?:api[_-]?key|access[_-]?token|secret|password|authorization)\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]");
+    return { value: result.slice(0, max), truncated: value.length > 64e3 || result.length > max };
+  }
+  function text(value, max) {
+    return clipped(value, max).value;
+  }
+  function content(key, value) {
+    const result = clipped(value);
+    return { [key]: result.value, ...result.truncated ? { truncated: true } : {} };
+  }
+  function sanitize(event) {
+    const p = event?.properties ?? event?.data ?? {};
+    const sessionID = p.sessionID ?? p.info?.sessionID ?? p.part?.sessionID;
+    if (!validBridgeID(sessionID) || sessionID === "global") return void 0;
+    const base = { type: event.type, sessionID, data: {} };
+    if (event.type === "message.updated") {
+      const info = p.info;
+      if (!validBridgeID(info?.id)) return void 0;
+      if (info.role === "assistant") {
+        assistants.set(info.id, sessionID);
+        if (assistants.size > 256) assistants.delete(assistants.keys().next().value);
+      }
+      return info.role === "assistant" ? { ...base, data: {
+        messageID: info.id,
+        completed: !!info.time?.completed,
+        failed: !!info.error
+      } } : void 0;
+    }
+    if (event.type === "message.part.updated") {
+      const part = p.part;
+      if (assistants.get(part?.messageID) !== sessionID) return void 0;
+      if (part.type === "text") return { ...base, type: "assistant.text", data: {
+        messageID: part.messageID,
+        ...content("text", part.text),
+        replace: true
+      } };
+      if (part.type !== "tool") return void 0;
+      const state = part.state ?? {};
+      return { ...base, type: "tool.status", data: {
+        tool: text(part.tool, 80),
+        status: text(state.status, 40),
+        ...state.status === "completed" ? content("output", state.output) : {},
+        ...state.status === "error" ? { failed: true } : {}
+      } };
+    }
+    if (event.type === "session.text.ended") return { ...base, type: "assistant.text", data: {
+      messageID: validBridgeID(p.assistantMessageID) ? p.assistantMessageID : void 0,
+      ...content("text", p.text),
+      replace: true
+    } };
+    if (["session.tool.called", "session.tool.success", "session.tool.failed"].includes(event.type)) {
+      return { ...base, type: "tool.status", data: {
+        status: event.type.split(".").at(-1),
+        ...event.type === "session.tool.success" ? content(
+          "output",
+          (p.content ?? []).filter((item) => item?.type === "text").map((item) => item.text).join("\n")
+        ) : {}
+      } };
+    }
+    if (["permission.asked", "question.asked", "question.v2.asked"].includes(event.type)) {
+      return { ...base, type: "approval.waiting", data: { kind: event.type.split(".")[0] } };
+    }
+    if (["permission.replied", "question.replied", "question.v2.replied", "question.rejected", "question.v2.rejected"].includes(event.type)) {
+      return { ...base, type: "approval.settled", data: { kind: event.type.split(".")[0] } };
+    }
+    if (event.type === "session.status") return { ...base, data: {
+      status: ["idle", "busy", "retry"].includes(p.status?.type) ? p.status.type : "unknown"
+    } };
+    if (["session.idle", "session.error", "session.deleted"].includes(event.type)) return base;
+    return void 0;
+  }
+  return { sanitize, text, clear: () => assistants.clear() };
+}
+
+// src/live-bridge.js
+var LIMITS = { events: 256, bytes: 2e6, clients: 8, commands: 1024, commandTTL: 864e5, body: 32768, requests: 16 };
+function failure(status, code) {
+  return Object.assign(new Error(code), { status, code });
+}
+function json(response, status, value) {
+  if (!response.destroyed && !response.headersSent) {
+    response.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+    response.end(JSON.stringify(value));
+  }
+}
+async function readBody(request) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of request) {
