commandmate 0.42.1 → 0.43.0

package/dist/server/src/lib/hooks/sources/opencode-v2/client.js

@@ -0,0 +1,422 @@
+"use strict";
+/**
+ * HTTP client for an OpenCode V2 server CommandMate started (Issue #2934).
+ *
+ * Three calls, all to the loopback server `scripts/opencode-v2/launch.sh` runs
+ * in the instance's pane:
+ *
+ *  - {@link probeOpencodeV2Server}: `GET /openapi.json` — the same request the
+ *    wrapper waits on before it starts the TUI;
+ *  - {@link openOpencodeV2EventStream}: `GET /api/event`, the SSE stream the
+ *    subscription reads its state from;
+ *  - {@link fetchOpencodeV2SessionMessagesPage}: `GET /api/session/{id}/message`,
+ *    the stored turns History is written from (Issue #2940);
+ *  - the approval and question calls (Issue #2945): list what is pending
+ *    (`GET /api/permission/request`, `GET /api/form`,
+ *    `GET /api/session/{id}/form`) and answer it
+ *    (`POST …/permission/{requestID}/reply`, `POST …/form/{formID}/reply`).
+ *
+ * All authenticate with Basic `opencode:<password>`, the password read from
+ * the instance's file (`./secrets`) at call time. The value is put into a
+ * header and nowhere else — never into a URL, an error message or a log field.
+ *
+ * Wire format measured on 2.0.18 (#2370 Phase 0): every frame is one
+ * `data: {id, created?, type, location?, data, durable?}` line, and between
+ * frames the server sends `: heartbeat` comment lines. An unauthenticated
+ * request to any route answers 401.
+ *
+ * @module lib/hooks/sources/opencode-v2/client
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPENCODE_V2_CONTEXT_MESSAGE_WINDOW = exports.MAX_OPENCODE_V2_DECISION_BODY_CHARS = exports.OPENCODE_V2_DECISION_TIMEOUT_MS = exports.OPENCODE_V2_MESSAGES_PAGE_SIZE = exports.MAX_OPENCODE_V2_MESSAGES_BODY_CHARS = exports.OPENCODE_V2_MESSAGES_TIMEOUT_MS = exports.MAX_OPENCODE_V2_SSE_FRAME_CHARS = exports.OPENCODE_V2_PROBE_TIMEOUT_MS = exports.OPENCODE_V2_SERVER_USER = exports.OPENCODE_V2_SERVER_HOST = void 0;
+exports.opencodeV2BaseUrl = opencodeV2BaseUrl;
+exports.opencodeV2AuthorizationHeader = opencodeV2AuthorizationHeader;
+exports.probeOpencodeV2Server = probeOpencodeV2Server;
+exports.createOpencodeV2SseParser = createOpencodeV2SseParser;
+exports.parseOpencodeV2Frame = parseOpencodeV2Frame;
+exports.openOpencodeV2EventStream = openOpencodeV2EventStream;
+exports.iterateOpencodeV2Stream = iterateOpencodeV2Stream;
+exports.fetchOpencodeV2SessionMessagesPage = fetchOpencodeV2SessionMessagesPage;
+exports.fetchOpencodeV2PendingPermissions = fetchOpencodeV2PendingPermissions;
+exports.fetchOpencodeV2PendingForms = fetchOpencodeV2PendingForms;
+exports.fetchOpencodeV2SessionForms = fetchOpencodeV2SessionForms;
+exports.replyOpencodeV2Permission = replyOpencodeV2Permission;
+exports.replyOpencodeV2Form = replyOpencodeV2Form;
+exports.fetchOpencodeV2Session = fetchOpencodeV2Session;
+exports.fetchOpencodeV2RecentMessages = fetchOpencodeV2RecentMessages;
+exports.fetchOpencodeV2Models = fetchOpencodeV2Models;
+const event_mapper_1 = require("../event-mapper");
+/** The only host OpenCode V2 servers are started on and dialled at. */
+exports.OPENCODE_V2_SERVER_HOST = '127.0.0.1';
+/** The Basic-auth user name `opencode2 serve` expects. */
+exports.OPENCODE_V2_SERVER_USER = 'opencode';
+/** How long one probe may take before it counts as unreachable. */
+exports.OPENCODE_V2_PROBE_TIMEOUT_MS = 2_000;
+/**
+ * Largest frame accepted off the stream, in characters.
