backeer-opencode 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to `backeer-opencode` are documented here.
 
+## 0.8.2 - 2026-11-03
+
+- Reuse the current Linux server's initial native password when OpenCode removes it from its runtime environment; credentials stay internal and no other process is inspected.
+- Add optional `liveBridge.projectDirectory` to keep unrelated locations from claiming the listener; `owner: "standalone"` limits that listener to the existing private stdio server when a shared server also loads the same project.
+- Include the optional native TUI companion entrypoint; activation remains explicit and the server owner remains the default.
+
+## 0.8.1 - 2026-11-03
+
+- Resolve an existing private V2 server before shared-service discovery; verify native API PID and exact session/project without starting a service or hardcoded ports/session IDs.
+- Discover Linux ephemeral listeners only from the current process's socket inodes; retain compatible owning shared-service and verified worktree handling.
+- Return allowlisted native-question diagnostics without exposing upstream text or credentials.
+
 ## 0.8.0 - 2026-11-03
 
 - Add `list_questions` and `answer_question` to both MCP adapters: pending text/options, single/multiple selection and custom text answers.

package/README.md

@@ -301,12 +301,15 @@ authentication and other forms are never exported. Events from other locations
 are ignored. V2 has no native `todo.updated` event, so todo notifications are
 disabled there regardless of the `todos` option.
 
-V2 remote question replies require the managed shared service. OpenCode 2.0.26
-does not expose forms on the plugin context, so the plugin uses the official
-client's authenticated service discovery and verifies session location before
-answering. It never starts another service. Notifications work in standalone
-mode, but remote question replies fail explicitly there rather than contacting
-a different session.
+V2 question reads/replies use the official authenticated client API. For an
+existing private stdio server, 0.8.1 first verifies its own native API and PID;
+a Linux ephemeral port is discovered only from that process's socket inodes.
+An explicit private `--port` also works without Linux socket discovery.
+Other processes retain compatible shared-service discovery. Exact session and
+project/worktree ownership are checked before reading or answering. The plugin
+never starts another service, moves a session or changes authentication. An
+unverifiable private server fails explicitly rather than selecting a different
+shared service.
 
 The V1 event mappings are:
 

package/dist/backeer-permission.js

@@ -44,7 +44,7 @@ function make7(connect) {
     if (current === connection)
       current = void 0;
   }
-  async function run(connection) {
+  async function run2(connection) {
     let iterator;
     let completion = {};
     try {
@@ -133,7 +133,7 @@ function make7(connect) {
             if (connection.connected)
               subscriber.push(connection.connected);
             if (fresh)
-              run(connection);
+              run2(connection);
           }
           return {
             next() {
@@ -1966,7 +1966,20 @@ function loadLiveBridgeConfig(option, { configDirectory, ingestToken } = {}) {
     const tokenFile = values.tokenFile ?? process.env.BACKEER_LIVE_TOKEN_FILE ?? join(configDirectory, "secrets", "backeer-live-token");
     const token = readCredential(tokenFile);
     if (token === ingestToken) throw new Error("Live control requires a credential distinct from the Backeer ingest token");
-    return { enabled: true, token, tokenFile, port };
+    const owner = values.owner ?? "server";
+    if (!["server", "standalone", "tui"].includes(owner)) throw new Error("Live control owner must be server, standalone or tui");
+    const projectDirectory = values.projectDirectory;
+    if (projectDirectory !== void 0 && (typeof projectDirectory !== "string" || !isAbsolute(projectDirectory))) {
+      throw new Error("Live control projectDirectory must be an absolute path");
+    }
+    return {
+      enabled: true,
+      token,
+      tokenFile,
+      port,
+      owner,
+      ...projectDirectory === void 0 ? {} : { projectDirectory }
+    };
   } catch (error) {
     return { enabled: false, error: error.message };
   }
@@ -2141,16 +2154,16 @@ function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
 function sleep(milliseconds, signal2) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     if (signal2?.aborted) {
-      resolve2();
+      resolve3();
       return;
     }
     const timeout = setTimeout(done, milliseconds);
     function done() {
       clearTimeout(timeout);
       signal2?.removeEventListener("abort", done);
-      resolve2();
+      resolve3();
     }
     signal2?.addEventListener("abort", done, { once: true });
   });
@@ -2395,7 +2408,7 @@ import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
 
 // src/updates.js
-var PLUGIN_VERSION = "0.8.0";
+var PLUGIN_VERSION = "0.8.2";
 var PACKAGE_NAME = "backeer-opencode";
 var NPM_REGISTRY_URL = "https://registry.npmjs.org";
 var CHECK_TIMEOUT_MS = 3e3;
@@ -3416,6 +3429,7 @@ function createLifecycleController({
 // src/live-bridge.js
 import { createServer } from "node:http";
 import { randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { resolve as resolve2 } from "node:path";
 
 // src/permission-command.js
 var ALLOWED_DECISIONS = /* @__PURE__ */ new Set(["once", "always", "reject"]);
@@ -3980,24 +3994,78 @@ function createPermissionController({
   };
 }
 
