backeer-opencode 0.8.1 → 0.10.0

package/src/live-bridge-events.js

@@ -1,24 +1,22 @@
-const ID = /^[A-Za-z0-9_-]{1,160}$/
+const ID = /^[A-Za-z0-9_-]+$/
 export const validBridgeID = (value) => typeof value === "string" && ID.test(value)
 
 export function createBridgeSanitizer(secrets = []) {
   const known = secrets.filter((value) => typeof value === "string" && value.length > 0)
   const assistants = new Map()
-  function clipped(value, max = 12_000) {
-    if (typeof value !== "string") return { value: "", truncated: false }
-    let result = value.slice(0, 64_000)
+  function text(value) {
+    if (typeof value !== "string") return ""
+    let result = value
     for (const secret of known) result = result.split(secret).join("[REDACTED]")
     result = result
       .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED PRIVATE KEY]")
       .replace(/\bBearer\s+[^\s"'<>]+/gi, "Bearer [REDACTED]")
       .replace(/\b(?:sk|bgi)_[A-Za-z0-9_-]{12,}|\bsk-[A-Za-z0-9_-]{12,}/g, "[REDACTED]")
       .replace(/((?:api[_-]?key|access[_-]?token|secret|password|authorization)\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]")
-    return { value: result.slice(0, max), truncated: value.length > 64_000 || result.length > max }
+    return result
   }
-  function text(value, max) { return clipped(value, max).value }
   function content(key, value) {
-    const result = clipped(value)
-    return { [key]: result.value, ...(result.truncated ? { truncated: true } : {}) }
+    return { [key]: text(value) }
   }
   function sanitize(event) {
     const p = event?.properties ?? event?.data ?? {}
@@ -30,7 +28,6 @@ export function createBridgeSanitizer(secrets = []) {
       if (!validBridgeID(info?.id)) return undefined
       if (info.role === "assistant") {
         assistants.set(info.id, sessionID)
-        if (assistants.size > 256) assistants.delete(assistants.keys().next().value)
       }
       return info.role === "assistant" ? { ...base, data: {
         messageID: info.id, completed: !!info.time?.completed, failed: !!info.error,

package/src/live-bridge.js

@@ -1,12 +1,12 @@
 import { createServer } from "node:http"
-import { randomUUID, timingSafeEqual } from "node:crypto"
+import { randomUUID, timingSafeEqual, createHash } from "node:crypto"
+import { resolve } from "node:path"
 import { createV1LiveClient } from "./live-bridge-client.js"
 import { createLiveConnectionNotifier, LIVE_HEARTBEAT_MS, LIVE_RECONNECT_MS } from "./live-connection.js"
 import { createBridgeSanitizer, validBridgeID } from "./live-bridge-events.js"
 import { questionSnapshot, resolveQuestionAnswers } from "./live-questions.js"
 import { PLUGIN_VERSION } from "./updates.js"
 
-const LIMITS = { events: 256, bytes: 2_000_000, clients: 8, commands: 1024, commandTTL: 86_400_000, body: 32_768, requests: 16 }
 function failure(status, code) { return Object.assign(new Error(code), { status, code }) }
 function json(response, status, value) {
   if (!response.destroyed && !response.headersSent) {
@@ -16,10 +16,7 @@ function json(response, status, value) {
 }
 async function readBody(request) {
   const chunks = []
-  let bytes = 0
   for await (const chunk of request) {
-    bytes += chunk.length
-    if (bytes > LIMITS.body) throw failure(413, "body_too_large")
     chunks.push(chunk)
   }
   try { return JSON.parse(Buffer.concat(chunks).toString("utf8")) } catch { throw failure(400, "invalid_json") }
@@ -27,7 +24,10 @@ async function readBody(request) {
 
 export async function createLiveBridge({ config, client, directory, reporter }) {
   const options = config.liveBridge
-  if (!options?.enabled) return { handle() {}, async dispose() {}, address: undefined }
+  if (!options?.enabled || (options.projectDirectory !== undefined &&
+      resolve(options.projectDirectory) !== resolve(directory))) {
+    return { handle() {}, async dispose() {}, address: undefined }
+  }
   const token = options.token
   if (typeof token !== "string" || token.length < 32 || token === config.token) {
     throw new Error("Live bridge requires a separate credential of at least 32 characters")
@@ -37,41 +37,46 @@ export async function createLiveBridge({ config, client, directory, reporter })
   const sanitizer = createBridgeSanitizer([token, config.token])
   const epoch = randomUUID()
   const events = [], streams = new Set(), commands = new Map(), states = new Map()
-  let sequence = 0, bytes = 0, active = 0, disposed = false, disposeTask
-  let lookups = 0
-  const lookupWaiters = new Set()
+  let sequence = 0, disposed = false, disposeTask
+  const lookupWaiters = new Set(), lookups = new Map()
   const cursor = () => `${epoch}:${sequence}`
 