+ *
+ * `permission.asked` carries a unified diff in `metadata.files[].patch`, so a
+ * frame is not small; but a frame that never ends must not grow without bound
+ * inside a long-lived server process either.
+ */
+exports.MAX_OPENCODE_V2_SSE_FRAME_CHARS = 4 * 1024 * 1024;
+/** Base URL of an instance's server. */
+function opencodeV2BaseUrl(port) {
+    return `http://${exports.OPENCODE_V2_SERVER_HOST}:${port}`;
+}
+/** The `Authorization` header value for a password. */
+function opencodeV2AuthorizationHeader(password) {
+    return `Basic ${Buffer.from(`${exports.OPENCODE_V2_SERVER_USER}:${password}`).toString('base64')}`;
+}
+/**
+ * Whether the server on `port` is up and accepts `password`.
+ *
+ * `rejected` is the answer that matters for reattachment: something is
+ * listening, but not a server holding this instance's password — a different
+ * process took the port, and subscribing to it would read someone else's
+ * events.
+ */
+async function probeOpencodeV2Server(port, password) {
+    try {
+        const response = await fetch(`${opencodeV2BaseUrl(port)}/openapi.json`, {
+            headers: { Authorization: opencodeV2AuthorizationHeader(password) },
+            redirect: 'error',
+            signal: AbortSignal.timeout(exports.OPENCODE_V2_PROBE_TIMEOUT_MS),
+        });
+        await response.body?.cancel().catch(() => { });
+        return response.status === 200
+            ? { kind: 'healthy' }
+            : { kind: 'rejected', status: response.status };
+    }
+    catch {
+        return { kind: 'unreachable' };
+    }
+}
+/** A fresh {@link OpencodeV2SseParser}. */
+function createOpencodeV2SseParser() {
+    let buffer = '';
+    let data = [];
+    let dataChars = 0;
+    let oversized = false;
+    let oversizedCount = 0;
+    const dispatch = (items) => {
+        if (oversized)
+            oversizedCount += 1;
+        else if (data.length > 0)
+            items.push({ kind: 'frame', data: data.join('\n') });
+        data = [];
+        dataChars = 0;
+        oversized = false;
+    };
+    const takeLine = (line, items) => {
+        if (line === '') {
+            dispatch(items);
+            return;
+        }
+        if (line.startsWith(':')) {
+            items.push({ kind: 'heartbeat' });
+            return;
+        }
+        if (!line.startsWith('data:'))
+            return;
+        if (oversized)
+            return;
+        const value = line.slice(5).replace(/^ /, '');
+        dataChars += value.length;
+        if (dataChars > exports.MAX_OPENCODE_V2_SSE_FRAME_CHARS) {
+            oversized = true;
+            data = [];
+            return;
+        }
+        data.push(value);
+    };
+    return {
+        push(chunk) {
+            const items = [];
+            buffer += chunk;
+            let newline = buffer.search(/\r?\n|\r/);
+            while (newline !== -1) {
+                const line = buffer.slice(0, newline);
+                const width = buffer.startsWith('\r\n', newline) ? 2 : 1;
+                buffer = buffer.slice(newline + width);
+                takeLine(line, items);
+                newline = buffer.search(/\r?\n|\r/);
+            }
+            if (buffer.length > exports.MAX_OPENCODE_V2_SSE_FRAME_CHARS) {
+                // One unterminated line longer than any frame: drop it rather than
+                // hold it. The event it belongs to is counted as oversized.