+// src/live-session-scope.js
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { realpath } from "node:fs/promises";
+import { isAbsolute as isAbsolute2 } from "node:path";
+var run = promisify(execFile);
+async function commonDirectory(directory) {
+  const { stdout } = await run(
+    "git",
+    ["-C", directory, "rev-parse", "--path-format=absolute", "--git-common-dir"],
+    { timeout: 1e3, maxBuffer: 8192, windowsHide: true }
+  );
+  return realpath(stdout.trim());
+}
+function approvedWorktreeSessions(value) {
+  if (!Array.isArray(value) || value.length > 16) return [];
+  return value.filter((item) => /^[A-Za-z0-9_-]{1,160}$/.test(item?.sessionID) && item.sessionID !== "global" && typeof item.directory === "string" && isAbsolute2(item.directory) && item.directory.length <= 4096);
+}
+function createSessionScope(directory, { resolveCommon = commonDirectory, approvedSessions = [] } = {}) {
+  const observed = /* @__PURE__ */ new Map();
+  const approved = approvedWorktreeSessions(approvedSessions);
+  return async function owns(info) {
+    const location = info?.location?.directory ?? info?.directory;
+    if (typeof location !== "string" || typeof directory !== "string") return false;
+    if (location === directory) {
+      if (info.id) {
+        observed.set(info.id, info.projectID);
+        if (observed.size > 256) observed.delete(observed.keys().next().value);
+      }
+      return true;
+    }
+    const explicitlyApproved = approved.some((item) => item.sessionID === info.id && item.directory === location);
+    if (!explicitlyApproved && (!observed.has(info.id) || !info.projectID || observed.get(info.id) !== info.projectID)) return false;
+    try {
+      const [base, current] = await Promise.all([resolveCommon(directory), resolveCommon(location)]);
+      return base === current;
+    } catch {
+      return false;
+    }
+  };
+}
+
 // src/live-bridge-client.js
 function createV2LiveClient(ctx) {
-  const known = /* @__PURE__ */ new Map();
+  const approvedSessions = approvedWorktreeSessions(ctx.options?.liveBridge?.sessionWorktrees);
+  const known = new Map(approvedSessions.map((item) => [item.sessionID, void 0]));
+  const ownsSession = createSessionScope(ctx.location?.directory, { approvedSessions });
   let disposed = false;
   async function get(id) {
     const info = await ctx.session.get({ sessionID: id });
     if (disposed) return info;
+    await ownsSession(info);
     known.set(id, info);
     if (known.size > 100) known.delete(known.keys().next().value);
     return info;
   }
   return {
     async list() {
+      const refreshed = [];
       if (typeof ctx.session.list === "function") {
-        return ctx.session.list({ directory: ctx.location.directory, limit: 100, order: "desc" });
+        const result = await ctx.session.list({ directory: ctx.location.directory, limit: 100, order: "desc" });
+        const values = Array.isArray(result) ? result : result?.data;
+        if (!Array.isArray(values)) throw new Error("Invalid native session list");
+        for (const info of values.slice(0, 100)) {
+          if (await ownsSession(info)) {
+            refreshed.push(info);
+            known.set(info.id, info);
+          }
+        }
       }
-      const refreshed = [];
-      for (const id of known.keys()) {
+      for (const id of [...known.keys()].slice(0, 100)) {
+        if (refreshed.some((info) => info.id === id)) continue;
         try {
           refreshed.push(await get(id));
         } catch {
@@ -4007,6 +4075,7 @@ function createV2LiveClient(ctx) {
       return refreshed;
     },
     get,
+    ownsSession,
     prompt: (id, text) => ctx.session.prompt({ sessionID: id, text, delivery: "queue" }),
     dispose: () => {
       disposed = true;
@@ -4209,7 +4278,8 @@ function questionSnapshot(pending, text) {
   const revision = createHash("sha256").update(JSON.stringify({
     id: pending.id,
     sessionID: pending.sessionID,
-    questions: pending.questions
+    questions: pending.questions,
+    ...pending.nativeRevision ? { nativeRevision: pending.nativeRevision } : {}
   })).digest("hex");
   const result = { questionId: pending.id, sessionID: pending.sessionID, revision, questions };
   if (Buffer.byteLength(JSON.stringify(result)) > 3e4) throw invalid("question_too_large");
@@ -4258,9 +4328,11 @@ async function readBody(request) {
 }
 async function createLiveBridge({ config, client, directory, reporter }) {
   const options = config.liveBridge;
-  if (!options?.enabled) return { handle() {
-  }, async dispose() {
-  }, address: void 0 };
+  if (!options?.enabled || options.projectDirectory !== void 0 && resolve2(options.projectDirectory) !== resolve2(directory)) {
+    return { handle() {
+    }, async dispose() {
+    }, address: void 0 };
+  }
   const token = options.token;
   if (typeof token !== "string" || token.length < 32 || token === config.token) {
     throw new Error("Live bridge requires a separate credential of at least 32 characters");
@@ -4278,7 +4350,7 @@ async function createLiveBridge({ config, client, directory, reporter }) {
     if (disposed) return Promise.reject(failure(503, "bridge_closed"));
     if (lookups >= 16) return Promise.reject(failure(429, "session_lookup_busy"));
     lookups++;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       let finished = false;
       const finish = (complete, value) => {
         if (finished) return;
@@ -4293,7 +4365,7 @@ async function createLiveBridge({ config, client, directory, reporter }) {
       Promise.resolve().then(() => api.get(id)).then(
         (value) => {
           lookups--;
-          finish(resolve2, value);
+          finish(resolve3, value);
         },
         (error) => {
           lookups--;
@@ -4311,13 +4383,17 @@ async function createLiveBridge({ config, client, directory, reporter }) {
       if (["session_lookup_busy", "session_lookup_timed_out", "bridge_closed"].includes(error.code)) throw error;
       throw failure(404, "session_not_found");
     }
-    if (info?.id !== id || typeof info.time?.archived === "number" || (info.location?.directory ?? info.directory) !== directory) {
+    if (info?.id !== id || typeof info.time?.archived === "number") {
       throw failure(404, "session_not_found");
     }
+    const locationDirectory = info.location?.directory ?? info.directory;
+    const owned = api.ownsSession ? await api.ownsSession(info) : locationDirectory === directory;
+    if (!owned) throw failure(404, "session_not_found");
     return {
       id,
       directory,
       title: sanitizer.text(info.title, 240),
+      ...locationDirectory !== directory ? { locationDirectory: sanitizer.text(locationDirectory, 4096), scope: "verified_git_worktree" } : {},
       ...validBridgeID(info.parentID) ? { parentID: info.parentID } : {},
       status: states.get(id) ?? "unknown"
     };
@@ -4456,13 +4532,33 @@ data: ${JSON.stringify(record)}
         const result2 = await api.list();
         const values = Array.isArray(result2) ? result2 : result2?.data;
         if (!Array.isArray(values)) throw failure(502, "invalid_session_list");
-        const own = values.slice(0, 100).filter((info) => validBridgeID(info?.id) && typeof info.time?.archived !== "number" && (info.location?.directory ?? info.directory) === directory);
-        return json(response, 200, { sessions: own.map((info) => ({
-          id: info.id,
-          title: sanitizer.text(info.title, 240),
-          status: states.get(info.id) ?? "unknown",
-          ...validBridgeID(info.parentID) ? { parentID: info.parentID } : {}
-        })), directory, cursor: cursor() });
+        const own = [];
+        for (const info of values.slice(0, 100)) {
+          if (!validBridgeID(info?.id) || typeof info.time?.archived === "number") continue;
+          if (api.ownsSession ? await api.ownsSession(info) : (info.location?.directory ?? info.directory) === directory) own.push(info);
+        }
+        return json(response, 200, {
+          sessions: own.map((info) => ({
+            id: info.id,
+            title: sanitizer.text(info.title, 240),
+            status: states.get(info.id) ?? "unknown",
+            ...(info.location?.directory ?? info.directory) !== directory ? {
+              locationDirectory: sanitizer.text(info.location?.directory ?? info.directory, 4096),
+              scope: "verified_git_worktree"
+            } : {},
+            ...validBridgeID(info.parentID) ? { parentID: info.parentID } : {}
+          })),
+          directory,
+          cursor: cursor(),
+          protocolVersion: 1,
+          bridgeVersion: PLUGIN_VERSION,
+          capabilities: {
+            questions: typeof api.questions === "function",
+            questionAnswers: typeof api.answerQuestion === "function",
+            verifiedWorktreeSessions: typeof api.ownsSession === "function",
+            questionTransport: api.questionTransport ?? "server"
+          }
+        });
       }
       if (request.method === "GET" && url.pathname === "/v1/events") {
         const selected = url.searchParams.get("sessionID") || void 0;
@@ -4575,11 +4671,11 @@ retry: ${LIVE_RECONNECT_MS}
   server.requestTimeout = 15e3;
   server.headersTimeout = 1e4;
   server.keepAliveTimeout = 5e3;
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     server.once("error", reject);
     server.listen(options.port ?? 43871, "127.0.0.1", () => {
       server.off("error", reject);
-      resolve2();
+      resolve3();
     });
   });
   server.on("error", () => {
@@ -4588,7 +4684,7 @@ retry: ${LIVE_RECONNECT_MS}
     handle,
     address: server.address(),
     dispose() {
-      disposeTask ??= new Promise((resolve2) => {
+      disposeTask ??= new Promise((resolve3) => {
         disposed = true;
         for (const cancel of lookupWaiters) cancel();
         for (const stream of streams) {
@@ -4596,7 +4692,7 @@ retry: ${LIVE_RECONNECT_MS}
           stream.response.destroy();
         }
         server.close(() => {
-          void connectionNotifications.dispose().then(resolve2);
+          void connectionNotifications.dispose().then(resolve3);
         });
         server.closeAllConnections?.();
         events.length = 0;
@@ -4626,7 +4722,8 @@ async function BackeerPlugin({ client, directory, feedback, v2 = false }, option
   const reporter = createOpenCodeReporter(client, config.logLevel);
   const conversation = feedback ?? createConversationFeedback({ client, reporter });
   if (config.liveBridge.error) reporter.error("Live control disabled", config.liveBridge.error);
-  const liveBridge = await createLiveBridge({ config, client, directory, reporter }).catch((error) => {
+  const bridgeConfig = config.liveBridge.owner === "tui" || config.liveBridge.owner === "standalone" && (!v2 || !process.argv.includes("--stdio")) ? { ...config, liveBridge: { enabled: false } } : config;
+  const liveBridge = await createLiveBridge({ config: bridgeConfig, client, directory, reporter }).catch((error) => {
     reporter.error("Live control unavailable", error);
     return { async handle() {
     }, async dispose() {
@@ -5261,30 +5358,110 @@ async function terminate(info, options, timing) {
   await rm2(options.file ?? fallback2(), { force: true });
 }
 function delay(milliseconds) {
-  return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
+  return new Promise((resolve3) => setTimeout(resolve3, milliseconds));
 }
 var Service = { discover, ensure, stop, headers: headers2 };
 