+    bytes += chunk.length;
+    if (bytes > LIMITS.body) throw failure(413, "body_too_large");
+    chunks.push(chunk);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw failure(400, "invalid_json");
+  }
+}
+async function createLiveBridge({ config, client, directory, reporter }) {
+  const options = config.liveBridge;
+  if (!options?.enabled) return { handle() {
+  }, async dispose() {
+  }, address: void 0 };
+  const token = options.token;
+  if (typeof token !== "string" || token.length < 32 || token === config.token) {
+    throw new Error("Live bridge requires a separate credential of at least 32 characters");
+  }
+  const api = client.liveBridge ?? createV1LiveClient(client, directory);
+  const connectionNotifications = createLiveConnectionNotifier(config, reporter);
+  const sanitizer = createBridgeSanitizer([token, config.token]);
+  const epoch = randomUUID3();
+  const events = [], streams = /* @__PURE__ */ new Set(), commands = /* @__PURE__ */ new Map(), states = /* @__PURE__ */ new Map();
+  let sequence = 0, bytes = 0, active = 0, disposed = false, disposeTask;
+  let lookups = 0;
+  const lookupWaiters = /* @__PURE__ */ new Set();
+  const cursor = () => `${epoch}:${sequence}`;
+  function lookup(id) {
+    if (disposed) return Promise.reject(failure(503, "bridge_closed"));
+    if (lookups >= 16) return Promise.reject(failure(429, "session_lookup_busy"));
+    lookups++;
+    return new Promise((resolve2, reject) => {
+      let finished = false;
+      const finish = (complete, value) => {
+        if (finished) return;
+        finished = true;
+        clearTimeout(timer);
+        lookupWaiters.delete(cancel);
+        complete(value);
+      };
+      const cancel = () => finish(reject, failure(503, "bridge_closed"));
+      const timer = setTimeout(() => finish(reject, failure(504, "session_lookup_timed_out")), 1e3);
+      lookupWaiters.add(cancel);
+      Promise.resolve().then(() => api.get(id)).then(
+        (value) => {
+          lookups--;
+          finish(resolve2, value);
+        },
+        (error) => {
+          lookups--;
+          finish(reject, error);
+        }
+      );
+    });
+  }
+  async function session(id) {
+    if (!validBridgeID(id) || id === "global") throw failure(400, "invalid_session");
+    let info;
+    try {
+      info = await lookup(id);
+    } catch (error) {
+      if (["session_lookup_busy", "session_lookup_timed_out", "bridge_closed"].includes(error.code)) throw error;
+      throw failure(404, "session_not_found");
+    }
+    if (info?.id !== id || (info.location?.directory ?? info.directory) !== directory) {
+      throw failure(404, "session_not_found");
+    }
+    return {
+      id,
+      title: sanitizer.text(info.title, 240),
+      ...validBridgeID(info.parentID) ? { parentID: info.parentID } : {},
+      status: states.get(id) ?? "unknown"
+    };
+  }
+  function removeStream(stream) {
+    const removed = streams.delete(stream);
+    clearInterval(stream.heartbeat);
+    stream.queue.length = 0;
+    stream.queuedBytes = 0;
+    if (removed && !streams.size && !disposed) connectionNotifications.update(false);
+  }
+  function write(stream, value) {
+    if (!streams.has(stream)) return;
+    if (stream.blocked) {
+      stream.queue.push(value);
+      stream.queuedBytes += Buffer.byteLength(value);
+      if (stream.queuedBytes > LIMITS.bytes) {
+        removeStream(stream);
+        stream.response.destroy();
+      }
+      return;
+    }
+    if (!stream.response.write(value)) {
+      stream.blocked = true;
+    }
+  }
+  async function handle(event) {
+    if (disposed) return;
+    const safe = sanitizer.sanitize(event);
+    if (!safe) return;
+    try {
+      await session(safe.sessionID);
+    } catch {
+      return;
+    }
+    if (disposed) return;
+    if (safe.type === "session.status") states.set(safe.sessionID, safe.data.status);
+    if (safe.type === "session.idle") states.set(safe.sessionID, "idle");
