backeer-opencode 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `backeer-opencode` are documented here.
 
+## 0.5.2 - 2026-11-03
+
+- Cancel unread HTTP error bodies so repeated failed requests release their
+  transport resources without exposing remote error contents.
+- Keep intentional shutdown in the closed state, await initial cursor setup,
+  and discard late handshake responses instead of reviving a closed client.
+- Add four regression tests for error-body cleanup and shutdown races.
+- Update the development-only brace-expansion dependency to its compatible
+  security patch. Production dependencies are unchanged.
+
 ## 0.5.1 - 2026-11-03
 
 - Keep live tracking active during hours of agent silence; retain 15-second

package/README.md

@@ -61,7 +61,7 @@ existing running sessions are not modified by this source checkout.
 
 The matching `backeer-opencode-mcp` executable is provided in the package.
 Connect through an existing SSH tunnel and register the local stdio executable
-as described in [the complete setup guide](docs/live-control.md). Version 0.5.1
+as described in [the complete setup guide](docs/live-control.md). Version 0.5.2
 in this checkout must be installed from its built package or installer bundle
 until it has been separately published; do not assume npm `latest` contains it.
 

package/dist/backeer-permission.js

@@ -2395,7 +2395,7 @@ import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
 
 // src/updates.js
-var PLUGIN_VERSION = "0.5.1";
+var PLUGIN_VERSION = "0.5.2";
 var PACKAGE_NAME = "backeer-opencode";
 var NPM_REGISTRY_URL = "https://registry.npmjs.org";
 var CHECK_TIMEOUT_MS = 3e3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backeer-opencode",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Backeer mobile approvals and authenticated live OpenCode control over SSE and MCP",
   "type": "module",
   "main": "./src/index.js",

package/src/live-control-client.js

@@ -98,6 +98,7 @@ export class LiveControlClient {
       })
       if (!response.ok) {
         // Never return a remote error body: it may contain original prompts or credentials.
+        await response.body?.cancel().catch(() => {})
         throw new Error(`Live-control request failed (HTTP ${response.status})`)
       }
       const text = await boundedText(response, 256 * 1024)
@@ -144,6 +145,7 @@ export class LiveControlClient {
             timeoutMs: this.reconnectMs,
           })).cursor)
           if (!initial) throw new Error("Live-control bridge did not provide a cursor")
+          if (this.controller.signal.aborted) return
           this.cursor = initial
           this.floor = initial
           this.readCursor = initial
@@ -178,6 +180,7 @@ export class LiveControlClient {
             signal: connection.signal, timeoutMs: this.reconnectMs,
           })).cursor)
           if (!initial) throw new Error("Live-control bridge did not provide a cursor")
+          if (this.controller.signal.aborted) return
           this.cursor = initial
           this.floor = initial
           this.readCursor = initial
@@ -186,6 +189,10 @@ export class LiveControlClient {
           redirect: "error", signal: connection.signal,
           headers: { Authorization: `Bearer ${this.token}`, Accept: "text/event-stream" },
         })
+        if (this.controller.signal.aborted) {
+          await response.body?.cancel().catch(() => {})
+          return
+        }
         if (!response.ok || !response.headers.get("content-type")?.includes("text/event-stream")) {
           this.status = response.status === 401 || response.status === 403 ? "unauthorized" : "disconnected"
           this.notify()
@@ -201,7 +208,10 @@ export class LiveControlClient {
         let buffer = ""
         while (!this.controller.signal.aborted && !resync) {
           const item = await reader.read()
-          if (item.done) { this.status = "disconnected"; break }
+          if (item.done) {
+            if (!this.controller.signal.aborted) this.status = "disconnected"
+            break
+          }
           armWatchdog()
           buffer += decoder.decode(item.value, { stream: true })
           buffer = buffer.replace(/\r\n|\r(?!$)/g, "\n")
@@ -333,6 +343,7 @@ export class LiveControlClient {
     this.controller.abort()
     this.status = "closed"
     this.notify()
+    await this.starting
     await this.task
     this.events = []
     this.bufferBytes = 0

package/src/updates.js

@@ -1,4 +1,4 @@
-export const PLUGIN_VERSION = "0.5.1"
+export const PLUGIN_VERSION = "0.5.2"
 
 const PACKAGE_NAME = "backeer-opencode"
 const NPM_REGISTRY_URL = "https://registry.npmjs.org"