+// src/opencode-v2-endpoint.js
+import { readdir, readFile as readFile3, readlink } from "node:fs/promises";
+async function ownLoopbackUrls({ platform = process.platform, fs = { readdir, readFile: readFile3, readlink } } = {}) {
+  if (platform !== "linux") return [];
+  const inodes = new Set((await Promise.all((await fs.readdir("/proc/self/fd")).map(async (fd) => {
+    try {
+      return /^socket:\[(\d+)\]$/.exec(await fs.readlink(`/proc/self/fd/${fd}`))?.[1];
+    } catch {
+      return void 0;
+    }
+  }))).filter(Boolean));
+  const tables = await Promise.all(["tcp", "tcp6"].map(async (name) => {
+    try {
+      return await fs.readFile(`/proc/self/net/${name}`, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return "";
+      throw error;
+    }
+  }));
+  const urls = /* @__PURE__ */ new Set();
+  for (const table of tables) for (const row of table.trim().split("\n").slice(1)) {
+    const fields = row.trim().split(/\s+/);
+    if (fields[3] !== "0A" || !inodes.has(fields[9])) continue;
+    const [address, portHex] = fields[1].split(":");
+    const host = address === "0100007F" ? "127.0.0.1" : address === "00000000000000000000000001000000" ? "[::1]" : void 0;
+    const port = Number.parseInt(portHex, 16);
+    if (host && port > 0 && port <= 65535) urls.add(`http://${host}:${port}`);
+  }
+  return [...urls];
+}
+async function privateEndpoint({
+  argv = process.argv,
+  env = process.env,
+  pid = process.pid,
+  platform = process.platform,
+  initialEnvironment = () => readFile3("/proc/self/environ", "utf8"),
+  urls = ownLoopbackUrls,
+  request = fetch
+} = {}) {
+  if (!argv.includes("--stdio")) return void 0;
+  const flag = argv.indexOf("--port");
+  const rawPort = flag >= 0 ? argv[flag + 1] : argv.find((arg) => arg.startsWith("--port="))?.slice(7);
+  const port = typeof rawPort === "string" && /^\d+$/.test(rawPort) ? Number(rawPort) : NaN;
+  try {
+    if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error();
+    const password = env.OPENCODE_PASSWORD || (platform === "linux" ? (await initialEnvironment()).split("\0").find((value) => value.startsWith("OPENCODE_PASSWORD="))?.slice(18) : void 0);
+    if (!password) throw new Error();
+    const candidates = port === 0 ? await urls() : [`http://127.0.0.1:${port}`];
+    for (const url of candidates) {
+      const endpoint = { url, auth: { type: "basic", username: "opencode", password } };
+      let response;
+      try {
+        response = await request(`${url}/api/info`, {
+          headers: Service.headers(endpoint),
+          signal: AbortSignal.timeout(2e3),
+          redirect: "error"
+        });
+        if (response.ok && (await response.json()).pid === pid) return endpoint;
+      } catch {
+      } finally {
+        await response?.body?.cancel().catch(() => {
+        });
+      }
+    }
+  } catch {
+  }
+  throw Object.assign(
+    new HttpError("The existing private OpenCode server could not be verified; keep its session running", 501),
+    { code: "question_private_server_unavailable" }
+  );
+}
+
 // src/opencode-v2-forms.js
-async function getFormApi(ctx, sessionID, { makeClient = exports_client.make } = {}) {
-  const endpoint = await Service.discover({ version: ctx.app.version });
+function unavailable(code, message, status = 501) {
+  return Object.assign(new HttpError(message, status), { code });
+}
+async function getFormApi(ctx, sessionID, { makeClient = exports_client.make, ownsSession, resolvePrivate = privateEndpoint } = {}) {
+  const endpoint = await resolvePrivate() ?? await Service.discover({ version: ctx.app.version }) ?? await Service.discover();
   if (!endpoint) {
-    throw new HttpError("Remote question replies require the OpenCode V2 shared service", 501);
+    throw unavailable("question_shared_service_unavailable", "Remote questions require a compatible running OpenCode V2 shared service");
   }
   const client = makeClient({ baseUrl: endpoint.url, headers: Service.headers(endpoint) });
   let session;
   try {
     session = await client.session.get({ sessionID });
   } catch {
-    throw new HttpError("The question session is not owned by the shared OpenCode service", 501);
+    throw unavailable("question_session_not_in_shared_service", "The question session is not owned by the shared OpenCode service");
   }
-  if (session.location.directory !== ctx.location.directory) {
-    throw new HttpError("The question session belongs to another OpenCode location", 403);
+  if (session.id !== void 0 && session.id !== sessionID) {
+    throw unavailable("question_session_not_in_shared_service", "The shared service returned another question session");
+  }
+  const owned = ownsSession ? await ownsSession(session) : session.location?.directory === ctx.location.directory;
+  if (!owned) {
+    throw unavailable("question_session_location_mismatch", "The question session belongs to another OpenCode location", 403);
   }
   return client.session.form;
 }
 