+    if (safe.type === "session.deleted") states.delete(safe.sessionID);
+    if (states.size > 256) states.delete(states.keys().next().value);
+    const record = { id: `${epoch}:${++sequence}`, ...safe, timestamp: Date.now() };
+    let frame = `id: ${record.id}
+event: backeer.event
+data: ${JSON.stringify(record)}
+
+`;
+    if (Buffer.byteLength(frame) > 32768) {
+      record.data = { truncated: true };
+      frame = `id: ${record.id}
+event: backeer.event
+data: ${JSON.stringify(record)}
+
+`;
+    }
+    const size = Buffer.byteLength(frame);
+    events.push({ sequence, sessionID: record.sessionID, frame, size });
+    bytes += size;
+    while (events.length > LIMITS.events || bytes > LIMITS.bytes) bytes -= events.shift().size;
+    for (const stream of streams) if (!stream.sessionID || stream.sessionID === record.sessionID) write(stream, frame);
+  }
+  function authorized(request) {
+    if (request.headers.origin || request.headers["sec-fetch-site"]) return false;
+    const expected = Buffer.from(`Bearer ${token}`);
+    const actual = Buffer.from(request.headers.authorization ?? "");
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+  }
+  function parseCursor(value) {
+    if (!value) return { after: 0 };
+    const match = /^([a-f0-9-]{36}):(\d{1,16})$/.exec(value);
+    if (!match) throw failure(400, "invalid_cursor");
+    if (match[1] !== epoch) return { gap: "stream_restarted" };
+    const after = Number(match[2]);
+    if (!Number.isSafeInteger(after) || after > sequence) throw failure(400, "invalid_cursor");
+    if (events.length && after < events[0].sequence - 1) return { gap: "cursor_expired" };
+    return { after };
+  }
+  async function route(request, response) {
+    if (!authorized(request)) return json(response, 401, { error: "unauthorized" });
+    if (active >= LIMITS.requests) return json(response, 429, { error: "bridge_busy" });
+    active++;
+    const timeout = setTimeout(() => json(response, 504, { error: "request_timed_out" }), 15e3);
+    timeout.unref();
+    try {
+      const url = new URL(request.url, "http://127.0.0.1");
+      if (url.username || url.password) throw failure(400, "invalid_url");
+      if (request.method === "GET" && url.pathname === "/v1/sessions") {
+        const result = await api.list();
+        const values = Array.isArray(result) ? result : result?.data;
+        if (!Array.isArray(values)) throw failure(502, "invalid_session_list");
+        const own = values.slice(0, 100).filter((info) => validBridgeID(info?.id) && (info.location?.directory ?? info.directory) === directory);
+        return json(response, 200, { sessions: own.map((info) => ({
+          id: info.id,
+          title: sanitizer.text(info.title, 240),
+          status: states.get(info.id) ?? "unknown",
+          ...validBridgeID(info.parentID) ? { parentID: info.parentID } : {}
+        })), cursor: cursor() });
+      }
+      if (request.method === "GET" && url.pathname === "/v1/events") {
+        const selected = url.searchParams.get("sessionID") || void 0;
+        if (selected) await session(selected);
+        const parsed = parseCursor(url.searchParams.get("after") ?? request.headers["last-event-id"]);
+        if (response.headersSent) return;
+        if (streams.size >= LIMITS.clients) throw failure(429, "too_many_streams");
+        clearTimeout(timeout);
+        response.writeHead(200, {
+          "content-type": "text/event-stream",
+          "cache-control": "no-cache, no-transform",
+          "x-accel-buffering": "no",
+          connection: "keep-alive"
+        });
+        if (parsed.gap) {
+          response.end(`event: backeer.gap
+data: ${JSON.stringify({ reason: parsed.gap, cursor: cursor() })}
+
+`);
+          return;
+        }
+        const stream = {
+          response,
+          sessionID: selected,
+          heartbeat: void 0,
+          blocked: false,
+          queue: [],
+          queuedBytes: 0
+        };
+        streams.add(stream);
+        connectionNotifications.update(true);