-  function lookup(id) {
+  function lookup(id, signal) {
     if (disposed) return Promise.reject(failure(503, "bridge_closed"))
-    if (lookups >= 16) return Promise.reject(failure(429, "session_lookup_busy"))
-    lookups++
+    let entry = lookups.get(id)
+    if (!entry) {
+      entry = { waiters: new Set() }
+      lookups.set(id, entry)
+      const settled = (ok, value) => {
+        lookups.delete(id)
+        for (const finish of [...entry.waiters]) finish(ok, value)
+      }
+      // Retrying readers share one in-flight native lookup for the exact ID.
+      // Aborted HTTP readers are removable subscribers, not retained Promise callbacks.
+      Promise.resolve().then(() => api.get(id)).then(value => settled(true, value), error => settled(false, error))
+    }
     return new Promise((resolve, reject) => {
-      let finished = false
-      const finish = (complete, value) => {
-        if (finished) return
-        finished = true
-        clearTimeout(timer)
+      const finish = (ok, value) => {
+        if (!entry.waiters.delete(finish)) return
         lookupWaiters.delete(cancel)
-        complete(value)
+        signal?.removeEventListener("abort", aborted)
+        if (ok) resolve(value)
+        else reject(value)
       }
-      const cancel = () => finish(reject, failure(503, "bridge_closed"))
-      const timer = setTimeout(() => finish(reject, failure(504, "session_lookup_timed_out")), 1000)
+      const cancel = () => finish(false, failure(503, "bridge_closed"))
+      const aborted = () => finish(false, failure(499, "request_cancelled"))
+      entry.waiters.add(finish)
       lookupWaiters.add(cancel)
-      // The caller's deadline does not release this slot: unsupported SDK
-      // cancellation must not let timed-out, still-running calls accumulate.
-      Promise.resolve().then(() => api.get(id)).then(
-        (value) => { lookups--; finish(resolve, value) },
-        (error) => { lookups--; finish(reject, error) },
-      )
+      signal?.addEventListener("abort", aborted, { once: true })
+      if (signal?.aborted) aborted()
     })
   }
 