 // src/opencode-v2-client.js
+import { createHash as createHash2 } from "node:crypto";
 async function nativeReply(operation) {
   try {
     return await operation();
@@ -5310,6 +5487,12 @@ function questionProperties(form) {
   return {
     id: form.id,
     sessionID: form.sessionID,
+    nativeRevision: createHash2("sha256").update(JSON.stringify({
+      id: form.id,
+      sessionID: form.sessionID,
+      title: form.title,
+      fields: form.fields
+    })).digest("hex"),
     questions: form.fields.map((field) => ({
       header: field.title ?? form.title,
       question: field.description ?? field.title ?? form.title,
@@ -5359,9 +5542,11 @@ function normalizeV2Event(event) {
   }
   return [normalized];
 }
-function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(ctx, sessionID)) {
+function createV2Client(ctx, resolveFormApi) {
+  const liveBridge = createV2LiveClient(ctx);
+  resolveFormApi ??= (sessionID) => getFormApi(ctx, sessionID, { ownsSession: liveBridge.ownsSession });
   const client = {
-    liveBridge: createV2LiveClient(ctx),
+    liveBridge,
     app: {
       async log({ body }) {
         console.error(JSON.stringify(body));
@@ -5381,10 +5566,13 @@ function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(ctx, ses
       decision: body.response
     })),
     v2: { session: { question: {
-      async reply({ sessionID, requestID, questionV2Reply }) {
+      async reply({ sessionID, requestID, questionV2Reply, expectedNativeRevision }) {
         const api = await resolveFormApi(sessionID);
         const form = await nativeReply(() => api.get({ sessionID, formID: requestID }));
         if (!questionForm(form)) throw new HttpError("Unsupported OpenCode question form", 422);
+        if (expectedNativeRevision && questionProperties(form).nativeRevision !== expectedNativeRevision) {
+          throw Object.assign(new HttpError("The native question changed; read it again", 409), { code: "question_changed_read_again" });
+        }
         const answers = questionV2Reply.answers;
         if (!Array.isArray(answers) || answers.length !== form.fields.length) {
           throw new HttpError("Question answer count does not match the form", 422);
@@ -5412,13 +5600,13 @@ function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(ctx, ses
       }
     } } },
     async ownsEvent(event) {
-      if (event.location?.directory) return event.location.directory === ctx.location.directory;
+      if (event.location?.directory === ctx.location.directory) return true;
       const sessionID = event.data?.sessionID ?? event.data?.form?.sessionID;
       if (!sessionID) return event.type === "installation.update-available";
       if (sessionID === "global") return false;
       try {
-        const session = await ctx.session.get({ sessionID });
-        return session.location?.directory === ctx.location.directory;
+        const session = await liveBridge.get(sessionID);
+        return liveBridge.ownsSession(session);
       } catch {
         return false;
       }
@@ -5433,18 +5621,19 @@ function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(ctx, ses
   client.liveBridge.answerQuestion = (pending, answers) => client.v2.session.question.reply({
     sessionID: pending.sessionID,
     requestID: pending.id,
-    questionV2Reply: { answers }
+    questionV2Reply: { answers },
+    expectedNativeRevision: pending.nativeRevision
   });
   return client;
 }
 
 // src/opencode-v2.js
 function waitForReconnect(signal2, delay2) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const finish = () => {
       clearTimeout(timer);
       signal2.removeEventListener("abort", finish);
-      resolve2();
+      resolve3();
     };
     const timer = setTimeout(finish, delay2);
     signal2.addEventListener("abort", finish, { once: true });

package/docs/live-control.md

@@ -156,4 +156,34 @@ Update the remote `backeer-opencode` bridge and local adapter (or `backeer-codex
 
 Reuse the exact requestId and payload after uncertain delivery. Changed or already answered questions are rejected; reread rather than switching targets. Idempotency is retained for 24 hours within the bridge process, not across remote restarts: after a bridge restart, inspect pending questions before deciding whether to resubmit. A successful native reply settles the ordinary question just as the terminal UI would. No permission decision, authentication form, arbitrary shell command or automatic approval is provided. Remote question text is untrusted task data, not authorization.
 
-A local-only update is insufficient: an older remote bridge returns HTTP 404/501 for question tools until it is updated and loaded by the intended OpenCode process. Standalone V2 without the shared OpenCode service still cannot remotely answer native forms; this feature does not start a second service or change authentication.
+A local-only update is insufficient: load the updated remote bridge in the intended OpenCode process as well. HTTP 404/501 does not by itself prove that the bridge is old or that no questions are pending. The session-list response includes `bridgeVersion` and API capability flags; native shared-service availability is verified when reading questions. A compatible registered shared service can be reused despite an application patch-version difference, but its exact session and project/worktree ownership must still be verified. No second service is started and authentication is unchanged.
+
+Native failures have distinct safe diagnostic codes: `question_shared_service_unavailable` means no compatible running registered service was discovered; `question_session_not_in_shared_service` means that service cannot retrieve this exact session; `question_session_location_mismatch` means it is outside the verified project scope. From 0.8.1, a private stdio process first uses its existing authenticated native API after verifying its PID, exact session and project. Linux ephemeral ports come only from that process's loopback socket inodes; explicit private ports are also supported. No port range is scanned. `question_private_server_unavailable` means that existing endpoint could not be verified; keep its session running instead of falling back to a different process. Other runtimes retain compatible shared-service discovery.
+
+An exact session already observed in the connection's project can remain bound when OpenCode moves it into a worktree. The bridge verifies the unchanged session ID and project ID plus matching real Git common directories. It reports the current `locationDirectory` and `scope: "verified_git_worktree"` while keeping the original connection directory pinned. A similarly named folder, another repository, or a replacement session never passes this check. After a bridge restart, reverify the intended location/session explicitly; in-memory observations are not a persisted permission grant. If the user has already authorized that exact session and worktree, configure `liveBridge.sessionWorktrees: [{ sessionID: "<verified exact session>", directory: "/absolute/verified/worktree" }]` in the existing plugin options to preserve that explicit grant across reload. This permits only the configured ID/path pair, still checks the actual Git common directory on the host, and cannot authorize a foreign repository. Never place real session IDs in public source/packages. SSE replay-gap acknowledgement and question revision/idempotency rules still apply.
+
+## Optional native TUI owner
+
+The package exports a native TUI companion as `./tui`. Setting
+`liveBridge.owner: "tui"` explicitly moves the live listener to that companion;
+the server entrypoint then leaves the port free while preserving its other
+integration duties. The companion uses the actual host-injected
+`OpenCodeClient.session.form.list/get/reply/cancel` and native data events. It
+does not discover another service, inspect terminal contents, emulate question
+HTTP endpoints, or start an OpenCode service. Confirm
+`capabilities.questionTransport === "injected_native_client"` after activation.
+This mode requires the directory/npm package with both entrypoints, rather than
+the legacy server-only single-file side load. Keep the standard server owner
+when its existing private native API can be verified; no owner migration is
+required in that case. Plugin teardown closes its bridge only; verify the
+running host's reload semantics before activation, since the external CLI may
+target a different shared service and full location reload may affect active
+work.
+
+## Global bridge location pin (0.8.2)
+
+When the bridge is configured globally, set `liveBridge.projectDirectory` to the intended project's absolute directory. Only that location starts the listener; loading the plugin in an npm cache or another project cannot claim its port. This restricts the host location and preserves the existing exact-session/worktree authorization checks. It does not change an existing chat binding, stored connection, token or port. Other independent servers hosting the same project still need distinct explicitly configured ports.
+
+OpenCode may remove `OPENCODE_PASSWORD` from runtime `process.env`. A Linux private server can reuse only its own original password from `/proc/self/environ`; it is neither logged nor copied to configuration. Native API PID, exact-session and project checks still apply. No other PID or port range is inspected.
+
+If both a private stdio server and a shared server load that same project, `liveBridge.owner: "standalone"` restricts the listener to the private server. It detects the current process's existing `--stdio` flag rather than a stored PID or session ID. The shared server's other Backeer duties remain active. The default `owner: "server"` and optional `owner: "tui"` behavior remain unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backeer-opencode",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Backeer mobile approvals and authenticated live OpenCode control over SSE and MCP",
   "type": "module",
   "main": "./src/index.js",
@@ -10,7 +10,8 @@
     "./live-profiles": "./src/live-profiles.js",
     "./live-session-manager": "./src/live-session-manager.js",
     "./live-managed-mcp": "./src/live-managed-mcp.js",
-    "./live-discovery": "./src/live-discovery.js"
+    "./live-discovery": "./src/live-discovery.js",
+    "./tui": "./src/opencode-v2-tui.js"
   },
   "bin": {
     "backeer-opencode": "bin/backeer-opencode.js",

package/src/live-bridge-client.js

@@ -1,31 +1,45 @@
 import { replyToQuestion } from "./permission-controller.js"
+import { createSessionScope, approvedWorktreeSessions } from "./live-session-scope.js"
 