+        request.socket.setTimeout(0);
+        request.socket.setKeepAlive(true, LIVE_HEARTBEAT_MS);
+        response.on("close", () => removeStream(stream));
+        response.on("drain", () => {
+          stream.blocked = false;
+          while (streams.has(stream) && !stream.blocked && stream.queue.length) {
+            const next = stream.queue.shift();
+            stream.queuedBytes -= Buffer.byteLength(next);
+            write(stream, next);
+          }
+        });
+        write(stream, `: connected
+retry: ${LIVE_RECONNECT_MS}
+
+`);
+        for (const item of events) {
+          if (!streams.has(stream)) break;
+          if (item.sequence > parsed.after && (!selected || selected === item.sessionID)) write(stream, item.frame);
+        }
+        if (streams.has(stream)) {
+          stream.heartbeat = setInterval(() => write(stream, ": heartbeat\n\n"), LIVE_HEARTBEAT_MS);
+          stream.heartbeat.unref();
+        }
+        return;
+      }
+      const match = /^\/v1\/sessions\/([A-Za-z0-9_-]{1,160})(\/instructions)?$/.exec(url.pathname);
+      if (!match) throw failure(404, "route_not_found");
+      if (request.method === "GET" && !match[2]) return json(response, 200, await session(match[1]));
+      if (request.method !== "POST" || !match[2]) throw failure(405, "method_not_allowed");
+      if (!/^application\/json(?:;|$)/i.test(request.headers["content-type"] ?? "")) throw failure(415, "json_required");
+      const body = await readBody(request);
+      if (!body || !validBridgeID(body.requestId) || typeof body.prompt !== "string" || !body.prompt.trim() || body.prompt.length > 16e3 || Object.keys(body).some((key) => !["requestId", "prompt"].includes(key))) throw failure(400, "invalid_instruction");
+      await session(match[1]);
+      if (response.headersSent || disposed) return;
+      for (const [id, command2] of commands) {
+        if (command2.settled && Date.now() - command2.created >= LIMITS.commandTTL) commands.delete(id);
+      }
+      const existing = commands.get(body.requestId);
+      if (existing) {
+        if (existing.sessionID !== match[1] || existing.prompt !== body.prompt) throw failure(409, "request_id_conflict");
+        await existing.task;
+        return json(response, 200, existing.result);
+      }
+      if (commands.size >= LIMITS.commands) throw failure(429, "command_window_full");
+      const command = {
+        sessionID: match[1],
+        prompt: body.prompt,
+        created: Date.now(),
+        settled: false,
+        result: { requestId: body.requestId, sessionID: match[1], status: "accepted" },
+        task: void 0
+      };
+      commands.set(body.requestId, command);
+      command.task = Promise.resolve().then(() => api.prompt(match[1], body.prompt)).finally(() => {
+        command.settled = true;
+      });
+      await command.task;
+      return json(response, 202, command.result);
+    } catch (error) {
+      json(response, error.status ?? 502, { error: error.code ?? "opencode_request_failed" });
+    } finally {
+      active--;
+      clearTimeout(timeout);
+    }
+  }
+  const server = createServer((request, response) => {
+    void route(request, response);
+  });
+  server.requestTimeout = 15e3;
+  server.headersTimeout = 1e4;
+  server.keepAliveTimeout = 5e3;
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? 43871, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve2();
+    });
+  });
+  server.on("error", () => {
+  });
+  return {
+    handle,
+    address: server.address(),
+    dispose() {
+      disposeTask ??= new Promise((resolve2) => {
+        disposed = true;
+        for (const cancel of lookupWaiters) cancel();
+        for (const stream of streams) {
+          removeStream(stream);
+          stream.response.destroy();
+        }
+        server.close(() => {
+          void connectionNotifications.dispose().then(resolve2);
+        });
+        server.closeAllConnections?.();
+        events.length = 0;