-  async function session(id) {
+  async function session(id, signal) {
     if (!validBridgeID(id) || id === "global") throw failure(400, "invalid_session")
     let info
-    try { info = await lookup(id) } catch (error) {
-      if (["session_lookup_busy", "session_lookup_timed_out", "bridge_closed"].includes(error.code)) throw error
+    try { info = await lookup(id, signal) } catch (error) {
+      if (["bridge_closed", "request_cancelled"].includes(error.code)) throw error
       throw failure(404, "session_not_found")
     }
     if (info?.id !== id || typeof info.time?.archived === "number") {
@@ -91,18 +96,12 @@ export async function createLiveBridge({ config, client, directory, reporter })
     const removed = streams.delete(stream)
     clearInterval(stream.heartbeat)
     stream.queue.length = 0
-    stream.queuedBytes = 0
     if (removed && !streams.size && !disposed) connectionNotifications.update(false)
   }
   function write(stream, value) {
     if (!streams.has(stream)) return
     if (stream.blocked) {
       stream.queue.push(value)
-      stream.queuedBytes += Buffer.byteLength(value)
-      if (stream.queuedBytes > LIMITS.bytes) {
-        removeStream(stream)
-        stream.response.destroy()
-      }
       return
     }
     if (!stream.response.write(value)) {
@@ -120,17 +119,9 @@ export async function createLiveBridge({ config, client, directory, reporter })
     if (safe.type === "session.status") states.set(safe.sessionID, safe.data.status)
     if (safe.type === "session.idle") states.set(safe.sessionID, "idle")
     if (safe.type === "session.deleted") states.delete(safe.sessionID)
-    if (states.size > 256) states.delete(states.keys().next().value)
     const record = { id: `${epoch}:${++sequence}`, ...safe, timestamp: Date.now() }
-    let frame = `id: ${record.id}\nevent: backeer.event\ndata: ${JSON.stringify(record)}\n\n`
-    if (Buffer.byteLength(frame) > 32_768) {
-      record.data = { truncated: true }
-      frame = `id: ${record.id}\nevent: backeer.event\ndata: ${JSON.stringify(record)}\n\n`
-    }
-    const size = Buffer.byteLength(frame)
-    events.push({ sequence, sessionID: record.sessionID, frame, size })
-    bytes += size
-    while (events.length > LIMITS.events || bytes > LIMITS.bytes) bytes -= events.shift().size
+    const frame = `id: ${record.id}\nevent: backeer.event\ndata: ${JSON.stringify(record)}\n\n`
+    events.push({ sequence, sessionID: record.sessionID, frame })
     for (const stream of streams) if (!stream.sessionID || stream.sessionID === record.sessionID) write(stream, frame)
   }
   function authorized(request) {
@@ -141,7 +132,7 @@ export async function createLiveBridge({ config, client, directory, reporter })
   }
   function parseCursor(value) {
     if (!value) return { after: 0 }
-    const match = /^([a-f0-9-]{36}):(\d{1,16})$/.exec(value)
+    const match = /^([a-f0-9-]{36}):(\d+)$/.exec(value)
     if (!match) throw failure(400, "invalid_cursor")
     if (match[1] !== epoch) return { gap: "stream_restarted" }
     const after = Number(match[2])
@@ -150,9 +141,6 @@ export async function createLiveBridge({ config, client, directory, reporter })
     return { after }
   }
   function cachedCommand(requestId, sessionID, signature) {
-    for (const [id, command] of commands) {
-      if (command.settled && Date.now() - command.created >= LIMITS.commandTTL) commands.delete(id)
-    }
     const existing = commands.get(requestId)
     if (existing && (existing.sessionID !== sessionID || existing.signature !== signature)) {
       throw failure(409, "request_id_conflict")
@@ -162,17 +150,16 @@ export async function createLiveBridge({ config, client, directory, reporter })
   async function execute(requestId, sessionID, signature, operation, questionId) {
     let command = cachedCommand(requestId, sessionID, signature)
     if (!command) {
-      if (commands.size >= LIMITS.commands) throw failure(429, "command_window_full")
       // Another chat/mobile/native UI may answer too: OpenCode is authoritative.
       // Reserve locally before calling it so concurrent request IDs cannot submit twice.
       if (questionId && [...commands.values()].some(item => item.sessionID === sessionID && item.questionId === questionId)) {
         throw failure(409, "question_reply_already_submitted")
       }
-      command = { sessionID, signature, questionId, created: Date.now(), settled: false,
+      command = { sessionID, signature, questionId,
         result: { requestId, sessionID, ...(questionId ? { questionId } : {}),
           status: questionId ? "answered" : "accepted" } }
       commands.set(requestId, command)
-      command.task = Promise.resolve().then(operation).finally(() => { command.settled = true })
+      command.task = Promise.resolve().then(operation).then(() => undefined)
     }
     await command.task
     return command.result
@@ -182,7 +169,6 @@ export async function createLiveBridge({ config, client, directory, reporter })
     const pending = await api.questions(sessionID)
     if (!Array.isArray(pending)) throw failure(502, "invalid_question_list")
     const own = pending.filter(item => item.sessionID === sessionID)
-    if (own.length > 16) throw failure(413, "too_many_questions")
     return own
   }
   async function route(request, response) {
@@ -191,10 +177,9 @@ export async function createLiveBridge({ config, client, directory, reporter })
         request.headers["x-backeer-project"] !== encodeURIComponent(directory)) {
       return json(response, 409, { error: "project_mismatch" })
     }
-    if (active >= LIMITS.requests) return json(response, 429, { error: "bridge_busy" })
-    active++
-    const timeout = setTimeout(() => json(response, 504, { error: "request_timed_out" }), 15_000)
-    timeout.unref()
+    const controller = new AbortController()
+    const closed = () => controller.abort()
+    response.once("close", closed)
     try {
       const url = new URL(request.url, "http://127.0.0.1")
       if (url.username || url.password) throw failure(400, "invalid_url")
@@ -203,7 +188,7 @@ export async function createLiveBridge({ config, client, directory, reporter })
         const values = Array.isArray(result) ? result : result?.data