 // Normal prompts and ordinary question answers only; never permission/auth replies.
 export function createV2LiveClient(ctx) {
   // 2.0.26's plugin SessionDomain intentionally omits list(). Track sessions
   // observed through get/events instead of inventing that context method or
   // starting a second OpenCode service just for discovery.
-  const known = new Map()
+  const approvedSessions = approvedWorktreeSessions(ctx.options?.liveBridge?.sessionWorktrees)
+  const known = new Map(approvedSessions.map(item => [item.sessionID, undefined]))
+  const ownsSession = createSessionScope(ctx.location?.directory, { approvedSessions })
   let disposed = false
   async function get(id) {
     const info = await ctx.session.get({ sessionID: id })
     if (disposed) return info
+    await ownsSession(info)
     known.set(id, info)
     if (known.size > 100) known.delete(known.keys().next().value)
     return info
   }
   return {
     async list() {
+      const refreshed = []
       if (typeof ctx.session.list === "function") {
-        return ctx.session.list({ directory: ctx.location.directory, limit: 100, order: "desc" })
+        const result = await ctx.session.list({ directory: ctx.location.directory, limit: 100, order: "desc" })
+        const values = Array.isArray(result) ? result : result?.data
+        if (!Array.isArray(values)) throw new Error("Invalid native session list")
+        for (const info of values.slice(0, 100)) {
+          if (await ownsSession(info)) {
+            refreshed.push(info)
+            known.set(info.id, info)
+          }
+        }
       }
-      const refreshed = []
-      for (const id of known.keys()) {
+      for (const id of [...known.keys()].slice(0, 100)) {
+        if (refreshed.some(info => info.id === id)) continue
         try { refreshed.push(await get(id)) } catch { known.delete(id) }
       }
       return refreshed
     },
     get,
+    ownsSession,
     prompt: (id, text) => ctx.session.prompt({ sessionID: id, text, delivery: "queue" }),
     dispose: () => { disposed = true; known.clear() },
   }

package/src/live-bridge-config.js

@@ -40,7 +40,14 @@ export function loadLiveBridgeConfig(option, { configDirectory, ingestToken } =
       join(configDirectory, "secrets", "backeer-live-token")
     const token = readCredential(tokenFile)
     if (token === ingestToken) throw new Error("Live control requires a credential distinct from the Backeer ingest token")
-    return { enabled: true, token, tokenFile, port }
+    const owner = values.owner ?? "server"
+    if (!["server", "standalone", "tui"].includes(owner)) throw new Error("Live control owner must be server, standalone or tui")
+    const projectDirectory = values.projectDirectory
+    if (projectDirectory !== undefined && (typeof projectDirectory !== "string" || !isAbsolute(projectDirectory))) {
+      throw new Error("Live control projectDirectory must be an absolute path")
+    }
+    return { enabled: true, token, tokenFile, port, owner,
+      ...(projectDirectory === undefined ? {} : { projectDirectory }) }
   } catch (error) {
     // A bad opt-in must not disable the existing mobile approval integration.
     return { enabled: false, error: error.message }

package/src/live-bridge.js

@@ -1,9 +1,11 @@
 import { createServer } from "node:http"
 import { randomUUID, timingSafeEqual } from "node:crypto"
+import { resolve } from "node:path"
 import { createV1LiveClient } from "./live-bridge-client.js"
 import { createLiveConnectionNotifier, LIVE_HEARTBEAT_MS, LIVE_RECONNECT_MS } from "./live-connection.js"
 import { createBridgeSanitizer, validBridgeID } from "./live-bridge-events.js"
 import { questionSnapshot, resolveQuestionAnswers } from "./live-questions.js"
+import { PLUGIN_VERSION } from "./updates.js"
 
 const LIMITS = { events: 256, bytes: 2_000_000, clients: 8, commands: 1024, commandTTL: 86_400_000, body: 32_768, requests: 16 }
 function failure(status, code) { return Object.assign(new Error(code), { status, code }) }
@@ -26,7 +28,10 @@ async function readBody(request) {
 
 export async function createLiveBridge({ config, client, directory, reporter }) {
   const options = config.liveBridge
-  if (!options?.enabled) return { handle() {}, async dispose() {}, address: undefined }
+  if (!options?.enabled || (options.projectDirectory !== undefined &&
+      resolve(options.projectDirectory) !== resolve(directory))) {
+    return { handle() {}, async dispose() {}, address: undefined }
+  }
   const token = options.token
   if (typeof token !== "string" || token.length < 32 || token === config.token) {
     throw new Error("Live bridge requires a separate credential of at least 32 characters")
@@ -73,11 +78,15 @@ export async function createLiveBridge({ config, client, directory, reporter })
       if (["session_lookup_busy", "session_lookup_timed_out", "bridge_closed"].includes(error.code)) throw error
       throw failure(404, "session_not_found")
     }
-    if (info?.id !== id || typeof info.time?.archived === "number" || (info.location?.directory ?? info.directory) !== directory) {
+    if (info?.id !== id || typeof info.time?.archived === "number") {
       throw failure(404, "session_not_found")
     }
+    const locationDirectory = info.location?.directory ?? info.directory
+    const owned = api.ownsSession ? await api.ownsSession(info) : locationDirectory === directory
+    if (!owned) throw failure(404, "session_not_found")
     return {
       id, directory, title: sanitizer.text(info.title, 240),
+      ...(locationDirectory !== directory ? { locationDirectory: sanitizer.text(locationDirectory, 4096), scope: "verified_git_worktree" } : {}),
       ...(validBridgeID(info.parentID) ? { parentID: info.parentID } : {}),
       status: states.get(id) ?? "unknown",
     }
@@ -197,12 +206,21 @@ export async function createLiveBridge({ config, client, directory, reporter })
         const result = await api.list()
         const values = Array.isArray(result) ? result : result?.data
         if (!Array.isArray(values)) throw failure(502, "invalid_session_list")
-        const own = values.slice(0, 100).filter((info) => validBridgeID(info?.id) && typeof info.time?.archived !== "number" &&
-          (info.location?.directory ?? info.directory) === directory)
+        const own = []
+        for (const info of values.slice(0, 100)) {
+          if (!validBridgeID(info?.id) || typeof info.time?.archived === "number") continue
+          if (api.ownsSession ? await api.ownsSession(info) : (info.location?.directory ?? info.directory) === directory) own.push(info)
+        }
         return json(response, 200, { sessions: own.map((info) => ({
           id: info.id, title: sanitizer.text(info.title, 240), status: states.get(info.id) ?? "unknown",
+          ...((info.location?.directory ?? info.directory) !== directory ? {
+            locationDirectory: sanitizer.text(info.location?.directory ?? info.directory, 4096), scope: "verified_git_worktree",
+          } : {}),
           ...(validBridgeID(info.parentID) ? { parentID: info.parentID } : {}),
-        })), directory, cursor: cursor() })
+        })), directory, cursor: cursor(), protocolVersion: 1, bridgeVersion: PLUGIN_VERSION,
+        capabilities: { questions: typeof api.questions === "function", questionAnswers: typeof api.answerQuestion === "function",
+          verifiedWorktreeSessions: typeof api.ownsSession === "function",
+          questionTransport: api.questionTransport ?? "server" } })
       }
       if (request.method === "GET" && url.pathname === "/v1/events") {
         const selected = url.searchParams.get("sessionID") || undefined