+        states.clear();
+        commands.clear();
+        sanitizer.clear();
+        api.dispose?.();
+      });
+      return disposeTask;
+    }
+  };
+}
+
 // src/permission-command.js
 var ALLOWED_DECISIONS = /* @__PURE__ */ new Set(["once", "always", "reject"]);
 var DECISION_LABELS = {
@@ -3941,6 +4498,13 @@ async function BackeerPlugin({ client, directory, feedback, v2 = false }, option
   }
   const reporter = createOpenCodeReporter(client, config.logLevel);
   const conversation = feedback ?? createConversationFeedback({ client, reporter });
+  if (config.liveBridge.error) reporter.error("Live control disabled", config.liveBridge.error);
+  const liveBridge = await createLiveBridge({ config, client, directory, reporter }).catch((error) => {
+    reporter.error("Live control unavailable", error);
+    return { async handle() {
+    }, async dispose() {
+    } };
+  });
   const permissionController = createPermissionController({
     config,
     reporter,
@@ -4048,6 +4612,38 @@ async function BackeerPlugin({ client, directory, feedback, v2 = false }, option
       conversation.error(identity.sessionID, "Question could not be sent");
     });
   }
+  async function handleNotificationEvent(event) {
+    if (!config.token) return;
+    conversation.handle(event);
+    lifecycleController.handle(event);
+    if (config.permissions && event.type === "permission.asked") {
+      await handlePermissionAsked(event);
+      return;
+    }
+    if (config.permissions && event.type === "permission.replied") {
+      permissionController.resolveLocally(
+        event.properties.requestID ?? event.properties.id
+      );
+      return;
+    }
+    if (config.todos && event.type === "todo.updated") {
+      await handleTodoUpdated(event);
+      return;
+    }
+    if (config.questions && (event.type === "question.asked" || event.type === "question.v2.asked")) {
+      await handleQuestionAsked(event);
+      return;
+    }
+    if (config.questions && ["question.replied", "question.v2.replied", "question.rejected", "question.v2.rejected"].includes(event.type)) {
+      const requestID = event.properties.requestID ?? event.properties.id;
+      if (typeof requestID === "string") {
+        permissionController.resolveQuestionLocally(
+          requestID,
+          event.type.endsWith("rejected") ? "rejected" : "answered"
+        );
+      }
+    }
+  }
   return {
     config: async (opencodeConfig) => {
       registerBackeerCommand(opencodeConfig);
@@ -4055,38 +4651,10 @@ async function BackeerPlugin({ client, directory, feedback, v2 = false }, option
     "command.execute.before": handleBackeerCommand,
     "chat.message": handleUpdateNotice,
     event: async ({ event }) => {
-      if (!config.token) return;
-      conversation.handle(event);
-      lifecycleController.handle(event);
-      if (config.permissions && event.type === "permission.asked") {
-        await handlePermissionAsked(event);
-        return;
-      }
-      if (config.permissions && event.type === "permission.replied") {
-        permissionController.resolveLocally(
-          event.properties.requestID ?? event.properties.id
-        );
-        return;
-      }
-      if (config.todos && event.type === "todo.updated") {
-        await handleTodoUpdated(event);
-        return;
-      }
-      if (config.questions && (event.type === "question.asked" || event.type === "question.v2.asked")) {
-        await handleQuestionAsked(event);
-        return;
-      }
-      if (config.questions && ["question.replied", "question.v2.replied", "question.rejected", "question.v2.rejected"].includes(event.type)) {
-        const requestID = event.properties.requestID ?? event.properties.id;
-        if (typeof requestID === "string") {
-          permissionController.resolveQuestionLocally(
-            requestID,
-            event.type.endsWith("rejected") ? "rejected" : "answered"
-          );
-        }
-      }
+      await Promise.all([handleNotificationEvent(event), liveBridge.handle(event)]);