+                buffer = '';
+                oversized = true;
+            }
+            return items;
+        },
+        flush() {
+            const items = [];
+            if (buffer !== '')
+                takeLine(buffer, items);
+            buffer = '';
+            dispatch(items);
+            return items;
+        },
+        oversizedFrames() {
+            return oversizedCount;
+        },
+    };
+}
+/** JSON object, or null for anything else. */
+function parseOpencodeV2Frame(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return (0, event_mapper_1.isPlainObject)(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Open `GET /api/event`.
+ *
+ * Resolves once the response headers are in — the instant the server has
+ * accepted the subscription — and rejects on anything but a `200
+ * text/event-stream`, so the caller's reconnect loop is the only error path.
+ *
+ * @param port - The instance's server
+ * @param password - The instance's password
+ * @param signal - Aborted to close the stream
+ */
+async function openOpencodeV2EventStream(port, password, signal) {
+    const response = await fetch(`${opencodeV2BaseUrl(port)}/api/event`, {
+        signal,
+        redirect: 'error',
+        headers: {
+            Accept: 'text/event-stream',
+            Authorization: opencodeV2AuthorizationHeader(password),
+        },
+    });
+    if (!response.ok || !response.body) {
+        await response.body?.cancel().catch(() => { });
+        throw new Error(`opencode2 /api/event responded ${response.status}`);
+    }
+    const contentType = response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase();
+    if (contentType !== 'text/event-stream') {
+        await response.body.cancel().catch(() => { });
+        throw new Error(`opencode2 /api/event answered ${contentType ?? 'no content-type'}`);
+    }
+    return iterateOpencodeV2Stream(response.body.getReader());
+}
+/** Parse an open body into items until it ends. */
+async function* iterateOpencodeV2Stream(reader) {
+    const decoder = new TextDecoder();
+    const parser = createOpencodeV2SseParser();
+    const convert = function* (items) {
+        for (const item of items) {
+            if (item.kind === 'heartbeat') {
+                yield item;
+                continue;
+            }
+            const frame = parseOpencodeV2Frame(item.data);
+            if (frame)
+                yield { kind: 'frame', frame };
+        }
+    };
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            yield* convert(parser.push(decoder.decode(value, { stream: true })));
+        }
+        yield* convert(parser.flush());
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+}
+/** How long one `GET /api/session/{id}/message` may take (Issue #2940). */
+exports.OPENCODE_V2_MESSAGES_TIMEOUT_MS = 5_000;
+/** Largest `/message` response body accepted, in characters (Issue #2940). */
+exports.MAX_OPENCODE_V2_MESSAGES_BODY_CHARS = 8 * 1024 * 1024;
+/** Messages asked for per page (Issue #2940). */
+exports.OPENCODE_V2_MESSAGES_PAGE_SIZE = 100;
+/**
+ * One page of `GET /api/session/{id}/message` (Issue #2940).
+ *
+ * Measured on 2.0.18: `{data: [...], cursor: {previous, next}}`, newest first
+ * with `order=desc`. `cursor.next` walks towards older messages and must be
+ * sent without `order`.
+ *
+ * @param cursor - `cursor.next` of the previous page, or null for the newest page
+ * @returns The page, or null when the server did not answer it (any status but
+ *   200, a timeout, a body that is not the expected object). Never throws.