package/src/live-control-client.js

@@ -3,6 +3,7 @@ import { open, lstat } from "node:fs/promises"
 import { isAbsolute } from "node:path"
 import { LIVE_RECONNECT_MS, LIVE_STALE_MS } from "./live-connection.js"
 import { checkWindowsTokenAcl } from "./live-token-permissions.js"
+import { liveErrorMessages } from "./live-errors.js"
 
 const CURSOR = /^[A-Za-z0-9_-]{1,80}:\d{1,16}$/
 const SESSION = /^[A-Za-z0-9_-]{1,160}$/
@@ -108,9 +109,19 @@ export class LiveControlClient {
         ...(body ? { body: JSON.stringify(body) } : {}),
       })
       if (!response.ok) {
-        // Never return a remote error body: it may contain original prompts or credentials.
-        await response.body?.cancel().catch(() => {})
-        throw new Error(`Live-control request failed (HTTP ${response.status})`)
+        // Read only a bounded JSON code; return exclusively local allowlisted
+        // messages, never original upstream error text or arbitrary JSON data.
+        let code
+        try {
+          if (response.headers.get("content-type")?.includes("application/json")) {
+            const value = JSON.parse(await boundedText(response, 4096))
+            if (Object.hasOwn(liveErrorMessages, value?.error)) code = value.error
+          }
+        } catch { /* Retain the generic status without exposing remote content. */ }
+        finally { await response.body?.cancel().catch(() => {}) }
+        const diagnostic = code ? `: ${liveErrorMessages[code]}` : ""
+        throw Object.assign(new Error(`Live-control request failed (HTTP ${response.status})${diagnostic}`),
+          { status: response.status, ...(code ? { code } : {}) })
       }
       const text = await boundedText(response, 256 * 1024)
       return JSON.parse(text)

package/src/live-control-mcp.js

@@ -4,6 +4,7 @@ import { z } from "zod"
 import { LiveControlClient, readLiveControlToken } from "./live-control-client.js"
 import { discoveryDefaults } from "./live-discovery.js"
 import { answerSchema, listQuestionDescription, answerQuestionDescription } from "./live-question-tools.js"
+import { safeLiveErrorMessage } from "./live-errors.js"
 
 const cursor = z.string().regex(/^[A-Za-z0-9_-]{1,80}:\d{1,16}$/)
 const sessionId = z.string().regex(/^[A-Za-z0-9_-]{1,160}$/)
@@ -22,8 +23,7 @@ export function createLiveControlMcp(client) {
     try { return result(await run(args, extra)) }
     catch (error) {
       // Fetch errors can include URLs and secrets from third-party implementations; expose only known local messages.
-      const message = /^Live-control request failed \(HTTP \d{3}\)$/.test(error.message)
-        ? error.message : "Live-control operation failed. Check the SSH tunnel, bridge configuration and local adapter diagnostics."
+      const message = safeLiveErrorMessage(error) ?? "Live-control operation failed. Check the SSH tunnel, bridge configuration and local adapter diagnostics."
       return { isError: true, content: [{ type: "text", text: message }] }
     }
   })

package/src/live-errors.js

@@ -0,0 +1,19 @@
+// Only these locally authored diagnostics may cross the transport boundary.
+// Arbitrary upstream error text, prompts and credentials are never displayed.
+export const liveErrorMessages = Object.freeze({
+  question_private_server_unavailable: "The existing private OpenCode server could not be verified. Keep its current session running; check its native API connection without switching sessions or starting another server.",
+  question_shared_service_unavailable: "No compatible running OpenCode shared service is available for native questions. Keep current work running; configure its supported shared-service connection before retrying.",
+  question_session_not_in_shared_service: "The running OpenCode shared service does not own this exact question session. Check the service connection; do not switch sessions or create a replacement.",
+  question_session_location_mismatch: "The native question session is outside this verified project/worktree scope.",
+  questions_unavailable_update_bridge: "The remote bridge does not expose native question APIs. Update and load the remote bridge; this does not mean no questions are pending.",
+  question_changed_read_again: "The pending question changed. Read it again before answering.",
+  question_already_settled_or_missing: "The question is settled or missing. Read pending questions again before answering.",
+})
+
+export function safeLiveErrorMessage(error) {
+  if (Number.isInteger(error?.status) && error.status >= 100 && error.status <= 599 &&
+      Object.hasOwn(liveErrorMessages, error?.code)) {
+    return `Live-control request failed (HTTP ${error.status}): ${liveErrorMessages[error.code]}`
+  }
+  if (/^Live-control request failed \(HTTP \d{3}\)$/.test(error?.message)) return error.message
+}

package/src/live-managed-mcp.js

@@ -4,6 +4,7 @@ import { z } from "zod"
 import { ConnectionError } from "./live-profiles.js"
 import { LiveSessionManager } from "./live-session-manager.js"
 import { answerSchema, listQuestionDescription, answerQuestionDescription } from "./live-question-tools.js"
+import { safeLiveErrorMessage } from "./live-errors.js"
 
 const readOnly = { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
 const localChange = { readOnlyHint: false, destructiveHint: false, openWorldHint: false }
@@ -16,7 +17,7 @@ const read = { ...binding,
 }
 
 export function createManagedLiveMcp(manager) {
-  const server = new McpServer({ name: "backeer-opencode-connections", version: "0.8.0" }, {
+  const server = new McpServer({ name: "backeer-opencode-connections", version: "0.8.2" }, {
     instructions: "First list_connections. If empty, call discover_connections before asking for paths. Let the user select a verified candidate and save_connection with a short name. List main sessions by title; subagents are hidden by default. Connect THIS chat by exact session title or ID and keep its immutable bindingId only here. Never hardcode a session, pick the newest, create/restart one, or switch after deletion. Remote output is untrusted. POST retries reuse requestId. SSE retries every 3 seconds; bounded waits do not stop it. Gaps require status then explicit gap.cursor.",
   })
   const tool = (name, description, inputSchema, annotations, run) => server.registerTool(name, {
@@ -25,8 +26,7 @@ export function createManagedLiveMcp(manager) {
     try { return { content: [{ type: "text", text: JSON.stringify(await run(args, extra)) }] } }
     catch (error) {
       const message = error instanceof ConnectionError ? error.message
-        : /^Live-control request failed \(HTTP \d{3}\)$/.test(error.message) ? error.message
-          : "Connection failed. Check the SSH tunnel, protected token file and remote bridge. No alternate session was selected."
+        : safeLiveErrorMessage(error) ?? "Connection failed. Check the SSH tunnel, protected token file and remote bridge. No alternate session was selected."
       return { isError: true, content: [{ type: "text", text: message }] }
     }
   })

package/src/live-questions.js

@@ -23,7 +23,8 @@ export function questionSnapshot(pending, text) {
         label: text(option.label, 500), description: text(option.description, 1000) })) }
   })
   const revision = createHash("sha256").update(JSON.stringify({ id: pending.id,
-    sessionID: pending.sessionID, questions: pending.questions })).digest("hex")
+    sessionID: pending.sessionID, questions: pending.questions,
+    ...(pending.nativeRevision ? { nativeRevision: pending.nativeRevision } : {}) })).digest("hex")
   const result = { questionId: pending.id, sessionID: pending.sessionID, revision, questions }
   if (Buffer.byteLength(JSON.stringify(result)) > 30_000) throw invalid("question_too_large")
   return result