     },
     dispose: async () => {
+      await liveBridge.dispose();
       await permissionController.dispose();
       lifecycleController.dispose();
       permissionPublications.clear();
@@ -4141,11 +4709,11 @@ function spawnServiceContender2(command, args, env) {
 }
 function contenderPool2(timing) {
   const contenders = /* @__PURE__ */ new Set();
-  let failure;
+  let failure2;
   let spawnDelay = timing.spawnDelay;
   let lastSpawn = 0;
   return {
-    failure: () => failure,
+    failure: () => failure2,
     serviceAnswered() {
       spawnDelay = timing.spawnDelay;
     },
@@ -4156,7 +4724,7 @@ function contenderPool2(timing) {
           contenders.delete(item);
         }
       }
-      failure = void 0;
+      failure2 = void 0;
       lastSpawn = 0;
     },
     recruitNow() {
@@ -4164,16 +4732,16 @@ function contenderPool2(timing) {
     },
     reap() {
       const finished = [...contenders].filter(contenderFinished2);
-      failure ??= finished.map(contenderFailure).find((error) => error !== void 0);
+      failure2 ??= finished.map(contenderFailure).find((error) => error !== void 0);
       if (finished.some((item) => item.child.exitCode === 0))
         spawnDelay = Math.min(spawnDelay * 2, timing.maxSpawnDelay);
       finished.forEach((item) => contenders.delete(item));
-      return contenders.size === 0 ? failure : void 0;
+      return contenders.size === 0 ? failure2 : void 0;
     },
     shouldRecruit(registered2) {
       if (lastSpawn === 0 && registered2)
         lastSpawn = Date.now();
-      return failure === void 0 && contenders.size < 2 && Date.now() - lastSpawn >= spawnDelay;
+      return failure2 === void 0 && contenders.size < 2 && Date.now() - lastSpawn >= spawnDelay;
     },
     add(contender) {
       contenders.add(contender);
@@ -4332,7 +4900,7 @@ function isHandoff(value) {
 
 // node_modules/@opencode/client/dist/chunks/service-timing-8ye1ye6f.js
 import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 function decide2(service, options) {
   if (!matchesVersion2(service.version, options))
     return { _tag: "replace", pty: service.state === "ready" ? "handoff" : "clear" };
@@ -4348,7 +4916,7 @@ function fail(message) {
   return { _tag: "fail", error: new Error(message) };
 }
 function fallback2() {
-  return join2(process.env["XDG_STATE_HOME"] ?? join2(homedir2(), ".local", "state"), "opencode", "service.json");
+  return join3(process.env["XDG_STATE_HOME"] ?? join3(homedir2(), ".local", "state"), "opencode", "service.json");
 }
 function same2(left, right) {
   return left.id === right.id && left.version === right.version && left.url === right.url && left.pid === right.pid;
@@ -4663,6 +5231,7 @@ function normalizeV2Event(event) {
 }
 function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(ctx, sessionID)) {
   return {
+    liveBridge: createV2LiveClient(ctx),
     app: {
       async log({ body }) {
         console.error(JSON.stringify(body));
@@ -4807,13 +5376,11 @@ ${output.parts.map((part) => part.text).join("\n")}`;
       }
     }));
     streamTask = (async () => {
-      let delay2 = 1e3;
       while (!controller.signal.aborted) {
         try {
           for await (const event of ctx.event.subscribe({ signal: controller.signal })) {
             if (controller.signal.aborted) break;
             if (!await client.ownsEvent(event)) continue;
-            delay2 = 1e3;
             for (const normalized of normalizeV2Event(event)) {
               await hooks.event({ event: normalized });
             }
@@ -4822,8 +5389,7 @@ ${output.parts.map((part) => part.text).join("\n")}`;
           if (!controller.signal.aborted) reporter.error("OpenCode event stream disconnected", error);
         }
         if (!controller.signal.aborted) {
-          await waitForReconnect(controller.signal, delay2);
-          delay2 = Math.min(delay2 * 2, 3e4);
+          await waitForReconnect(controller.signal, LIVE_RECONNECT_MS);
         }
       }
     })();