+ */
+async function fetchOpencodeV2SessionMessagesPage(port, password, sessionId, cursor) {
+    const query = new URLSearchParams({ limit: String(exports.OPENCODE_V2_MESSAGES_PAGE_SIZE) });
+    if (cursor === null)
+        query.set('order', 'desc');
+    else
+        query.set('cursor', cursor);
+    try {
+        const response = await fetch(`${opencodeV2BaseUrl(port)}/api/session/${encodeURIComponent(sessionId)}/message?${query}`, {
+            headers: {
+                Accept: 'application/json',
+                Authorization: opencodeV2AuthorizationHeader(password),
+            },
+            redirect: 'error',
+            signal: AbortSignal.timeout(exports.OPENCODE_V2_MESSAGES_TIMEOUT_MS),
+        });
+        if (response.status !== 200) {
+            await response.body?.cancel().catch(() => { });
+            return null;
+        }
+        const text = await response.text();
+        if (text.length > exports.MAX_OPENCODE_V2_MESSAGES_BODY_CHARS)
+            return null;
+        const parsed = JSON.parse(text);
+        if (!(0, event_mapper_1.isPlainObject)(parsed) || !Array.isArray(parsed.data))
+            return null;
+        const next = (0, event_mapper_1.isPlainObject)(parsed.cursor) && typeof parsed.cursor.next === 'string'
+            ? parsed.cursor.next
+            : null;
+        return { data: parsed.data, next };
+    }
+    catch {
+        return null;
+    }
+}
+// =============================================================================
+// Approvals and questions (Issue #2945)
+// =============================================================================
+/** How long one approval / question request may take (Issue #2945). */
+exports.OPENCODE_V2_DECISION_TIMEOUT_MS = 5_000;
+/** Largest approval / question response body accepted, in characters (Issue #2945). */
+exports.MAX_OPENCODE_V2_DECISION_BODY_CHARS = 4 * 1024 * 1024;
+/**
+ * One authenticated JSON request to an instance's server.
+ *
+ * @returns The status and parsed body, or null when nothing answered (refused
+ *   connection, timeout, a body over the bound or not JSON). Never throws.
+ */
+async function requestOpencodeV2(port, password, method, path, body) {
+    try {
+        const response = await fetch(`${opencodeV2BaseUrl(port)}${path}`, {
+            method,
+            headers: {
+                Accept: 'application/json',
+                Authorization: opencodeV2AuthorizationHeader(password),
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+            },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            redirect: 'error',
+            signal: AbortSignal.timeout(exports.OPENCODE_V2_DECISION_TIMEOUT_MS),
+        });
+        const text = await response.text();
+        if (text.length > exports.MAX_OPENCODE_V2_DECISION_BODY_CHARS)
+            return null;
+        return { status: response.status, body: text === '' ? null : JSON.parse(text) };
+    }
+    catch {
+        return null;
+    }
+}
+/** The `data` array of a 200 list response, or null. */
+function listData(response) {
+    if (response === null || response.status !== 200)
+        return null;
+    return (0, event_mapper_1.isPlainObject)(response.body) && Array.isArray(response.body.data)
+        ? response.body.data
+        : null;
+}
+/**
+ * `GET /api/permission/request` — every approval the server is waiting on
+ * (`Permission.Request[]`). The server is the instance's own, so "every" is
+ * this instance's.
+ *
+ * @returns The entries, or null when the server did not answer the list
+ */
+async function fetchOpencodeV2PendingPermissions(port, password) {
+    return listData(await requestOpencodeV2(port, password, 'GET', '/api/permission/request'));
+}
+/**
+ * `GET /api/form` — every question (`Form.Info[]`) the server is waiting on.
+ *
+ * @returns The entries, or null when the server did not answer the list
+ */
+async function fetchOpencodeV2PendingForms(port, password) {
+    return listData(await requestOpencodeV2(port, password, 'GET', '/api/form'));
+}
+/**
+ * `GET /api/session/{id}/form` — the questions one session is waiting on.
+ *
+ * Where a question's fields are read from when a `form.created` frame arrives
+ * without them (2.0.18 sends the form in the frame as `data.form`).
+ *
+ * @returns The entries, or null when the server did not answer the list
+ */
+async function fetchOpencodeV2SessionForms(port, password, sessionId) {
+    return listData(await requestOpencodeV2(port, password, 'GET', `/api/session/${encodeURIComponent(sessionId)}/form`));
+}
+/**
+ * `POST /api/session/{sessionID}/permission/{requestID}/reply`.
+ *
+ * Measured on 2.0.18: 204, then `permission.replied` on the stream and the
+ * TUI's dialog closes.
+ *
+ * @returns Whether the server accepted the reply (2xx)
+ */
+async function replyOpencodeV2Permission(port, password, sessionId, requestId, decision, message) {
+    const response = await requestOpencodeV2(port, password, 'POST', `/api/session/${encodeURIComponent(sessionId)}/permission/${encodeURIComponent(requestId)}/reply`, message === undefined ? { decision } : { decision, message });
+    return response !== null && response.status >= 200 && response.status < 300;
+}
+/**
+ * `POST /api/session/{sessionID}/form/{formID}/reply` with `{answer}`.