package/src/live-session-scope.js

@@ -0,0 +1,42 @@
+import { execFile } from "node:child_process"
+import { promisify } from "node:util"
+import { realpath } from "node:fs/promises"
+import { isAbsolute } from "node:path"
+
+const run = promisify(execFile)
+
+async function commonDirectory(directory) {
+  const { stdout } = await run("git", ["-C", directory, "rev-parse", "--path-format=absolute", "--git-common-dir"],
+    { timeout: 1000, maxBuffer: 8192, windowsHide: true })
+  return realpath(stdout.trim())
+}
+
+// Follow only an already observed exact session into a real worktree of the
+// same Git repository. A path prefix or a remote projectID alone is not proof.
+export function approvedWorktreeSessions(value) {
+  if (!Array.isArray(value) || value.length > 16) return []
+  return value.filter(item => /^[A-Za-z0-9_-]{1,160}$/.test(item?.sessionID) && item.sessionID !== "global" &&
+    typeof item.directory === "string" && isAbsolute(item.directory) && item.directory.length <= 4096)
+}
+
+export function createSessionScope(directory, { resolveCommon = commonDirectory, approvedSessions = [] } = {}) {
+  const observed = new Map()
+  const approved = approvedWorktreeSessions(approvedSessions)
+  return async function owns(info) {
+    const location = info?.location?.directory ?? info?.directory
+    if (typeof location !== "string" || typeof directory !== "string") return false
+    if (location === directory) {
+      if (info.id) {
+        observed.set(info.id, info.projectID)
+        if (observed.size > 256) observed.delete(observed.keys().next().value)
+      }
+      return true
+    }
+    const explicitlyApproved = approved.some(item => item.sessionID === info.id && item.directory === location)
+    if (!explicitlyApproved && (!observed.has(info.id) || !info.projectID || observed.get(info.id) !== info.projectID)) return false
+    try {
+      const [base, current] = await Promise.all([resolveCommon(directory), resolveCommon(location)])
+      return base === current
+    } catch { return false }
+  }
+}

package/src/opencode-v2-client.js

@@ -1,6 +1,7 @@
 import { HttpError } from "./http.js"
 import { getFormApi } from "./opencode-v2-forms.js"
 import { createV2LiveClient } from "./live-bridge-client.js"
+import { createHash } from "node:crypto"
 
 async function nativeReply(operation) {
   try {
@@ -30,6 +31,8 @@ function questionForm(form) {
 
 function questionProperties(form) {
   return { id: form.id, sessionID: form.sessionID,
+    nativeRevision: createHash("sha256").update(JSON.stringify({ id: form.id,
+      sessionID: form.sessionID, title: form.title, fields: form.fields })).digest("hex"),
     questions: form.fields.map((field) => ({
       header: field.title ?? form.title,
       question: field.description ?? field.title ?? form.title,
@@ -79,9 +82,11 @@ export function normalizeV2Event(event) {
   return [normalized]
 }
 
-export function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(ctx, sessionID)) {
+export function createV2Client(ctx, resolveFormApi) {
+  const liveBridge = createV2LiveClient(ctx)
+  resolveFormApi ??= (sessionID) => getFormApi(ctx, sessionID, { ownsSession: liveBridge.ownsSession })
   const client = {
-    liveBridge: createV2LiveClient(ctx),
+    liveBridge,
     app: {
       async log({ body }) {
         // Server stderr is captured by OpenCode's log, never the TUI input.
@@ -102,10 +107,13 @@ export function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(c
       decision: body.response,
     })),
     v2: { session: { question: {
-      async reply({ sessionID, requestID, questionV2Reply }) {
+      async reply({ sessionID, requestID, questionV2Reply, expectedNativeRevision }) {
         const api = await resolveFormApi(sessionID)
         const form = await nativeReply(() => api.get({ sessionID, formID: requestID }))
         if (!questionForm(form)) throw new HttpError("Unsupported OpenCode question form", 422)
+        if (expectedNativeRevision && questionProperties(form).nativeRevision !== expectedNativeRevision) {
+          throw Object.assign(new HttpError("The native question changed; read it again", 409), { code: "question_changed_read_again" })
+        }
         const answers = questionV2Reply.answers
         if (!Array.isArray(answers) || answers.length !== form.fields.length) {
           throw new HttpError("Question answer count does not match the form", 422)
@@ -133,13 +141,13 @@ export function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(c
       },
     } } },
     async ownsEvent(event) {
-      if (event.location?.directory) return event.location.directory === ctx.location.directory
+      if (event.location?.directory === ctx.location.directory) return true
       const sessionID = event.data?.sessionID ?? event.data?.form?.sessionID
       if (!sessionID) return event.type === "installation.update-available"
       if (sessionID === "global") return false
       try {
-        const session = await ctx.session.get({ sessionID })
-        return session.location?.directory === ctx.location.directory
+        const session = await liveBridge.get(sessionID)
+        return liveBridge.ownsSession(session)
       } catch {
         return false
       }
@@ -153,7 +161,7 @@ export function createV2Client(ctx, resolveFormApi = (sessionID) => getFormApi(c
       (!form.state || form.state.status === "pending")).map(questionProperties)
   }
   client.liveBridge.answerQuestion = (pending, answers) => client.v2.session.question.reply({
-    sessionID: pending.sessionID, requestID: pending.id, questionV2Reply: { answers },
+    sessionID: pending.sessionID, requestID: pending.id, questionV2Reply: { answers }, expectedNativeRevision: pending.nativeRevision,
   })
   return client
 }

package/src/opencode-v2-endpoint.js

@@ -0,0 +1,60 @@
+import { readdir, readFile, readlink } from "node:fs/promises"
+import { Service } from "@opencode/client/service"
+
+import { HttpError } from "./http.js"
+
+// Inspect only sockets already owned by this server; never scan other ports.
+export async function ownLoopbackUrls({ platform = process.platform, fs = { readdir, readFile, readlink } } = {}) {
+  if (platform !== "linux") return []
+  const inodes = new Set((await Promise.all((await fs.readdir("/proc/self/fd")).map(async fd => {
+    try { return /^socket:\[(\d+)\]$/.exec(await fs.readlink(`/proc/self/fd/${fd}`))?.[1] }
+    catch { return undefined } // Descriptors can close while being inspected.
+  }))).filter(Boolean))
+  const tables = await Promise.all(["tcp", "tcp6"].map(async name => {
+    try { return await fs.readFile(`/proc/self/net/${name}`, "utf8") }
+    catch (error) { if (error.code === "ENOENT") return ""; throw error }
+  }))
+  const urls = new Set()
+  for (const table of tables) for (const row of table.trim().split("\n").slice(1)) {
+    const fields = row.trim().split(/\s+/)
+    if (fields[3] !== "0A" || !inodes.has(fields[9])) continue
+    const [address, portHex] = fields[1].split(":")
+    const host = address === "0100007F" ? "127.0.0.1"
+      : address === "00000000000000000000000001000000" ? "[::1]" : undefined
+    const port = Number.parseInt(portHex, 16)
+    if (host && port > 0 && port <= 65535) urls.add(`http://${host}:${port}`)
+  }
+  return [...urls]
+}
+
+export async function privateEndpoint({ argv = process.argv, env = process.env, pid = process.pid,
+  platform = process.platform, initialEnvironment = () => readFile("/proc/self/environ", "utf8"),
+  urls = ownLoopbackUrls, request = fetch } = {}) {
+  if (!argv.includes("--stdio")) return undefined
+  const flag = argv.indexOf("--port")
+  const rawPort = flag >= 0 ? argv[flag + 1] : argv.find(arg => arg.startsWith("--port="))?.slice(7)
+  const port = typeof rawPort === "string" && /^\d+$/.test(rawPort) ? Number(rawPort) : NaN
+  try {
+    if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error()
+    // OpenCode removes this variable at runtime. Linux retains this process's
+    // initial environment; read only our own existing password, never another PID.
+    const password = env.OPENCODE_PASSWORD || (platform === "linux"
+      ? (await initialEnvironment()).split("\0").find(value => value.startsWith("OPENCODE_PASSWORD="))?.slice(18)
+      : undefined)
+    if (!password) throw new Error()
+    const candidates = port === 0 ? await urls() : [`http://127.0.0.1:${port}`]
+    for (const url of candidates) {
+      const endpoint = { url, auth: { type: "basic", username: "opencode", password } }
+      let response
+      try {
+        response = await request(`${url}/api/info`, {
+          headers: Service.headers(endpoint), signal: AbortSignal.timeout(2000), redirect: "error",
+        })
+        if (response.ok && (await response.json()).pid === pid) return endpoint
+      } catch { /* Another listener owned by this process is not its native API. */ }
+      finally { await response?.body?.cancel().catch(() => {}) }
+    }
+  } catch { /* Report only a safe diagnostic, never upstream credentials or output. */ }
+  throw Object.assign(new HttpError("The existing private OpenCode server could not be verified; keep its session running", 501),
+    { code: "question_private_server_unavailable" })
+}