         if (!Array.isArray(values)) throw failure(502, "invalid_session_list")
         const own = []
-        for (const info of values.slice(0, 100)) {
+        for (const info of values) {
           if (!validBridgeID(info?.id) || typeof info.time?.archived === "number") continue
           if (api.ownsSession ? await api.ownsSession(info) : (info.location?.directory ?? info.directory) === directory) own.push(info)
         }
@@ -220,11 +205,9 @@ export async function createLiveBridge({ config, client, directory, reporter })
       }
       if (request.method === "GET" && url.pathname === "/v1/events") {
         const selected = url.searchParams.get("sessionID") || undefined
-        if (selected) await session(selected)
+        if (selected) await session(selected, controller.signal)
         const parsed = parseCursor(url.searchParams.get("after") ?? request.headers["last-event-id"])
         if (response.headersSent) return
-        if (streams.size >= LIMITS.clients) throw failure(429, "too_many_streams")
-        clearTimeout(timeout)
         response.writeHead(200, {
           "content-type": "text/event-stream", "cache-control": "no-cache, no-transform",
           "x-accel-buffering": "no", connection: "keep-alive",
@@ -234,7 +217,7 @@ export async function createLiveBridge({ config, client, directory, reporter })
           return
         }
         const stream = { response, sessionID: selected, heartbeat: undefined,
-          blocked: false, queue: [], queuedBytes: 0 }
+          blocked: false, queue: [] }
         streams.add(stream)
         connectionNotifications.update(true)
         request.socket.setTimeout(0)
@@ -244,7 +227,6 @@ export async function createLiveBridge({ config, client, directory, reporter })
           stream.blocked = false
           while (streams.has(stream) && !stream.blocked && stream.queue.length) {
             const next = stream.queue.shift()
-            stream.queuedBytes -= Buffer.byteLength(next)
             write(stream, next)
           }
         })
@@ -259,13 +241,12 @@ export async function createLiveBridge({ config, client, directory, reporter })
         }
         return
       }
-      const match = /^\/v1\/sessions\/([A-Za-z0-9_-]{1,160})(\/instructions|\/questions(?:\/([A-Za-z0-9_-]{1,160})\/answers)?)?$/.exec(url.pathname)
+      const match = /^\/v1\/sessions\/([A-Za-z0-9_-]+)(\/instructions|\/questions(?:\/([A-Za-z0-9_-]+)\/answers)?)?$/.exec(url.pathname)
       if (!match) throw failure(404, "route_not_found")
-      if (request.method === "GET" && !match[2]) return json(response, 200, await session(match[1]))
+      if (request.method === "GET" && !match[2]) return json(response, 200, await session(match[1], controller.signal))
       if (request.method === "GET" && match[2] === "/questions") {
-        await session(match[1])
+        await session(match[1], controller.signal)
         const result = { questions: (await questions(match[1])).map(item => questionSnapshot(item, sanitizer.text)) }
-        if (Buffer.byteLength(JSON.stringify(result)) > 240_000) throw failure(413, "questions_too_large")
         return json(response, 200, result)
       }
       if (request.method !== "POST" || !match[2]) throw failure(405, "method_not_allowed")
@@ -274,8 +255,8 @@ export async function createLiveBridge({ config, client, directory, reporter })
       if (match[3]) {
         if (!body || !validBridgeID(body.requestId) || !/^[a-f0-9]{64}$/.test(body.revision) ||
             Object.keys(body).some(key => !["requestId", "revision", "answers"].includes(key))) throw failure(400, "invalid_question_answer")
-        await session(match[1])
-        const signature = JSON.stringify({ questionId: match[3], revision: body.revision, answers: body.answers })
+        await session(match[1], controller.signal)
+        const signature = createHash("sha256").update(JSON.stringify({ questionId: match[3], revision: body.revision, answers: body.answers })).digest("hex")
         const existing = cachedCommand(body.requestId, match[1], signature)
         if (existing) { await existing.task; return json(response, 200, existing.result) }
         const pending = (await questions(match[1])).find(item => item.id === match[3])
@@ -289,25 +270,24 @@ export async function createLiveBridge({ config, client, directory, reporter })
       }
       if (match[2] !== "/instructions") throw failure(405, "method_not_allowed")
       if (!body || !validBridgeID(body.requestId) || typeof body.prompt !== "string" ||
-          !body.prompt.trim() || body.prompt.length > 16_000 ||
+          !body.prompt.trim() ||
           Object.keys(body).some((key) => !["requestId", "prompt"].includes(key))) throw failure(400, "invalid_instruction")
-      await session(match[1])
+      await session(match[1], controller.signal)
       if (response.headersSent || disposed) return
-      const signature = JSON.stringify({ prompt: body.prompt })
+      const signature = createHash("sha256").update(JSON.stringify({ prompt: body.prompt })).digest("hex")
       const existing = cachedCommand(body.requestId, match[1], signature)
       const result = await execute(body.requestId, match[1], signature, () => api.prompt(match[1], body.prompt))
       return json(response, existing ? 200 : 202, result)
     } catch (error) {
       json(response, error.status ?? 502, { error: error.code ?? "opencode_request_failed" })
     } finally {
-      active--
-      clearTimeout(timeout)
+      response.removeListener("close", closed)
     }
   }
   const server = createServer((request, response) => { void route(request, response) })
-  server.requestTimeout = 15_000
-  server.headersTimeout = 10_000
-  server.keepAliveTimeout = 5_000
+  server.requestTimeout = 0
+  server.headersTimeout = 0
+  server.keepAliveTimeout = 0
   await new Promise((resolve, reject) => {
     server.once("error", reject)
     server.listen(options.port ?? 43871, "127.0.0.1", () => { server.off("error", reject); resolve() })
@@ -325,6 +305,7 @@ export async function createLiveBridge({ config, client, directory, reporter })
         events.length = 0
         states.clear()
         commands.clear()
+        lookups.clear()
         sanitizer.clear()
         api.dispose?.()
       })