+ *
+ * Measured on 2.0.18: 204, then `form.replied`. A value the form does not
+ * accept answers 400 (`FormInvalidAnswerError`).
+ *
+ * @returns Whether the server accepted the answer (2xx)
+ */
+async function replyOpencodeV2Form(port, password, sessionId, formId, answer) {
+    const response = await requestOpencodeV2(port, password, 'POST', `/api/session/${encodeURIComponent(sessionId)}/form/${encodeURIComponent(formId)}/reply`, { answer });
+    return response !== null && response.status >= 200 && response.status < 300;
+}
+// =============================================================================
+// Session usage (Issue #2981)
+// =============================================================================
+/** Messages asked for when only the newest assistant message is wanted (Issue #2981). */
+exports.OPENCODE_V2_CONTEXT_MESSAGE_WINDOW = 20;
+/**
+ * `GET /api/session/{id}` — the session's `Session.Info`, cumulative `cost` and
+ * `tokens` included. Measured on 2.0.18: `{data: {...}}`.
+ *
+ * @returns The `data` object, or null when the server did not answer it
+ */
+async function fetchOpencodeV2Session(port, password, sessionId) {
+    const response = await requestOpencodeV2(port, password, 'GET', `/api/session/${encodeURIComponent(sessionId)}`);
+    if (response === null || response.status !== 200)
+        return null;
+    return (0, event_mapper_1.isPlainObject)(response.body) && (0, event_mapper_1.isPlainObject)(response.body.data)
+        ? response.body.data
+        : null;
+}
+/**
+ * The newest {@link OPENCODE_V2_CONTEXT_MESSAGE_WINDOW} entries of
+ * `GET /api/session/{id}/message`, newest first.
+ *
+ * @returns The entries, or null when the server did not answer the list
+ */
+async function fetchOpencodeV2RecentMessages(port, password, sessionId) {
+    const query = new URLSearchParams({
+        limit: String(exports.OPENCODE_V2_CONTEXT_MESSAGE_WINDOW),
+        order: 'desc',
+    });
+    return listData(await requestOpencodeV2(port, password, 'GET', `/api/session/${encodeURIComponent(sessionId)}/message?${query}`));
+}
+/**
+ * `GET /api/model` — the models the server offers, each with
+ * `limit: { context, output, input? }` (2.0.18).
+ *
+ * @returns The entries, or null when the server did not answer the list
+ */
+async function fetchOpencodeV2Models(port, password) {
+    return listData(await requestOpencodeV2(port, password, 'GET', '/api/model'));
+}

package/dist/server/src/lib/hooks/sources/opencode-v2/decision-labels.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * OpenCode V2's own words for the three approval verdicts (Issue #2945 D1).
+ *
+ * The shared list (`STRUCTURED_DECISION_OPTIONS` in `lib/session/structured-prompt`)
+ * is v1's: `Allow once` / `Allow always` / `Reject`. OpenCode V2's TUI draws
+ * `Allow once   Always allow   Reject` (measured on 2.0.18, #2370 Phase 0) — the
+ * middle words the other way round — and a card that says one thing while the
+ * pane beside it says another makes the operator stop and check which is right.
+ * So the surfaces show v2's words for a v2 approval, keyed by the wire reply
+ * (`once` / `always` / `reject`), which is what the number still sends.
+ *
+ * A pure module with no imports, so the browser bundle can read it.
+ *
+ * @module lib/hooks/sources/opencode-v2/decision-labels
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPENCODE_V2_DECISION_LABELS = void 0;
+/** Label per wire reply, in the order v2's TUI draws them. Untranslated, as v1's are. */
+exports.OPENCODE_V2_DECISION_LABELS = {
+    once: 'Allow once',
+    always: 'Always allow',
+    reject: 'Reject',
+};