package/src/opencode-v2-forms.js

@@ -2,23 +2,34 @@ import { OpenCode } from "@opencode/client"
 import { Service } from "@opencode/client/service"
 
 import { HttpError } from "./http.js"
+import { privateEndpoint } from "./opencode-v2-endpoint.js"
 
-export async function getFormApi(ctx, sessionID, { makeClient = OpenCode.make } = {}) {
+function unavailable(code, message, status = 501) {
+  return Object.assign(new HttpError(message, status), { code })
+}
+
+export async function getFormApi(ctx, sessionID, { makeClient = OpenCode.make, ownsSession, resolvePrivate = privateEndpoint } = {}) {
   // 2.0.26 exposes forms on the client API, but not on the plugin context.
-  // Discover only: never start a second service or change its configuration.
-  const endpoint = await Service.discover({ version: ctx.app.version })
+  // Prefer the current private server; never start a second service or change it.
+  // discover() itself checks the registered service's protocol compatibility.
+  // An app patch-version difference must not hide a compatible owning service.
+  const endpoint = await resolvePrivate() ?? await Service.discover({ version: ctx.app.version }) ?? await Service.discover()
   if (!endpoint) {
-    throw new HttpError("Remote question replies require the OpenCode V2 shared service", 501)
+    throw unavailable("question_shared_service_unavailable", "Remote questions require a compatible running OpenCode V2 shared service")
   }
   const client = makeClient({ baseUrl: endpoint.url, headers: Service.headers(endpoint) })
   let session
   try {
     session = await client.session.get({ sessionID })
   } catch {
-    throw new HttpError("The question session is not owned by the shared OpenCode service", 501)
+    throw unavailable("question_session_not_in_shared_service", "The question session is not owned by the shared OpenCode service")
+  }
+  if (session.id !== undefined && session.id !== sessionID) {
+    throw unavailable("question_session_not_in_shared_service", "The shared service returned another question session")
   }
-  if (session.location.directory !== ctx.location.directory) {
-    throw new HttpError("The question session belongs to another OpenCode location", 403)
+  const owned = ownsSession ? await ownsSession(session) : session.location?.directory === ctx.location.directory
+  if (!owned) {
+    throw unavailable("question_session_location_mismatch", "The question session belongs to another OpenCode location", 403)
   }
   return client.session.form
 }

package/src/opencode-v2-tui.js

@@ -0,0 +1,49 @@
+import { loadConfig } from "./config.js"
+import { createLiveBridge } from "./live-bridge.js"
+import { createV2Client, normalizeV2Event } from "./opencode-v2-client.js"
+import { HttpError } from "./http.js"
+
+// The public TUI plugin context injects the client of the actual connected
+// OpenCode owner, including standalone processes. Never discover another server.
+export async function setup(ctx) {
+  if (ctx.options?.liveBridge?.owner !== "tui" || !ctx.location?.directory) return
+  const native = ctx.client
+  if (!native?.session?.form?.list || !native.session.form.get || !native.session.form.reply ||
+      !native.session.form.cancel || !native.session.get || !native.session.prompt) {
+    throw new HttpError("The injected OpenCode client does not expose native question forms", 501)
+  }
+  const config = loadConfig(ctx.options)
+  if (!config.liveBridge.enabled) return
+  const ownerContext = { app: ctx.app, options: ctx.options, location: ctx.location, session: native.session }
+  let client
+  client = createV2Client(ownerContext, async sessionID => {
+    const info = await native.session.get({ sessionID })
+    if (info.id !== sessionID || !await client.liveBridge.ownsSession(info)) {
+      throw Object.assign(new HttpError("The native question session is outside the verified project", 403),
+        { code: "question_session_location_mismatch" })
+    }
+    return native.session.form
+  })
+  client.liveBridge.questionTransport = "injected_native_client"
+  const bridge = await createLiveBridge({ config, client, directory: ctx.location.directory })
+  let disposed = false
+  // Public native data events, not terminal content or UI automation. New
+  // subscribers read authoritative pending forms directly from the same owner.
+  const unlisten = ctx.data.listen(({ details }) => {
+    void (async () => {
+      if (disposed || !await client.ownsEvent(details)) return
+      for (const event of normalizeV2Event(details)) {
+        if (disposed) return
+        await bridge.handle(event)
+      }
+    })().catch(() => { /* A failed event must not affect the native TUI or active work. */ })
+  })
+  let cleanup
+  return () => cleanup ??= (async () => {
+    disposed = true
+    unlisten()
+    await bridge.dispose()
+  })()
+}
+
+export default { id: "backeer-opencode", setup }

package/src/plugin.js

@@ -48,7 +48,10 @@ export default async function BackeerPlugin({ client, directory, feedback, v2 =
   const reporter = createOpenCodeReporter(client, config.logLevel)
   const conversation = feedback ?? createConversationFeedback({ client, reporter })
   if (config.liveBridge.error) reporter.error("Live control disabled", config.liveBridge.error)
-  const liveBridge = await createLiveBridge({ config, client, directory, reporter }).catch((error) => {
+  const bridgeConfig = config.liveBridge.owner === "tui" ||
+    (config.liveBridge.owner === "standalone" && (!v2 || !process.argv.includes("--stdio")))
+    ? { ...config, liveBridge: { enabled: false } } : config
+  const liveBridge = await createLiveBridge({ config: bridgeConfig, client, directory, reporter }).catch((error) => {
     reporter.error("Live control unavailable", error)
     return { async handle() {}, async dispose() {} }
   })

package/src/updates.js

@@ -1,4 +1,4 @@
-export const PLUGIN_VERSION = "0.8.0"
+export const PLUGIN_VERSION = "0.8.2"
 
 const PACKAGE_NAME = "backeer-opencode"
 const NPM_REGISTRY_URL = "https://registry.npmjs.org"